Malicious Office (OOXML) / .XLSX — malware analysis report

Static analysis result for SHA-256 430a5cad8e1f05ce…

MALICIOUS

Office (OOXML) / .XLSX

2.78 MB Created: 2021-04-18 22:18:27 UTC Authoring application: Microsoft Excel 16.0300
MD5: 2af288c50b186890e36d954d0d21a002 SHA-1: bdd7bdcc70ca5a468b56df237d52062d3fec3273 SHA-256: 430a5cad8e1f05ce7d3c9e4304eb93bc795bf9d4492eab79790db7a97b3745f6
160 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.001 PowerShell T1204.002 Malicious File

The sample is an XLSX file containing VBA macros. A critical heuristic firing indicates the presence of a Shell() call within a Workbook_Open macro, which is a common technique for executing arbitrary commands. This strongly suggests the macro is designed to download and execute a secondary payload. No specific family could be identified, and no external IOCs were extracted.

Heuristics 5

  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • Workbook_Open macro high OLE_VBA_WBOPEN
    Workbook_Open macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA project inside OOXML medium OOXML_VBA
    Document contains vbaProject.bin — VBA macros present
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/spreadsheetml/2006/main
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships
    • http://schemas.openxmlformats.org/markup-compatibility/2006
    • http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac
    • http://schemas.microsoft.com/office/spreadsheetml/2014/revision
    • http://schemas.microsoft.com/office/spreadsheetml/2015/revision2
    • http://schemas.microsoft.com/office/spreadsheetml/2016/revision3

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
b286c863b727f6dcfefc9a27d67de4a3284483584d208d304d1afc2d6ff0dad8		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 8388608 bytes
vbaProject_00.bin
43094b3f68f893beb3c9b70c3ce0fab637576a3244196c9cdbb8bffe4e30e10d		 vba-project OOXML VBA project: xl/vbaProject.bin 3303936 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.