Office (OOXML) / .XLSM malware analysis — malicious · b053e871089776ed

MALICIOUS

Office (OOXML) / .XLSM

285.7 KB Created: 2021-04-12 13:22:08 UTC Authoring application: Microsoft Excel 15.0300

MD5: 3bbf7ada52932d578d114b2215e6bfb1 SHA-1: c4e52054139eef065fcf23807e98816704548c4f SHA-256: b053e871089776edb74938981d82d1f05078aaa45d83c0574f8dfcc9bb7775ce

148 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1059.001 PowerShell T1204.002 Malicious File

The sample is an XLSM file containing a Workbook_Open macro that uses CreateObject to likely download and execute a second-stage payload from one of the embedded URLs. The obfuscated document body text suggests a lure to trick the user into opening the malicious content. The VBA Chr string obfuscation and auto-execution terms further indicate malicious intent.

Heuristics 6

Workbook_Open macro high OLE_VBA_WBOPEN

Workbook_Open macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
VBA project inside OOXML medium OOXML_VBA

Document contains vbaProject.bin — VBA macros present
Environ() call (env variable access) low OLE_VBA_ENVIRON

Environ() call (env variable access)
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://niosac.in/superadmin/bower_components/morris.js/examples/lib/FSRUaZhk9R6i.php
- https://oremoralesabogados.com.pe/Scripts/IGC5gCUFswD7Uk.php
- https://denisserios.com.mx/firmascorreo2019/ASzHfPjZ4AiiNM6.php
- https://fudfest.com/1767/6JjOEeNGMj.php
- https://eg.digitsector.com/welcome/exporting-server/java/highcharts-export/highcharts-export-convert/Y7SMWsvOuDiWby.php
- https://timesnow24.net/wp-content/plugins/coming-soon/app/backwards/e0UlCnplG.php
- https://calcarionoroeste.cpusistemaseweb.com.br/_views/api/jquery.mobile-1.4.5/images/icons-png/UL6lWO5H4oLqcY.php
- https://vmarks.com.br/logo/gzzsLwl37HNZxM.php
- https://mhousebd.com/uploads/tv_image/sm/7qFCX9nY.php

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `4db2485c0933cff27dda3ed77c55474f19cba72bb29b5ba8c9dd47028f965ed2`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	82569 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 14 Chr/ChrW string-construction calls. Carved macro source contains an auto-exec entry point and execution/download terms.
`vbaProject_00.bin` `01b57ce1b9ca5f5a16c4899010e8c25eb63778afe57b38ce1e1dd07a2b212827`	vba-project	OOXML VBA project: xl/vbaProject.bin	237056 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.