Office (OOXML) / .XLSX malware analysis — malicious · 40544ec4e1b5b8ec

MALICIOUS

Office (OOXML) / .XLSX

54.8 KB Created: 2006-10-11 04:02:12 UTC Authoring application: WPS Office 12.0000

MD5: b44c460bf94c90fd4e249210d6a33de6 SHA-1: e84b6d6bff21613eec6dfbdb945f50af00923285 SHA-256: 40544ec4e1b5b8ec2c78ef66bd65b5089646087f0f77b5c803e478f0765e4b8f

128 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.005 Visual Basic

The document contains VBA macros, indicated by the OOXML_VBA and EXTRACTED_FILE_STATIC_TRIAGE heuristics. The DOC BODY text suggests a fake invoice lure, aligning with the SE_INVOICE_LURE heuristic. The presence of VBA macros and the invoice lure strongly suggest the document is designed to execute malicious code, likely to download a second-stage payload. The OLE_VBA_LOLBIN heuristic further supports the execution of arbitrary code via VBA. The single extracted URL is marked as benign, but the overall pattern is highly suspicious.

Heuristics 5

LOLBin reference in VBA critical OLE_VBA_LOLBIN

LOLBin reference in VBA
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
VBA project inside OOXML medium OOXML_VBA

Document contains vbaProject.bin — VBA macros present
Fake invoice / payment lure low SE_INVOICE_LURE

Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://www.j.mp/ajdddjsdicjosdj

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `866c2efad58b19492d74ab95d45821c8bd6f257a52652df3ab1f8e2f47161aa5`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	1844 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 shell/COM execution token(s).
`vbaProject_00.bin` `82316e0222f5a2379345eaddf79818a66ce3a18f44544d356cc214d57d3446d5`	vba-project	OOXML VBA project: xl/vbaProject.bin	14848 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 2 shell/COM execution token(s). Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.