Office (OOXML) / .XLSM malware analysis — malicious · 4d0d824a4e5f7ef7

MALICIOUS

Office (OOXML) / .XLSM

185.6 KB

MD5: b7f385dc3ee44fea9c2c31ad147db71c SHA-1: 4137e0f9ff9816b18c9d2d1f5be64fddd8404d9d SHA-256: 4d0d824a4e5f7ef7bc1d5bac31b2e31dc5e0a18d875e612448b8d7c74c40c4f4

220 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File

The file is an XLSM document containing VBA macros. The document body explicitly contains PowerShell commands that download an executable from a suspicious URL and then execute it. This indicates a downloader or droppper functionality. The ClamAV detection further confirms the malicious nature of the file.

Heuristics 6

ClamAV: Xls.Malware.Sagent-10035294-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Malware.Sagent-10035294-0
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
Visible LOLBin command execution instruction high SE_LOLBIN_RUN_COMMAND

Document contains instructions or visible command text involving Windows script/execution tools such as PowerShell, mshta, cmd, rundll32, or regsvr32
VBA project inside OOXML medium OOXML_VBA

Document contains vbaProject.bin — VBA macros present
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://mirchvdo.xyz/wp-content/plugins/fighter/SG/3333333333.exe

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `df8ffe475c6e1046effb85ac208725c93fec452b74dc53993be2652d8b36566c`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	1890 bytes
`vbaProject_00.bin` `b01c97fda6d437456442306b7e8be148e44194d3170492fb71bf9df4c780221f`	vba-project	OOXML VBA project: xl/vbaProject.bin	5632 bytes
Detection ClamAV: Xls.Malware.Sagent-10035294-0 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.