Office (OLE) / .XLSX malware analysis — malicious · 7b14612ff42c9c8e

MALICIOUS

Office (OLE) / .XLSX

793.5 KB Created: 2021-06-02 11:14:12 Authoring application: Microsoft Excel

MD5: d24d609e6ac612f69030bfc3695e6aad SHA-1: e9f23049b54de3c828658b7a3e0f2732725201e3 SHA-256: 7b14612ff42c9c8e8abdc45ca2d55abf3ccb523e5787e62b91a2cf2c2a289890

230 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1059.001 PowerShell T1140 Deobfuscate/Decode Files or Information

The file contains a Workbook_Open VBA macro that utilizes CreateObject, a common technique for executing malicious code. This macro is likely responsible for downloading and executing a second-stage payload from one of the embedded URLs. The presence of an appended OLE payload further supports the malicious nature of the file.

Heuristics 8

OLE file has appended executable-looking payload bytes high OLE_APPENDED_PAYLOAD

OLE compound file contains a large high-entropy region beyond the declared major streams and that region includes shellcode, PE, or loader API markers. This is a payload-carrier signal, not a specific CVE attribution by itself.
Workbook_Open macro high OLE_VBA_WBOPEN

Workbook_Open macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code
Environ() call (env variable access) low OLE_VBA_ENVIRON

Environ() call (env variable access)
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — context-specific rules above attribute URLs they actually evaluated; this rule lists URLs that were present in the bytes but were not otherwise tied to a specific finding.
URL https://za$#mW&Fbalit.com/wp-content/p$#mW
- https://bwcreative�
- https://ar�?l?�y�
- https://demohome1.wpbizwon.com/wp-content/themes/twentyninetee
- https://sicam.�r
- https://�reikihe
- https://za$#mW&Fbalit.com/wp-content/p$#mW&Flugins/wordpress-seo/css/dist/3IR10ztB.$#mW&Fphp
- https://sunshineservic85:E.-eproviders.com/wp-content/plugins/w85:E.-2dc/templates/catego85:E.-ries/WS3E2S2dTX7hx.php
- https://bwcreativestudio.com/blog/My:S
- https://arbor23WI1etsens72.fr/23WI1wp-content/themes/t23WI1wentyseventeen/templat23WI1e-part23WI1s/footer/X8FJlzkyXi23WI18ixjn.php
- https://demohome1.wpbizwon.com/wp-content/themes/twentynineteen/template-parts(,A4pOe/cont(,A4pOeent/RDGw3r0D.php
- https://sicam.com.co/wp-content/m+WLp*plugins/contact-form-7/modules/recapm+WLp*tchm+WLp*a/UuS8hhCWiqqIksV.php
- https://atisnteG:Rebestangola.cteG:Rom/wp-teG:RcontentteG:R/plugins/updteG:Rraftplus/central/classes/9oACJwoN92zV.php
- https://reikihealingclinic.in/wb.ba7p-contentb.ba7/plugins/updraftplus/templates/wb.ba7p-admin/UavWtxhL8k.php

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `e526d220d5d8bcb00716ad01bdbd2290457c7ca83dfb148deb29dcc5b2a2db16`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	222372 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.