Office (OLE) / .XLSX malware analysis — malicious · 4c9e0da6515b621f

MALICIOUS

Office (OLE) / .XLSX

405.5 KB Created: 2021-02-15 19:29:50 Authoring application: Microsoft Excel

MD5: a39c6293e8a7583bc547024704678781 SHA-1: a5fb7d250d4818287b1815bbb5539db6b1a63c07 SHA-256: 4c9e0da6515b621f41d21f1fd75b30f41ee0765598f1ad4c2a2698f63808445c

300 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1059.003 Windows Command Shell

The sample contains VBA macros, including an Auto_Close macro, which is designed to execute code when the document is closed. Heuristics indicate suspicious cmd.exe invocations and the use of Shell() calls within the VBA code. These elements suggest the macro attempts to launch a command-line process, likely to download and execute a secondary payload.

Heuristics 8

Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA
NOP sled detected high SC_NOP_SLED

Found 20+ consecutive 0x90 bytes
Suspicious cmd.exe invocation with execution flag high SC_STR_CMD

Suspicious cmd.exe invocation with execution flag
Auto_Close macro high OLE_VBA_AUTOCLOSE

Auto_Close macro
cmd.exe reference in VBA high OLE_VBA_CMD

cmd.exe reference in VBA
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code
Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `808678fbf728570d76d5053689763da123e59f0250381817adfe43cbe6ead573`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	4617 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 shell/COM execution token(s).

Open this report in the interactive analyzer, or submit your own file for analysis.