Office (OOXML) / .XLSX malware analysis — malicious · 481ed8fd169c76bc

MALICIOUS

Office (OOXML) / .XLSX

132.9 KB Created: 2020-05-02 09:14:21 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2022-07-27

MD5: 9a20511ba5719152a533b8f7ccfc2aa8 SHA-1: 58c783de42df02a8c29923b8b4b0a1cf8d864bfe SHA-256: 481ed8fd169c76bcef15878eb573a6e953762f9c09d9f7ff55dbf11a9ff1a790

270 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1059.001 PowerShell T1105 Ingress Tool Transfer T1204.002 Malicious File

The sample contains a Workbook_Open macro that utilizes Shell() and CreateObject calls, indicating an attempt to download and execute a payload. The script decodes several Base64 strings, which likely represent URLs or commands for the second-stage payload. The presence of these indicators strongly suggests a downloader or dropper functionality.

Heuristics 8

Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA
VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC

VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
Workbook_Open macro high OLE_VBA_WBOPEN

Workbook_Open macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
VBA project inside OOXML medium OOXML_VBA

Document contains a VBA project — VBA macros present
Environ() call (env variable access) low OLE_VBA_ENVIRON

Environ() call (env variable access)
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `3fb0cbd76b38537fe7fc65b4cbbe62e4158036ed5a0185d183900e355b288920`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	5069 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 long base64-like blob(s).
`vbaProject_00.bin` `7980388f8fe47f096cf9d743d3fa8d5b0fec7ff8fc7f6a408180283e0997b403`	vba-project	OOXML VBA project: xl/vbaProject.bin	37376 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 long base64-like blob(s).

Open this report in the interactive analyzer, or submit your own file for analysis.