Malicious Office (OOXML) / .XLSX — malware analysis report

Heuristics 5

• ClamAV: Xls.Dropper.Agent-7382066-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Xls.Dropper.Agent-7382066-0
• NOP sled detected high SC_NOP_SLED
  Found 20+ consecutive 0x90 bytes
  Disassembly hidden — these bytes score as degenerate, not coherent x86 code (single mnemonic 'nop' is 100% of instructions — a sled or padding/filler run, not program logic).
• VBA project inside OOXML medium 1 related finding OOXML_VBA
  Document contains a VBA project — VBA macros present
• VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
  Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download� In document text (OOXML body / shared strings)

  • https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1�In document text (OOXML body / shared strings)

Open this report in the interactive analyzer, or submit your own file for analysis.