MALICIOUS
140
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1059.001 PowerShell
T1204.002 Malicious File
This XLSX file contains a Workbook_Open VBA macro, a common technique for initial execution. The macro exhibits VBA Chr string obfuscation and uses a GetObject call, indicating it's designed to execute further code. The presence of a 'macros.bas' file and the 'vbaProject.bin' further confirm macro-based execution. The script likely downloads and executes a second-stage payload, but the specific payload and its destination could not be determined from the provided static analysis.
Heuristics 4
-
Workbook_Open macro high OLE_VBA_WBOPENWorkbook_Open macro
-
GetObject call high OLE_VBA_GETOBJGetObject call
-
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGEOne or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
-
VBA project inside OOXML medium OOXML_VBADocument contains vbaProject.bin — VBA macros present
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas6411d103bdd383fa88e7810d7afb6c27fad8b085d2c9e404d71788a7d62477f2 |
vba-macro | oletools.olevba.extract_macros (decoded VBA source from OOXML) | 9388 bytes |
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
Carved artifact contains 22 Chr/ChrW string-construction calls.
|
|||
vbaProject_00.binb8aba95ae6fc8d3df820ae7639e2ad2b1f396c71707b8d4f77740f88fb60f82e |
vba-project | OOXML VBA project: xl/vbaProject.bin | 61440 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.