Office (OOXML) / .XLSM malware analysis — malicious · 74f28a4dad71ce2a

MALICIOUS

Office (OOXML) / .XLSM

143.4 KB Created: 2020-06-18 00:46:21 UTC Authoring application: Microsoft Excel 16.0300

MD5: 5628587a1bc8cc65ef2d1c7283319eaf SHA-1: 2aea79b0b48861b2edbebe7180d7b5506f951d56 SHA-256: 74f28a4dad71ce2a455d4ad77fe50105b72b2357c2f34cd96b877498b35838cb

264 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1204.002 Malicious File

The sample is an XLSM file containing a VBA macro with an Auto_Open subroutine. This macro decodes and writes a VBScript to disk at 'C:\ProgramData\poc.vbs'. The VBScript then proceeds to download a second-stage executable from 'https://manikmeyah.net/wp-content/themes/ft/rUCCfunGgRj9MjR.exe' using MSXML2.XMLHTTP. This indicates a downloader functionality, aiming to execute a payload from a remote source.

Heuristics 8

Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA
VBA Base64-decoded Shell command stager critical OLE_VBA_BASE64_SHELL_COMMAND_STAGER

VBA auto-exec macro decodes Base64 string literals into command or script-launch text and executes the result with Shell. This catches cmd/cscript/PowerShell/VBS launchers hidden from plain keyword matching.
Auto_Open macro high OLE_VBA_AUTO

Auto_Open macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
VBA project inside OOXML medium OOXML_VBA

Document contains a VBA project — VBA macros present
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL https://manikmeyah.net/wp-content/themes/ft/rUCCfunGgRj9MjR.exe

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `b728dfb9cbb582032f759816049876435565bb19c5897795a0949d2256b3585f`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	3605 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 3 long base64-like blob(s).
`vbaProject_00.bin` `c7988631181871c4d2a31a377d12bf349d3df981f3ffed080ed997ed8f20ceb5`	vba-project	OOXML VBA project: xl/vbaProject.bin	20480 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 3 long base64-like blob(s).

Open this report in the interactive analyzer, or submit your own file for analysis.