Malicious Office (OOXML) / .XLSM — malware analysis report

Static analysis result for SHA-256 ae48d05b90ab63fc…

MALICIOUS

Office (OOXML) / .XLSM

14.7 KB Created: 2020-10-08 01:22:15 UTC Authoring application: Microsoft Excel 16.0300
MD5: 37a02440c8b4020af6a27ccbbad0124a SHA-1: c8ac179b46107fd979edc8f6faec2a61bbbaa06d SHA-256: ae48d05b90ab63fc91814a04445c3b95e76fc414489e53d9670a4498f5956beb
162 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.001 PowerShell T1566.002 Spearphishing Attachment

This XLSM file contains a Workbook_Open macro that executes obfuscated VBA code. The script uses GetObject to interact with external objects and appears to be designed to download and execute a second-stage payload. The presence of an Excel 4.0 macro sheet further indicates malicious intent. The obfuscated nature of the VBA code and the lack of specific indicators for a known family lead to an 'unknown family' classification.

Heuristics 5

  • Excel 4.0 macro sheet (1 sheet(s)) critical OOXML_XLM_MACROSHEET
    Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks.
  • Workbook_Open macro high OLE_VBA_WBOPEN
    Workbook_Open macro
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
  • VBA project inside OOXML medium OOXML_VBA
    Document contains vbaProject.bin — VBA macros present
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/spreadsheetml/2006/main
    • http://schemas.microsoft.com/office/excel/2006/main
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships
    • http://schemas.openxmlformats.org/markup-compatibility/2006
    • http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac
    • http://schemas.microsoft.com/office/spreadsheetml/2014/revision
    • http://schemas.microsoft.com/office/spreadsheetml/2015/revision2
    • http://schemas.microsoft.com/office/spreadsheetml/2016/revision3
    • http://schemas.microsoft.com/office/spreadsheetml/2016/revision6

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
731fc854db173daa59d119913c9c1e8215e5e18a17ea9a095521b88e044040cd		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 3118 bytes
vbaProject_00.bin
727323731ba175eca0fd8ed93876a51c27e33ec5ef83e0d64152b268cd4c71ca		 vba-project OOXML VBA project: xl/vbaProject.bin 12800 bytes
xlm_sheet_00.xml
192b1326c7d815b4ff5ba83b1d9555bb44368ecf2f7f400e1dd39ab71ea80f1e		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet1.xml 1285 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.