Office (OOXML) / .XLSM malware analysis — suspicious · 87406923a7f9e0fd

SUSPICIOUS

Office (OOXML) / .XLSM

389.9 KB Created: 2020-01-28 19:47:00 UTC Authoring application: Microsoft Excel 15.0300

MD5: 7124f497798d7e456e49a1c1d95b74b5 SHA-1: 93b1ac410aa872939c2f3f769e4f42c570ae550f SHA-256: 87406923a7f9e0fde408bc6ca9828bafe5200e1326825a98c2830a1fd93a84fd

40 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The sample is an XLSM file containing VBA macros that attempt to download and execute a PowerShell payload. The VBA code constructs a URL by concatenating strings and then uses PowerShell to download and execute the file from that URL. The document also contains a lure to enable macros, a common tactic for malware droppers.

Heuristics 6

Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA
VBA project inside OOXML medium OOXML_VBA

Document contains a VBA project — VBA macros present
Macro/content-enable lure medium SE_ENABLE_LURE

Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
External hyperlinks (6) low OOXML_EXTERNAL_HYPERLINKS

Document contains 6 external hyperlinks — clickable URLs are stored as external relationships. First target: https://go.microsoft.com/fwlink/?linkid=844736
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://go.microsoft.com/fwlink/?linkid=844736
- http://go.microsoft.com/fwlink/?LinkId=844969
- https://go.microsoft.com/fwlink/?linkid=844749
- https://go.microsoft.com/fwlink/?linkid=844741
- https://go.microsoft.com/fwlink/?linkid=844732
- https://go.microsoft.com/fwlink/?linkid=844725
- https://go.microsoft.com/fwlink/?linkid=844742
- https://go.microsoft.com/fwlink/?linkid=844734
- https://go.microsoft.com/fwlink/?linkid=844751
- https://go.microsoft.com/fwlink/?linkid=844745
- https://go.microsoft.com/fwlink/?linkid=844743
- https://go.microsoft.com/fwlink/?linkid=844728
- https://go.microsoft.com/fwlink/?linkid=844746
- https://go.microsoft.com/fwlink/?linkid=844747
- https://go.microsoft.com/fwlink/?linkid=844726
- https://go.microsoft.com/fwlink/?linkid=844738
- https://go.microsoft.com/fwlink/?linkid=844735
- https://go.microsoft.com/fwlink/?linkid=844750
- http://go.microsoft.com/fwlink/?LinkId=846285
Macro capabilities present but unconfirmed info MACRO_CAPABILITY_UNCORROBORATED

The document's VBA exposes execution capabilities (Shell/WScript/CreateObject/auto-exec) but nothing corroborates malicious intent — no obfuscation, memory-exec primitive, download+exec chain, encoded payload, LOLBin, DDE, AV hit, or suspicious URL. The verdict was capped at 'suspicious' so legitimate macro-heavy business documents are not flagged malicious on capability presence alone.

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `0d236f8232a1dafe9f81a596357e89ac69a9471bac4c2f6a9c7310af2161b43a`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	6024 bytes
`vbaProject_00.bin` `1f02986f88e8f4f7f82a9a429906c9aa5e481c950a25bb294a19ea632f2c5fe4`	vba-project	OOXML VBA project: xl/vbaProject.bin	10752 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.