Office (OOXML) malware analysis — malicious · b9a3e39f618566ad

MALICIOUS

Office (OOXML)

10.41 MB Created: 2011-08-25 14:29:57 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2021-07-10

MD5: a59934bc55c5d8bb0c9fa2b8fd4360ee SHA-1: 6e54cbb061348719bb320657e8a1b10fd5e8e2f2 SHA-256: b9a3e39f618566adb99bff21901f990440553db14d534a2875617ef36f0786d5

278 Risk Score

Heuristics 9

VBA project inside OOXML medium 6 related findings OOXML_VBA

Document contains a VBA project — VBA macros present
Potential Shell call in VBA critical OLE_VBA_SHELL

Potential Shell call in VBA
Matched line in script
```
''
' Prepare text for shell
' - Wrap in "..."
```
Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER

Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
Matched line in script
```
    Set web_Http = CreateObject("WinHttp.WinHttpRequest.5.1")
```
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
Matched line in script
```
    Set web_Http = CreateObject("WinHttp.WinHttpRequest.5.1")
```

CallByName call high OLE_VBA_CALLBYNAME

CallByName call

Matched line in script

                    If web_Converter("ParseType") = "Binary" Then
                        Set ParseByFormat = VBA.CallByName(web_Instance, web_Callback, VBA.vbMethod, Bytes)
                    Else

VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
Workbook_Open macro low OLE_VBA_WBOPEN

Workbook_Open macro
Matched line in script
```
Private Sub Workbook_Open()
    On Error Resume Next
```
Hidden worksheet (hidden) low OOXML_HIDDEN_SHEET

Excel workbook contains 2 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction
Large OOXML part skipped info SCAN_INCOMPLETE

One or more high-value OOXML parts exceeded the scanner's per-entry size cap and may not have been fully inspected.

Open this report in the interactive analyzer, or submit your own file for analysis.