Office (OOXML) / .XLSM malware analysis — malicious · 537f6064cb160c47

MALICIOUS

Office (OOXML) / .XLSM

435.5 KB Created: 2021-07-28 10:37:27 UTC Authoring application: Microsoft Excel 12.0000

MD5: a7cf7ccfd60c90a42154696ea224d9ab SHA-1: 5e2b6de4fe409dd6ac380492c5be6693eb12290c SHA-256: 537f6064cb160c47c31175d6dc41e54943b7a521bddc36d0ea4eebd4774eea5e

148 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1059.001 PowerShell T1105 Ingress Tool Transfer

The sample is an XLSM file containing a Workbook_Open macro. This macro uses CreateObject to execute a command that appears to download a file to 'C:\Users\Public\Documents\IAccessible2Proxy.exe' and then execute it. The macro also attempts to establish persistence by writing to the registry key 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run\IAccessible2Proxy'. The obfuscated nature of the VBA code and the use of Environ() and Cells() to construct paths and commands suggest a downloader attempting to evade static analysis.

Heuristics 5

Workbook_Open macro high OLE_VBA_WBOPEN

Workbook_Open macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
VBA project inside OOXML medium OOXML_VBA

Document contains vbaProject.bin — VBA macros present
Environ() call (env variable access) low OLE_VBA_ENVIRON

Environ() call (env variable access)

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `2eef94ac69161c2acc2e6b367051d5e6bfd937a6bebd0307b37f3096b3ad8774`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	1146 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved macro source contains an auto-exec entry point and execution/download terms.
`vbaProject_00.bin` `45e4b520df40c224bd212636d03a6eff69dbee3d173de5706e2dd9325ef1b381`	vba-project	OOXML VBA project: xl/vbaProject.bin	9216 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.