Office (OOXML) malware analysis — malicious · 9657af01b5d19640

MALICIOUS

Office (OOXML)

76.1 KB Created: 2016-12-09 10:21:15 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2020-07-24

MD5: 02b5f24c7aac17d45f7a5a06e5cb6f80 SHA-1: e25565a3bc1e5c13bdb9e4745e6b5843fdb274cf SHA-256: 9657af01b5d196408c0a26eee29a0932322b40dca8a7876b0c79b28b40dc180c

200 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.005 Visual Basic

This Excel document contains embedded OLE objects, and critically, one of these objects contains a VBA macro project. The presence of a macro project strongly suggests that the document is designed to execute malicious code upon opening, likely through a spearphishing attachment vector. The ClamAV detection further supports its malicious nature.

Heuristics 3

ClamAV: Doc.Macro.Injection-6355574-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Macro.Injection-6355574-0
Embedded Office object carries macros critical OFFICE_EMBEDDED_MACRO_OBJECT

This document embeds a second Office file that itself contains a VBA macro project or an Excel 4.0 (XLM) macro sheet. Hiding a macro-bearing workbook or document inside another document — frequently under an obfuscated, non-standard part name — is a macro-smuggling technique that defeats scanners which only inspect the outer document's macro storage. No benign authoring workflow stages a hidden macro project this way.
Embedded OLE object medium OOXML_OLE_OBJECT

Document contains an embedded OLE object

Extracted artifacts 5

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`ooxml_oleobject_00.bin`	ooxml-ole-object	OOXML embedded OLE part: xl/embeddings/Microsoft_Excel_Worksheet.xlsx	61105 bytes
SHA-256: `32a55b07fc7aba6a319e835c54096dd034c3859a5c48db3ce0e8375f78a45507`
Detection ClamAV: Doc.Macro.Injection-6355574-0 Obfuscation or payload: unlikely
`ooxml_oleobject_01.bin`	ooxml-ole-object	OOXML embedded OLE part: xl/embeddings/Microsoft_Excel_Worksheet.xlsx!xl/embeddings/Microsoft_Excel_Worksheet.xlsx	45082 bytes
SHA-256: `397fc306b6a1aa8ac070cc97b5918b9447136bdee9b9acdf7a82cee84e2e049d`
Detection ClamAV: Doc.Macro.Injection-6355574-0 Obfuscation or payload: unlikely
`ooxml_oleobject_02.bin`	ooxml-ole-object	OOXML embedded OLE part: xl/embeddings/Microsoft_Excel_Worksheet.xlsx!xl/embeddings/Microsoft_Excel_Worksheet.xlsx!xl/embeddings/Microsoft_Excel_Worksheet.xlsx	29988 bytes
SHA-256: `468ddaf679a3b7da8ef8d4ebfa8e00d3ad938a31a5b097f8b2499844a1d12a83`
Detection ClamAV: Doc.Macro.Injection-6355574-0 Obfuscation or payload: unlikely
`ooxml_oleobject_03.bin`	ooxml-ole-object	OOXML embedded OLE part: xl/embeddings/Microsoft_Excel_Worksheet.xlsx!xl/embeddings/Microsoft_Excel_Worksheet.xlsx!xl/embeddings/Microsoft_Excel_Worksheet.xlsx!xl/embeddings/Microsoft_Excel_Macro-Enabled_Worksheet.xlsm	17428 bytes
SHA-256: `0e6209f8f91d9bcc2953672ca7910e44df7539d1118321d599d75b6c900a5b4c`
Detection ClamAV: Doc.Macro.Injection-6355574-0 Obfuscation or payload: unlikely
`emf_00.emf`	ooxml-emf	OOXML EMF part: xl/media/image1.emf	58988 bytes
SHA-256: `8a11ee8837bb53e4cc885ce39ff0423f4b9aa4ccb4eb1a2ec70796cf2cf358ae`

Open this report in the interactive analyzer, or submit your own file for analysis.