Office (OOXML) / .XLSX malware analysis — malicious · 8f1705785b8c87a9

MALICIOUS

Office (OOXML) / .XLSX

38.0 KB Created: 2021-08-03 12:12:36 UTC Authoring application: Microsoft Excel 16.0300

MD5: 47b0d016daf42fa5cda473bea50717b9 SHA-1: 4d68162bad4e1c7033dd28cc90e84740822969c8 SHA-256: 8f1705785b8c87a9f1d3f1fd81d9654e082d6ed5a3aeda88093ad362d88c7f3b

260 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1059.003 Windows Command Shell T1204.002 Malicious File T1071.001 Web Protocols

The sample is a macro-enabled Excel spreadsheet that contains a Workbook_Open macro. This macro calls a function that uses WScript.Shell to execute a command, likely to download and run a second-stage payload. The script uses obfuscated string concatenation to construct its commands, making direct reconstruction of the full URL or command difficult from the provided snippet.

Heuristics 6

Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA
WScript.Shell usage critical OLE_VBA_WSCRIPT

WScript.Shell usage
Workbook_Open macro high OLE_VBA_WBOPEN

Workbook_Open macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
VBA project inside OOXML medium OOXML_VBA

Document contains vbaProject.bin — VBA macros present

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `204bedfe55160a748aa95f5e86df27382d29d732a0ff9b101ca91d2a3866117e`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	4919 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 shell/COM execution token(s). Carved artifact contains 4 long base64-like blob(s). Carved macro source contains an auto-exec entry point and execution/download terms.
`vbaProject_00.bin` `102a93393bdeb4c8335279591017d77be04ea49b4d32d0586ca795d4288b0fed`	vba-project	OOXML VBA project: xl/vbaProject.bin	37376 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 shell/COM execution token(s). Carved artifact contains 5 long base64-like blob(s). Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.