Valyria Office (OOXML) / .XLSM malware analysis — malicious · 76b7ae78dfc0e9b8

MALICIOUS

Office (OOXML) / .XLSM

192.2 KB Created: 2006-09-16 00:00:00 UTC Authoring application: Microsoft Excel 12.0000 First seen: 2022-07-05

MD5: 0e2a53f9ffb97e07df6f62348ed7ced8 SHA-1: beac2a38c259fe122a0b75934cef4696e678855a SHA-256: 76b7ae78dfc0e9b88707b6710157e86ea3186c5cd2bb259bbd10df6274eb8794

516 Risk Score

Malware Insights

Valyria · confidence 85%

MITRE ATT&CK

T1059.005 Visual Basic for Applications T1204.002 User Execution: Malicious File T1027 Obfuscated Files or Information T1059.001 name

The sample is a malicious XLSM file that uses a chain of function calls to reach the execution sink. The VBA script uses Base64 encoding to obfuscate strings and uses the same logic to- execute a file named 'XFVPUGVOLmV4ZQ==' (Base64 for 'XUPGVOL.exe')groupId: 85, rationale: 'The sample is a malicious XLSM file that uses a chain of function uma- a file named 'XFVPUGVOL.exe' from the %TEMP% directory. The ClamAV detection 'Xls.Malware.Valyria' directly supports the attribution to the Valyria family.

Heuristics 13

Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA
Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER

Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
Embedded Office object carries macros critical OFFICE_EMBEDDED_MACRO_OBJECT

This document embeds a second Office file that itself contains a VBA macro project or an Excel 4.0 (XLM) macro sheet. Hiding a macro-bearing workbook or document inside another document — frequently under an obfuscated, non-standard part name — is a macro-smuggling technique that defeats scanners which only inspect the outer document's macro storage. No benign authoring workflow stages a hidden macro project this way.
ClamAV: Xls.Malware.Valyria-10036513-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Malware.Valyria-10036513-0
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
Workbook_Open macro high OLE_VBA_WBOPEN

Workbook_Open macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
VBA project inside OOXML medium OOXML_VBA

Document contains a VBA project — VBA macros present
Embedded OLE object medium OOXML_OLE_OBJECT

Document contains an embedded OLE object
Environ() call (env variable access) low OLE_VBA_ENVIRON

Environ() call (env variable access)
Hidden worksheet (hidden) low OOXML_HIDDEN_SHEET

Excel workbook contains 1 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction

Extracted artifacts 5

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `c1fe22d621d9875105ca2d793301dafb13dc55c15fa22b96b855e83a238f4b6e`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	20400 bytes
`ooxml_oleobject_00.bin` `442e0a3d5a46516f267ab8f8c7dd23e3958c6be1f84ab1d8cfe00365934c1339`	ooxml-ole-object	OOXML embedded OLE part: xl/embeddings/oleObject1.bin	6144 bytes
`ooxml_oleobject_01.bin` `542793530faea71c653341657df880c9c796f25ca3d0641bf5e08356739ad82f`	ooxml-ole-object	OOXML embedded OLE part: xl/embeddings/Microsoft_Office_Word_Macro-Enabled_Document1.docm	59113 bytes
Detection ClamAV: Doc.Downloader.Formbook-bc97c1e0c33c3c93-9951465-0 Obfuscation or payload: unlikely
`ooxml_oleobject_02.bin` `d652032cda10eea211680b588319d16f0f87d02925b885467bcd4e16f61a7548`	ooxml-ole-object	OOXML embedded OLE part: xl/vbaProject.bin	54272 bytes
Detection ClamAV: Xls.Malware.Valyria-10036513-0 Obfuscation or payload: likely Carved macro source contains an auto-exec entry point and execution/download terms.
`emf_00.emf` `4b05b9ba750ab743feab26b6e1537454ecc93faa806daf1b6d4906dcbbb08fb3`	ooxml-emf	OOXML EMF part: xl/media/image3.emf	1099960 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.