Dridex Office (OOXML) / .XLSM malware analysis — malicious · b0d9e7a0410a3e1c

MALICIOUS

Office (OOXML) / .XLSM

179.7 KB Created: 2021-02-24 13:04:46 UTC Authoring application: Microsoft Excel 15.0300

MD5: ee17335130c99b871d9e7266f837648f SHA-1: c0944b377eb495b5a6b362c01915d61197d3eabc SHA-256: b0d9e7a0410a3e1cb0b915fae6cbd5a96be9ff6bbe4e67a00e4069f0f31ccb07

268 Risk Score

Malware Insights

Dridex · confidence 95%

MITRE ATT&CK

T1059.005 Visual Basic T1059.001 PowerShell T1204.002 Malicious File

The critical ClamAV detections for 'Doc.Dropper.Dridex-9845759-0' strongly indicate the Dridex family. The presence of a Workbook_Open macro and GetObject calls suggests the macro is designed to execute automatically upon opening the document. This macro likely downloads and executes a secondary payload, a common characteristic of Dridex droppers. The extracted artifact also triggered static triage signals related to script execution and obfuscation.

Heuristics 7

ClamAV: Doc.Dropper.Dridex-9845759-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Dropper.Dridex-9845759-0
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
Workbook_Open macro high OLE_VBA_WBOPEN

Workbook_Open macro
GetObject call high OLE_VBA_GETOBJ

GetObject call
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
VBA project inside OOXML medium OOXML_VBA

Document contains vbaProject.bin — VBA macros present
Environ() call (env variable access) low OLE_VBA_ENVIRON

Environ() call (env variable access)

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `37d6c5fa5ffcf0e2cd3ebd65d3777dcd2f1cff2ff8b0bc78c1b35587777c7d69`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	14509 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 109 Chr/ChrW string-construction calls. Carved macro source contains an auto-exec entry point and execution/download terms.
`vbaProject_00.bin` `ce2e7154ec10f87082160cd20562fae43ac1418b2df21ab5f7b7a94701f4c455`	vba-project	OOXML VBA project: xl/vbaProject.bin	61952 bytes
Detection ClamAV: Doc.Dropper.Dridex-9845759-0 Obfuscation or payload: likely Carved artifact contains 2 shell/COM execution token(s). Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.