Office (OOXML) / .XLSM malware analysis — suspicious · 717657030b01a05e

SUSPICIOUS

Office (OOXML) / .XLSM

143.3 KB Created: 2020-05-26 02:03:39 UTC Authoring application: Microsoft Excel 16.0300

MD5: 40dc6f2bb584fc74f8d5ae65e6accebc SHA-1: 078e37effb58c551c7d2aaf8db67a66ef837cc5a SHA-256: 717657030b01a05ef5489fd6e4d109a5e35fee9d9dda49f3e6b1c59c65dbd3e6

40 Risk Score

Heuristics 7

Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA
Workbook_Open macro high OLE_VBA_WBOPEN

Workbook_Open macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
VBA project inside OOXML medium OOXML_VBA

Document contains a VBA project — VBA macros present
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Macro capabilities present but unconfirmed info MACRO_CAPABILITY_UNCORROBORATED

The document's VBA exposes execution capabilities (Shell/WScript/CreateObject/auto-exec) but nothing corroborates malicious intent — no obfuscation, memory-exec primitive, download+exec chain, encoded payload, LOLBin, DDE, AV hit, or suspicious URL. The verdict was capped at 'suspicious' so legitimate macro-heavy business documents are not flagged malicious on capability presence alone.

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `5028864a05a3b0b75ab27353d14deae67504820ff51fc7a4b7c4d908f458fabe`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	3176 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 long base64-like blob(s).
`vbaProject_00.bin` `047b2bd68c9bfddc7c5f4f6c636369095c2694059254cf324a7f32be9fe7d483`	vba-project	OOXML VBA project: xl/vbaProject.bin	19456 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 long base64-like blob(s).

Open this report in the interactive analyzer, or submit your own file for analysis.