Office (OOXML) / .XLSM malware analysis — malicious · 49ebd46b665fea87

MALICIOUS

Office (OOXML) / .XLSM

28.8 KB Created: 2022-04-27 13:09:33 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2022-05-10

MD5: 9768ccdcede716416de0e725fa1dbe71 SHA-1: a7a38f44f477005a4e00a2f58012bcafebb4c018 SHA-256: 49ebd46b665fea87543edc8ab53f27ee0822f42f208a9336a830feee1bc3c8f8

350 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1059.001 PowerShell T1204.002 Malicious File T1071.001 Web Protocols T1105 Ingress Tool Transfer

The sample is an XLSM file containing an Auto_Open VBA macro. This macro utilizes WScript.Shell and CreateObject to call URLDownloadToFile, which downloads a file from http://www.opaengola.com/ttt.zip. The document body presents a fake procurement form and instructs the user to enable content, indicating a social engineering lure. The VBA script's primary function is to download and execute a second-stage payload.

Heuristics 10

Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA
WScript.Shell usage critical OLE_VBA_WSCRIPT

WScript.Shell usage
URLDownloadToFile in VBA critical OLE_VBA_DOWNLOAD

URLDownloadToFile in VBA
Auto_Open macro high OLE_VBA_AUTO

Auto_Open macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
VBA project inside OOXML medium OOXML_VBA

Document contains vbaProject.bin — VBA macros present
Macro/content-enable lure medium SE_ENABLE_LURE

Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
Environ() call (env variable access) low OLE_VBA_ENVIRON

Environ() call (env variable access)
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://www.opaengola.com/ttt.zip

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `4207a70fc0954903c8947bf5128ea8a451f2fcbe38b868f45dede0677326f305`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	4204 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 2 shell/COM execution token(s). Carved macro source contains an auto-exec entry point and execution/download terms.
`vbaProject_00.bin` `1f558d77b5751ab6e6effd1a52d38b96ad634b688ee18ec841fe6570ff7c0053`	vba-project	OOXML VBA project: xl/vbaProject.bin	28160 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 2 shell/COM execution token(s). Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.