Office (OOXML) / .XLSM malware analysis — malicious · 655542e0dfb02e09

MALICIOUS

Office (OOXML) / .XLSM

39.8 KB Created: 2022-06-14 07:34:15 UTC Authoring application: 16.0300 First seen: 2022-06-14

MD5: 35a2595870988f473166a590888baec1 SHA-1: 46a0673626c3ef32f248fc060b9dcfb18da88e8c SHA-256: 655542e0dfb02e09a56576a67e6565288e97820a507bffe64ce86af06d13b633

88 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1204.002 Malicious File

The sample is an XLSM file containing VBA macros. A critical heuristic identified the use of URLDownloadToFileA, indicating the macro attempts to download a file from the internet. The VBA script explicitly uses the URLDownloadToFileA function, strongly suggesting it downloads and executes a second-stage payload. The presence of VBA macros and the download functionality points to a macro-based downloader.

Heuristics 3

URLDownloadToFile in VBA critical OLE_VBA_DOWNLOAD

URLDownloadToFile in VBA
VBA project inside OOXML medium OOXML_VBA

Document contains a VBA project — VBA macros present
Environ() call (env variable access) low OLE_VBA_ENVIRON

Environ() call (env variable access)

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `3a261aeaf3241dfa83d986e2cb7375c8bc853018536bdd0c2eeb56f7267e99e2`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	10418 bytes
`vbaProject_00.bin` `332fef2c8110291c9f0c320058d3cf7524c466580eb22ff15dc0300398599ef7`	vba-project	OOXML VBA project: xl/vbaProject.bin	37888 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.