Office (OOXML) / .XLSM malware analysis — malicious · 8bdcc1592ffaee91

MALICIOUS

Office (OOXML) / .XLSM

155.9 KB Created: 2021-04-21 14:23:42 UTC Authoring application: Microsoft Excel 15.0300

MD5: 77f482d7c33d70474d451cf2546f4b4f SHA-1: 9ef86f2a8171e50ec5734886d895885280e029d8 SHA-256: 8bdcc1592ffaee9154ed4331a44fa52af3b2baebbd4ef71840adc73b38635d9e

148 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1059.001 PowerShell T1105 Ingress Tool Transfer

The sample contains a Workbook_Open macro that uses CreateObject to execute code, indicating it's designed to run malicious actions upon opening. The macro likely downloads and executes a second-stage payload from one of the embedded URLs. The document body text suggests a lure related to invoices or payments.

Heuristics 6

Workbook_Open macro high OLE_VBA_WBOPEN

Workbook_Open macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
VBA project inside OOXML medium OOXML_VBA

Document contains vbaProject.bin — VBA macros present
Environ() call (env variable access) low OLE_VBA_ENVIRON

Environ() call (env variable access)
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://mihlodzi.co.za/wastemp/font-awesome/css/ikaXQ4HcVYlFg.php
- https://canadianteenagers.net/old-bkp/themes/dolphin/images/icons/ICETKuHKxf.php
- https://mueblesromero.net/vmfiles/hHXXLCcJv0JgsF.php
- https://ffcs.com.pk/gifts/admin-1504894771/themes/default/css/1TyQel3j.php
- https://streichersquickprint.biz/css/vendor/_notes/TED5iyLtzczFAV.php
- https://cbaebooks.unitedinstitute.org.in/login-files/fonts/Linearicons-Free-v1.0.0/WebFont/aPymRuMPtg.php
- https://live.marizafoods.id/images/gambar_baru/produk/jam/dV3L0zGzQ65Q.php
- https://www.dosashop.com/blog/wp-content/uploads/2020/01/ji4Ss8AIFkrdQ.php
- https://meaningful-marriage.co.za/wp-includes/sodium_compat/namespaced/Core/ChaCha20/Hp8nneMHunkah.php

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `de4129177f1ae0bde5702c9908aea96871da7975fbc75bc82d5e5cfc3f13a6b4`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	9043 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved macro source contains an auto-exec entry point and execution/download terms.
`vbaProject_00.bin` `4257249aae6bd723b70a43b749fd2a198273e547f8b784b0969fadb4a81bdcad`	vba-project	OOXML VBA project: xl/vbaProject.bin	54272 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.