Office (OOXML) / .XLSM malware analysis — malicious · 7bd83bdf703998e5

MALICIOUS

Office (OOXML) / .XLSM

70.2 KB Created: 2021-04-28 11:55:19 UTC Authoring application: Microsoft Excel 15.0300

MD5: a390ebe3d126bdf2170ea32003aa62d4 SHA-1: 2726a7e06d8955733f3473c11a7d10f0da8bcd70 SHA-256: 7bd83bdf703998e5f10a0c680f640d1f405f8dc4feb1c77fc3ebc4a3bed96ab3

208 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1105 Ingress Tool Transfer

The critical ClamAV heuristic and high-severity VBA heuristics indicate malicious intent. The Workbook_Open macro is designed to execute a VBA script that leverages CreateObject to download and execute a second-stage payload from one of the provided URLs. The presence of a Workbook_Open macro and CreateObject calls strongly suggests a downloader functionality.

Heuristics 7

ClamAV: Xls.Downloader.DridexDarkGreen1020210-9905041-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Downloader.DridexDarkGreen1020210-9905041-0
Workbook_Open macro high OLE_VBA_WBOPEN

Workbook_Open macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
VBA project inside OOXML medium OOXML_VBA

Document contains vbaProject.bin — VBA macros present
Environ() call (env variable access) low OLE_VBA_ENVIRON

Environ() call (env variable access)
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://britblend.com/js/ckeditor/plugins/pastefromword/filter/f80MOEo3kQ.php
- https://imobnascimento.com.br/includes/PHPMailer/L987xdjZEZK.php
- https://admin.guavabits.com/includes/upload/0zRvUytFt5.php
- https://cassiel.com.ar/fonts/font-awesome/css/YGdmxjgBiGTWuo.php
- https://test2.multiversidadglocal.org/availability/condition/group/yui/build/p0R6P2rEX.php
- https://eshitadesai.com/wp-content/plugins/vc-extensions-bundle/shadowcard/css/4xZWXAvQvCQR.php
- https://microconbio.com/wp-content/plugins/revslider/includes/InstagramScraper/dCZxP9cH.php
- https://greatblueinds.com/ajx-admin/ckeditor/plugins/wsc/dialogs/3o9vBeIP3K.php

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `53fe0d4cd1d90943259f3b0c798f4a40d050bf4082cd124fd5a9db9ff4c80deb`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	10015 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved macro source contains an auto-exec entry point and execution/download terms.
`vbaProject_00.bin` `72983187902fd55a0e69c0eb0ee591eac77646d48dd0e6f6e0e1a924bb7d2484`	vba-project	OOXML VBA project: xl/vbaProject.bin	53760 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.