Office (OOXML) / .XLSX malware analysis — malicious · 690cb1f68b15a544

MALICIOUS

Office (OOXML) / .XLSX

7.56 MB First seen: 2026-03-07

MD5: 6db2018760b44e7e8d2fa3603c40988f SHA-1: 5890ae555fd273293543a6ebb61d1d32e203448c SHA-256: 690cb1f68b15a54438509e1ec1ce57bd1c617ce6c429a62a694b85da9c09542c

290 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1204.002 Malicious File

The sample is a macro-enabled XLSX file containing a Workbook_Open macro that is heavily obfuscated. The script utilizes CreateObject() and Shell() functions to download and execute a second-stage payload. It constructs paths within the user's AppData and Documents directories, suggesting an attempt to stage and run malicious content. The presence of obfuscated auto-execution logic and the use of shell execution functions strongly indicate a downloader or dropper functionality.

Heuristics 9

Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA
Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER

Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
Workbook_Open macro high OLE_VBA_WBOPEN

Workbook_Open macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
VBA project inside OOXML medium OOXML_VBA

Document contains a VBA project — VBA macros present
Embedded OLE object medium OOXML_OLE_OBJECT

Document contains an embedded OLE object
Environ() call (env variable access) low OLE_VBA_ENVIRON

Environ() call (env variable access)
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 8

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `9b88482203710e0db5866760b69867b4369aa6de01203761052adfd85c940a97`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	6189 bytes
`ooxml_oleobject_00.bin` `76972fe0cb6de83bae8f7997683e45c3e5cfa1e116baf8dc60a4c633609d332c`	ooxml-ole-object	OOXML embedded OLE part: xl\embeddings\oleObject5.bin	7741060 bytes
`ooxml_oleobject_01.bin` `e3135864d4409d624002b3149f47e07760c9cf1f15dc3bf880ff1bc7e957374d`	ooxml-ole-object	OOXML embedded OLE part: xl\embeddings\oleObject11.bin	231652 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 long base64-like blob(s).
`ooxml_oleobject_02.bin` `9d2c1fb900d66157bda150bf394e453fb3b1645a12e34e735944957b397575d1`	ooxml-ole-object	OOXML embedded OLE part: xl\embeddings\oleObject07.bin	231584 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 long base64-like blob(s).
`ooxml_oleobject_03.bin` `6f61ae4d23e8d65a918560635373dcefbe9c871f595218cfc0d4c90dcbda851e`	ooxml-ole-object	OOXML embedded OLE part: xl\embeddings\oleObject4.bin	9436 bytes
`ooxml_oleobject_04.bin` `436872111e379a00e4a983a6f188434b881503fa42fe2070d388c22a9d1686d4`	ooxml-ole-object	OOXML embedded OLE part: xl\embeddings\oleObject3.bin	10765 bytes
`ooxml_oleobject_05.bin` `707e941bf6fcd4c83afa250bb96d0d790f0e52bef6af92749213bbd64cc7e76f`	ooxml-ole-object	OOXML embedded OLE part: xl\embeddings\oleObject10.bin	231656 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 long base64-like blob(s).
`vbaProject_00.bin` `f7df80d9ab3f9f6e5ef77499035786b543288837a65bd804b04621160d6e9333`	vba-project	OOXML VBA project: xl\vbaProject.bin	24576 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.