MALICIOUS
84
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.005 Visual Basic
The sample is an Excel document containing VBA macros, identified as malicious. The document body lists various telecommunications equipment, suggesting a lure to disguise the malicious intent. The VBA macro code, though partially truncated, contains obfuscated Base64 encoded data and uses Windows API calls for file operations, indicating it likely downloads and executes a second-stage payload. The embedded URL 'http://www.gzwesun.com' is a potential indicator of compromise.
Heuristics 5
-
Heap-spray pattern detected high SC_HEAP_SPRAYRepeated 0x41 (A) bytes found
-
NOP-equivalent sled detected medium SC_NOP_EQUIV_SLEDLong run of 0x41 bytes
-
VBA macros detected medium OLE_VBA_MACROSDocument contains VBA macro code
-
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGEOne or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://www.gzwesun.com
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.basf06f1d88e202fc182cc68f51670319a42bf1a7dbdd05e0e3e0371c4131ca86be |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 17203 bytes |
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
Carved artifact contains 18 long base64-like blob(s).
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.