Office (OOXML) / .XLSX malware analysis — malicious · 89fef01e8bf5d15a

MALICIOUS

Office (OOXML) / .XLSX

213.0 KB Created: 2000-04-13 21:48:14 UTC Authoring application: Microsoft Excel 12.0000

MD5: 89d0f4a39fc22906a66a870b49186fef SHA-1: d73053f34f22415483962608bb5e0fb579661290 SHA-256: 89fef01e8bf5d15aa8601415aa0a58d40abcfdece7800442058a84a5fa173d5b

140 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 Command and Scripting Interpreter T1071.001 Application Layer Compromise T1566.001 Phishing T1071.002 Remote Services - SMB

The file exhibits multiple indicators of malicious activity, including a VBA macro that executes upon workbook opening, a CreateObject call potentially establishing a command-line interface, and the extraction of suspicious VBA code. The macro's behavior – displaying a message box and attempting to create a scheduled task – strongly suggests an attempt to establish persistence and execute a secondary payload. The extracted VBA code appears to be obfuscated and contains references to potentially malicious functions. The overall pattern aligns with a macro-based downloader or a technique to leverage the trust associated with Excel macros to deliver a payload.

Heuristics 4

Workbook_Open macro high OLE_VBA_WBOPEN

Workbook_Open macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
VBA project inside OOXML medium OOXML_VBA

Document contains vbaProject.bin — VBA macros present

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `1a90ab79c098e6635cf700ddabbb8fa143dc12171dde3d4a0eafa3f2a8474fc8`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	3513 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved macro source contains an auto-exec entry point and execution/download terms.
`vbaProject_00.bin` `fa4f1eb6f682a6d5b17131317c7d9407bfd86a447683ffd8f44ba17e93e78487`	vba-project	OOXML VBA project: xl/vbaProject.bin	16384 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.