Office (OOXML) / .XLSM malware analysis — malicious · 41e35586c4481089

MALICIOUS

Office (OOXML) / .XLSM

43.1 KB Created: 2020-01-28 19:47:00 UTC Authoring application: Microsoft Excel 16.0300

MD5: 055db9a47d18151bc7bce54985e93150 SHA-1: df2300b19d72d8f4e923f0d85444bb529f98ac45 SHA-256: 41e35586c44810891de06d96470a2a939ffabff6f3697900467e109f5f8535de

110 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File T1566.001 Spearphishing Attachment

The VBA macro within the Excel file contains a Shell() call that constructs and executes a PowerShell command. This command is designed to download a file from 'http://lovezaday.exe' and execute it. The document also contains a lure to enable macros, a common tactic for macro-based malware delivery. The PowerShell command is obfuscated using Base64 encoding.

Heuristics 5

Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA
VBA project inside OOXML medium OOXML_VBA

Document contains vbaProject.bin — VBA macros present
Macro/content-enable lure medium SE_ENABLE_LURE

Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
External hyperlinks (3) low OOXML_EXTERNAL_HYPERLINKS

Document contains 3 external hyperlinks — clickable URLs are stored as external relationships. First target: http://go.microsoft.com/fwlink/?LinkId=846285
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://go.microsoft.com/fwlink/?LinkId=846285
- http://go.microsoft.com/fwlink/?LinkId=844969

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `613d88abf0fbe102999ac0132c2808d0e2434386ebff0d299c80b5eab9e1d572`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	2794 bytes
`vbaProject_00.bin` `9f5969e01db0fabc4ddcc5b07b44400e35583d77d1c79bf4fae3c40b4049cecb`	vba-project	OOXML VBA project: xl/vbaProject.bin	6656 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.