Malicious Office (OOXML) / .XLSX — malware analysis report

Static analysis result for SHA-256 6c3e2de1ae1bd652…

MALICIOUS

Office (OOXML) / .XLSX

60.6 KB Created: 2006-10-11 04:02:12 UTC Authoring application: WPS Office 12.0000
MD5: ab00a2b6e072cd6a7adac6a227e129fb SHA-1: 33a115a303e9a12fefa325821c791f42746c45db SHA-256: 6c3e2de1ae1bd65297af6ae24897368d24db8f74a1bb755dfa129dc203691543
168 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The sample contains VBA macros that are obfuscated using split string literals, specifically reassembling the dangerous API name 'mshta'. The Workbook_BeforeClose event triggers a ShellExecute call using a dynamically determined filename and parameters, likely to download and execute a second-stage payload. The document body content, resembling an invoice, supports the lure for this macro-enabled attack.

Heuristics 5

  • Dangerous API name reassembled from split string literals critical OLE_VBA_SPLIT_KEYWORD_OBFUSCATION
    VBA concatenates short string literals that reassemble a dangerous API/ProgID/LOLBin name (e.g. Scripting.FileSystemObject, WScript.Shell, powershell, URLDownloadToFile) which appears in no single literal. Splitting an API name across string concatenation is done only to evade keyword scanning.
  • External relationship high OOXML_EXTERNAL_REL
    External target in xl/externalLinks/_rels/externalLink2.xml.rels: file:///\\Sskim\최종선적현황\7-9BUY\HS VINA 7-9BUY 최종선적분.xls
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • VBA project inside OOXML medium OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Fake invoice / payment lure low SE_INVOICE_LURE
    Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
b91b6e4a6627d628faab243d57564bb3ef098ab29c35d6572605eaa771aa2755		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 2313 bytes
vbaProject_00.bin
5a570b4f0faabb56b1d5d7b22766f7ed01ffa6d8bd680b56ea5700870601820a		 vba-project OOXML VBA project: xl/vbaProject.bin 16896 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.