Office (OOXML) / .XLSM malware analysis — malicious · 50b218c6836334dd

MALICIOUS

Office (OOXML) / .XLSM

289.5 KB Created: 2021-04-14 15:32:56 UTC Authoring application: Microsoft Excel 15.0300

MD5: e6979b1f70fceb6961e99aa0162208f3 SHA-1: 25a9a3ce24a802aeae0b966344d22cebc42de81b SHA-256: 50b218c6836334dd548802bc4e66ce8d9e68709e05d4ba2d5639322514215e5c

148 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1566.002 Spearphishing Attachment T1071.001 Web Protocols

The sample is an XLSM file containing VBA macros, specifically a Workbook_Open macro that executes code via CreateObject. This script likely downloads and executes a second-stage payload from one of the embedded URLs. The document body contains a list of URLs and the text 'VIEW OR PRINT', suggesting a lure to click these links. The VBA Chr string obfuscation and auto-execution terms further indicate malicious intent.

Heuristics 6

Workbook_Open macro high OLE_VBA_WBOPEN

Workbook_Open macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
VBA project inside OOXML medium OOXML_VBA

Document contains vbaProject.bin — VBA macros present
Environ() call (env variable access) low OLE_VBA_ENVIRON

Environ() call (env variable access)
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://rewardunlimited.us/tr3O9zb4o5ptybB.php
- https://oremoralesabogados.com.pe/Scripts/WqPCodwcgmkqSZ.php
- https://keisie.university/machform/lib/google-api-client/monolog/monolog/BLWOdJPA.php
- https://quaprosa.com/CNcmUBc40tCbU.php
- https://matchlesstravels.com.pk/backup-12-2-2019/wp-admin/css/colors/blue/lT5C3R1Gcq.php
- https://safraprime.com.br/img/portfolio/full/7CjadBxFsuro.php
- https://fudfest.com/1767/11byp4et0YZIbTY.php
- https://www.dutamasindo.id/template/plugins/bootstrap-submenu/dist/css/s83Po08eRHhSfD5.php
- https://ziengineeringco.com/project-arab-contracting/css/dAHBzO4XG.php
- https://1-world-travel.com/wp-content/plugins/wp_multistore_builder_agency/thumbs/button/xNc4J3iqgpM.php

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `44e03c960603ea3e8a9c9dfd038eb42813908b4fdfbddcd26f70fc766c30804a`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	84449 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 28 Chr/ChrW string-construction calls. Carved macro source contains an auto-exec entry point and execution/download terms.
`vbaProject_00.bin` `d0619a6f5766e81a305d4d466f3e09554bdfc9adff5398dd5598ac49c243afbd`	vba-project	OOXML VBA project: xl/vbaProject.bin	242176 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.