Office (OOXML) / .XLSM malware analysis — malicious · b143495f864738a4

MALICIOUS

Office (OOXML) / .XLSM

42.1 KB Created: 2021-06-22 12:43:05 UTC Authoring application: Microsoft Excel 16.0300

MD5: 2827e820071d873987632c3560a58bff SHA-1: 42475dd9f109f0c0fe843d3de5e7791a6e53200e SHA-256: b143495f864738a42070e844c968ed39c193b4f3d9a76fdbb41b45a439030c6e

300 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1059.005 Visual Basic T1204.002 Malicious File T1059.003 Windows Command Shell

The sample is an XLSM file containing VBA macros. The Workbook_Open event is present, indicating automatic execution upon opening. Critical heuristics indicate the presence of PowerShell and cmd.exe references within the VBA, along with a WMI Win32_Process launcher. The VBA script itself contains obfuscated Base64 decoding logic, suggesting it's designed to download and execute a secondary payload. The presence of 'macros.bas' and 'vbaProject_00.bin' are noted as extracted artifacts.

Heuristics 7

PowerShell reference in VBA critical OLE_VBA_PS

PowerShell reference in VBA
VBA WMI Win32_Process launcher critical OLE_VBA_WMI_PROCESS_CREATE

VBA macro builds or references a WMI moniker for Win32_Process and invokes .Create to start a command. This is a high-confidence macro execution chain that often hides the WMI class name through string concatenation or helper functions.
Workbook_Open macro high OLE_VBA_WBOPEN

Workbook_Open macro
GetObject call high OLE_VBA_GETOBJ

GetObject call
cmd.exe reference in VBA high OLE_VBA_CMD

cmd.exe reference in VBA
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
VBA project inside OOXML medium OOXML_VBA

Document contains vbaProject.bin — VBA macros present

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `4690173febd99673f228c62ecac6aadaad6e96e90debbd93f66438f18ca49579`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	36140 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 2 shell/COM execution token(s). Carved macro source contains an auto-exec entry point and execution/download terms.
`vbaProject_00.bin` `19cdbed4a08138afd2d9f454e7bc395e59f8e9d061a0c4a796d73742b52a4c23`	vba-project	OOXML VBA project: xl/vbaProject.bin	11776 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.