Office (OOXML) / .XLSM malware analysis — malicious · 8f29eb1623e98052

MALICIOUS

Office (OOXML) / .XLSM

280.6 KB Created: 2021-04-05 15:52:07 UTC Authoring application: Microsoft Excel 15.0300

MD5: 105f6f60bff03c3705c287e98f6a490c SHA-1: bf2bb7a9dc9e972017f316db8f856867b7bcf330 SHA-256: 8f29eb1623e9805210db58460e05962d70de5b4fe754804ad95cf935331461cc

148 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1566.002 Spearphishing with Malicious Attachment

The sample is an XLSM file containing VBA macros, specifically a Workbook_Open macro designed to execute automatically. The script uses CreateObject and Environ calls, and obfuscated strings, indicating it likely downloads and executes a second-stage payload from one of the provided URLs. The presence of a Workbook_Open macro and the obfuscated nature of the script strongly suggest malicious intent.

Heuristics 6

Workbook_Open macro high OLE_VBA_WBOPEN

Workbook_Open macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
VBA project inside OOXML medium OOXML_VBA

Document contains vbaProject.bin — VBA macros present
Environ() call (env variable access) low OLE_VBA_ENVIRON

Environ() call (env variable access)
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://blog.bkbehr.de/wp-content/plugins/seo_index/6rZiKqKrCFGjqnN.php
- https://strangerspassing.by/wp-content/plugins/seo_index/iHATNZvrDSwjYwP.php
- https://strend.net/wp-content/plugins/seo_index/ryOBuYUNW5dpq.php
- https://grupoissa.org/wp-content/plugins/seo_index/QCEp8XgLscY.php
- https://d-shumov.ru/wp-content/plugins/seo_index/dNEk3Em3w8QA.php
- https://porteletbaycafe.com/wp-content/plugins/seo_index/dqhnEAFTkC.php
- https://www.tomhicksphoto.com/wp-content/plugins/seo_index/bsAiWrHJv.php
- https://www.djkuki.com/wp-content/plugins/seo_index/UwfOQnDzgNO.php
- https://ttiops.org/wp-content/plugins/seo_index/pmYGsyscn1.php
- https://pradeshnee.com/wp-content/plugins/seo_index/EDfjbIKwOORx.php

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `f462347973c67119bacf53ff2c07de7dd92a7d5d3dd0a508e70c84fc04e59b14`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	82355 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 23 Chr/ChrW string-construction calls. Carved macro source contains an auto-exec entry point and execution/download terms.
`vbaProject_00.bin` `7a9d252cef5c6acf24b1ff6bf5e10f604289d91bb24e9594f84903e2d104842d`	vba-project	OOXML VBA project: xl/vbaProject.bin	239104 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.