Office (OOXML) / .XLSX malware analysis — malicious · 8d6eb0ea0a37d557

MALICIOUS

Office (OOXML) / .XLSX

60.5 KB Created: 2006-10-11 04:02:12 UTC Authoring application: WPS Office 12.0000

MD5: c7bad1cde5a30aa2b665c62a1ebe3548 SHA-1: e4cb443f698d32c572274f379e52e2c8e6296846 SHA-256: 8d6eb0ea0a37d5573bd7a306d12837a74dd2e68a597b42516784b3f2d23743e4

108 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.005 Visual Basic

The document contains VBA macros, indicated by the OOXML_VBA heuristic. The presence of invoice-related language in the document body, combined with the OOXML_EXTERNAL_REL heuristic pointing to a local file path, suggests a social engineering lure. The high-severity EXTRACTED_FILE_STATIC_TRIAGE heuristic further confirms the presence of suspicious VBA code. The primary attack vector appears to be the execution of malicious VBA macros disguised as an invoice.

Heuristics 4

External relationship high OOXML_EXTERNAL_REL

External target in xl/externalLinks/_rels/externalLink2.xml.rels: file:///\\Sskim\최종선적현황\7-9BUY\HS VINA 7-9BUY 최종선적분.xls
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
VBA project inside OOXML medium OOXML_VBA

Document contains vbaProject.bin — VBA macros present
Fake invoice / payment lure low SE_INVOICE_LURE

Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `2969ada02dc6511617daedca3698f824462657b0c9d75ff95715ee8f03659c8c`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	2317 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 3 shell/COM execution token(s).
`vbaProject_00.bin` `65a56afc1c04ae897bb49e61a3bddd261d74ae66f56fae3b96852fbadceb7ad2`	vba-project	OOXML VBA project: xl/vbaProject.bin	16896 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 3 shell/COM execution token(s). Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.