Malicious Office (OOXML) / .XLSM — malware analysis report

Static analysis result for SHA-256 97af4d9287b8ee07…

MALICIOUS

Office (OOXML) / .XLSM

71.0 KB Created: 2022-05-16 07:03:55 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2022-08-23
MD5: 5e705e3fb3f71000b70a62aa596a9249 SHA-1: 851965be08ef625b6399bc71dcb3dccb1cd25e02 SHA-256: 97af4d9287b8ee07dec0a4f205f85dba4b9f5097f3f216349ac601bb6ac5f765
76 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.005 Visual Basic

The sample is an XLSM file containing VBA macros, indicated by the OOXML_VBA heuristic. The document body presents information resembling disaster relief claims, aligning with the SE_INVOICE_LURE heuristic, suggesting a social engineering pretext. The OOXML_EXTERNAL_REL heuristic points to a potentially malicious external reference within the document. While the VBA code itself appears to be related to worksheet cell manipulation, the presence of macros and the lure suggest the primary intent is to execute further malicious actions, likely through the embedded VBA project.

Heuristics 4

  • External relationship high OOXML_EXTERNAL_REL
    External target in xl/externalLinks/_rels/externalLink1.xml.rels: file:///C:\Users\issasa\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\TJV9GU25\Excel Snapshot Template (002)
  • VBA project inside OOXML medium OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Hidden worksheet (hidden) low OOXML_HIDDEN_SHEET
    Excel workbook contains 6 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction
  • Fake invoice / payment lure low SE_INVOICE_LURE
    Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
664be631cd32c0e1128f53dba3418d1cc3b3cc77b0a332ec368296d99897a284		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 2728 bytes
vbaProject_00.bin
fecb85ae8702ca3dc7100473899c552f483c51b252d142d5664a17d080492dc4		 vba-project OOXML VBA project: xl/vbaProject.bin 19968 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.