Office (OOXML) / .XLSM malware analysis — malicious · 90763bf058de7d47

MALICIOUS

Office (OOXML) / .XLSM

304.1 KB Created: 2021-04-12 13:26:32 UTC Authoring application: Microsoft Excel 15.0300

MD5: ffda421cad39343ff1f63eac5351a75b SHA-1: 5d4af4d67a7af92553cc9b14482e6b2a16593281 SHA-256: 90763bf058de7d4789f7fccaf109b656da872e27fe6691b47fbe563a3e004d63

148 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1059.001 PowerShell T1204.002 Malicious File

The sample contains a Workbook_Open macro that uses CreateObject, indicating it attempts to execute code upon opening. The macro likely uses VBA Chr string obfuscation to hide its actions, which is a common technique for downloading and executing second-stage payloads from the numerous suspicious URLs found within the document body. The presence of these indicators strongly suggests a malicious intent to compromise the user's system.

Heuristics 6

Workbook_Open macro high OLE_VBA_WBOPEN

Workbook_Open macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
VBA project inside OOXML medium OOXML_VBA

Document contains vbaProject.bin — VBA macros present
Environ() call (env variable access) low OLE_VBA_ENVIRON

Environ() call (env variable access)
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://kplmrdentalcare.com/wp-content/themes/demonishrana/template-parts/footer/d1kzqnUrzgy.php
- https://citricosdealhaurin.com/wp-includes/js/tinymce/plugins/charmap/OTyExtSOwCzVd.php
- https://seyfertnetworks.com/wp-content/themes/twentyseventeen/template-parts/footer/yZguO5nM3.php
- https://blog.greendreammarriage.com/wp-content/plugins/js_composer/include/autoload/aYr15A3gUH9gv5.php
- https://crismello.com/wp-content/plugins/mesmerize-companion/vendor/bin/DofsNiTnpSYC.php
- https://jayantapaul.tdejob.work/RgB7UOLZcxf.php
- https://ims.seebonerp.com/system/database/drivers/pdo/subdrivers/aRCyPrs9HGh.php
- https://eg.digitsector.com/welcome/exporting-server/java/highcharts-export/highcharts-export-convert/Y7SMWsvOuDiWby.php
- https://tourreward.cf/icon/h4YS2FuNnckgnb.php
- https://barcellos.gg/wp-includes/js/tinymce/skins/lightgray/ufE92n8BCkRR5j.php

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `b0650bef29fae3bbdf097b874418939bf24193026fffed0e73d857eff6b792af`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	80824 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 19 Chr/ChrW string-construction calls. Carved macro source contains an auto-exec entry point and execution/download terms.
`vbaProject_00.bin` `775cd860bd8515f9be072fd6fbd4fbac443b90d8fe05834295f965a2021a00fe`	vba-project	OOXML VBA project: xl/vbaProject.bin	239616 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.