Office (OOXML) / .XLSM malware analysis — malicious · 8c44a80c5b7ef52d

MALICIOUS

Office (OOXML) / .XLSM

392.0 KB Created: 2020-01-28 19:47:00 UTC Authoring application: Microsoft Excel 16.0300

MD5: 7e4cea497583a27270f0a7a50388c8ff SHA-1: f47058d0e8010df13335620144d71d44f0e3e327 SHA-256: 8c44a80c5b7ef52d01a5828c26fcbbb99b3e9d85509806cebd4e4b3f10c902bb

112 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File T1566.002 Spearphishing Attachment

The sample is a macro-enabled Excel document designed to trick users into enabling content. Upon enabling, the VBA macro executes a PowerShell command that downloads and runs a second-stage payload from the URL 'https://onedrive.live.com/download?cid=66CAA4B4CE216B79&resid=66CAA4B4CE216B79%21217&authkey=AJD0YmdmkCnNafc'. The PowerShell command is heavily obfuscated but reconstructs to a download and execution routine.

Heuristics 6

Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA
VBA project inside OOXML medium OOXML_VBA

Document contains vbaProject.bin — VBA macros present
Macro/content-enable lure medium SE_ENABLE_LURE

Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
External hyperlinks (4) low OOXML_EXTERNAL_HYPERLINKS

Document contains 4 external hyperlinks — clickable URLs are stored as external relationships. First target: https://go.microsoft.com/fwlink/?linkid=844732
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://go.microsoft.com/fwlink/?linkid=844732
- https://go.microsoft.com/fwlink/?linkid=844741
- https://go.microsoft.com/fwlink/?linkid=844736
- https://go.microsoft.com/fwlink/?linkid=844747
- https://go.microsoft.com/fwlink/?linkid=844746
- https://go.microsoft.com/fwlink/?linkid=844728
- https://go.microsoft.com/fwlink/?linkid=844735
- https://go.microsoft.com/fwlink/?linkid=844725
- https://go.microsoft.com/fwlink/?linkid=844738
- https://go.microsoft.com/fwlink/?linkid=844749
- http://go.microsoft.com/fwlink/?LinkId=846285
- https://go.microsoft.com/fwlink/?linkid=844745
- https://go.microsoft.com/fwlink/?linkid=844751
- https://go.microsoft.com/fwlink/?linkid=844743
- https://go.microsoft.com/fwlink/?linkid=844750
- https://go.microsoft.com/fwlink/?linkid=844726
- https://go.microsoft.com/fwlink/?linkid=844742
- https://go.microsoft.com/fwlink/?linkid=844734
- http://go.microsoft.com/fwlink/?LinkId=844969

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `ecf5a302c4f3c20c32022c20d46134d61035d292a8b2fdfbe4b35d9a4074409e`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	5695 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 long base64-like blob(s).
`vbaProject_00.bin` `ad374191e1c301357be28b0c9c2edab53bd4b76cbb59c3e6241d636edb795b36`	vba-project	OOXML VBA project: xl/vbaProject.bin	10752 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.