Office (OOXML) / .XLSX malware analysis — malicious · b5ca98aaf7acc121

MALICIOUS

Office (OOXML) / .XLSX

60.5 KB Created: 2006-10-11 04:02:12 UTC Authoring application: WPS Office 12.0000

MD5: bef0d1e9c66a0ae35a1e0ca747bdad15 SHA-1: 36480210715a4c038d21b071b7f89508fef80c20 SHA-256: b5ca98aaf7acc12175fda388247d7898d815a8091ede0f30dfe952d26b1739c0

108 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.005 Visual Basic

The file is an OOXML document containing VBA macros, indicated by the OOXML_VBA heuristic. The document body contains invoice-like text, suggesting a lure. The presence of VBA macros and an external relationship pointing to a local file path strongly suggests that the document is designed to execute malicious code, likely through the embedded VBA, which is a common delivery mechanism for malware. The SE_INVOICE_LURE heuristic further supports the invoice-based social engineering pretext.

Heuristics 4

External relationship high OOXML_EXTERNAL_REL

External target in xl/externalLinks/_rels/externalLink2.xml.rels: file:///\\Sskim\최종선적현황\7-9BUY\HS VINA 7-9BUY 최종선적분.xls
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
VBA project inside OOXML medium OOXML_VBA

Document contains vbaProject.bin — VBA macros present
Fake invoice / payment lure low SE_INVOICE_LURE

Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `5dfdb96b7c0ec480d92f7f77ba4a7ff06fa9792c5a1fa2ddff7783c7a1ce7ff2`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	2309 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 3 shell/COM execution token(s).
`vbaProject_00.bin` `bd03247fee74efbb1eeea7d3da9914b9594f3f79a65319d994edfa18296d7549`	vba-project	OOXML VBA project: xl/vbaProject.bin	16896 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 3 shell/COM execution token(s). Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.