Office (OLE) / .XLSX malware analysis — malicious · 732ca83f379dd429

MALICIOUS

Office (OLE) / .XLSX

34.5 KB Created: 2015-02-25 14:46:23 Authoring application: Microsoft Excel First seen: 2023-02-14

MD5: 60fd0765120838062b1388df89a3e2ea SHA-1: a772969cf99df255ea87dfac69c4d636b080204a SHA-256: 732ca83f379dd429505350fab8d4af4186cdb543acaf58e037961bbe667c0e15

180 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1105 Ingress Tool Transfer

The file contains VBA macros that utilize the URLDownloadToFile API, indicating an intent to download and execute a second-stage payload from a remote source. The presence of CreateObject calls further suggests dynamic execution capabilities. No specific family could be identified, but the technique is common for initial access and payload delivery.

Heuristics 4

Reference to URLDownloadToFile API critical SC_STR_URLDOWNLOAD

Reference to URLDownloadToFile API
URLDownloadToFile in VBA critical OLE_VBA_DOWNLOAD

URLDownloadToFile in VBA
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `51976e69874382bf61830c4178c93c536c183adac373e41d3ffde5ae7f708824`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	5723 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.