Office (OOXML) / .XLSM malware analysis — malicious · 3a27efe2cf4772b5

MALICIOUS

Office (OOXML) / .XLSM

13.2 KB Created: 2018-09-06 01:19:36 UTC Authoring application: Microsoft Excel 16.0300

MD5: ca95874adad930c6611402fca758f5e4 SHA-1: f4e8b9e3b6ed129d03361feef7e1fbb3aee78019 SHA-256: 3a27efe2cf4772b5689adb301b5da6344eef92e28b057badb4d6be553c838e6f

142 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1204.002 Malicious File

The sample is an XLSM file containing a Workbook_Open macro. This macro uses CreateObject to launch explorer.exe and open the URL http://www.google.com. This technique is commonly used to redirect users to malicious websites or download further payloads. The macro's intent is to open a URL in the default browser.

Heuristics 5

Workbook_Open macro high OLE_VBA_WBOPEN

Workbook_Open macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
VBA project inside OOXML medium OOXML_VBA

Document contains vbaProject.bin — VBA macros present
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://www.google.com

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `50d6da1c69acddbec0112e01ff67cc844dff73c28c9407f563c57cb6cc70247b`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	843 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 shell/COM execution token(s). Carved macro source contains an auto-exec entry point and execution/download terms.
`vbaProject_00.bin` `c106bc6206304b16b57c4b22884b590a85ed8c2e3a4682b932e37de974fc12a4`	vba-project	OOXML VBA project: xl/vbaProject.bin	15872 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 shell/COM execution token(s). Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.