Office (OOXML) / .XLSX malware analysis — malicious · 4a763137ae907f24

MALICIOUS

Office (OOXML) / .XLSX

153.2 KB Created: 2020-03-17 22:14:12 UTC Authoring application: Microsoft Excel 15.0300

MD5: 6e9a33426b63e6f7a353796ad9135f0c SHA-1: 8cb0d4307b571ce19b95bbb0442121b9bf0dda28 SHA-256: 4a763137ae907f2478ae4823431bf1bab8a80f6b0b26a18865f6731de6a0f308

280 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1059 Command and Scripting Interpreter

This XLSX file contains a Workbook_Open VBA macro, which is a common technique for executing malicious code upon opening. The macro utilizes the Shell() function, indicating an intent to download and execute a secondary payload. ClamAV detections further confirm its malicious nature as a dropper.

Heuristics 6

Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA
ClamAV: Xls.Dropper.Agent-7626157-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Dropper.Agent-7626157-0
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
Workbook_Open macro high OLE_VBA_WBOPEN

Workbook_Open macro
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
VBA project inside OOXML medium OOXML_VBA

Document contains vbaProject.bin — VBA macros present

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `05a7ec93e22dba1a8dfe6b1632657aea035e3c3d699364ad9693e50ca8e099df`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	3395 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 long base64-like blob(s). Carved macro source contains an auto-exec entry point and execution/download terms.
`vbaProject_00.bin` `ebd919812fae653669ecf1b15c4b1febfb7e8e4e79be24bfcf3de807ae84b1b5`	vba-project	OOXML VBA project: xl/vbaProject.bin	15872 bytes
Detection ClamAV: Xls.Dropper.Agent-7626157-0 Obfuscation or payload: likely Carved artifact contains 1 long base64-like blob(s). Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.