Xls.Downloader.Obfuse-9382072-0 — Office (OOXML) / .OLE malware analysis

Static analysis result for SHA-256 ba2f7e2e8aa6a23d…

MALICIOUS

Office (OOXML) / .OLE

152.4 KB Created: 2020-07-09 10:24:48 UTC Authoring application: Microsoft Excel 15.0300
MD5: beb8f4478a5fa9ad319c819343126245 SHA-1: e62d879907500e585438ad22d78c496b4902ab23 SHA-256: ba2f7e2e8aa6a23dc5cffbe514ea7ffb4a8aa2b8519d4d55b558c2e4f062cc39
380 Risk Score

Malware Insights

Xls.Downloader.Obfuse-9382072-0 · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1059.003 Windows Command Shell T1204.002 Malicious File

The OOXML file contains a Workbook_Open macro that utilizes WScript.Shell and the Shell() function to execute arbitrary commands. This is a common technique for downloading and executing further malicious payloads. ClamAV signatures confirm the detection as a downloader variant.

Heuristics 8

  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
  • ClamAV: Xls.Downloader.Obfuse-9382072-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Downloader.Obfuse-9382072-0
  • ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV
    ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
  • Workbook_Open macro high OLE_VBA_WBOPEN
    Workbook_Open macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • VBA project inside OOXML medium OOXML_VBA
    Document contains vbaProject.bin — VBA macros present

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
94b87026363182d24841a3e1c65fd476146bfaca5c80c4c1955a7d28c7b10183		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 1557 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 shell/COM execution token(s). Carved artifact contains 1 long base64-like blob(s). Carved macro source contains an auto-exec entry point and execution/download terms.
vbaProject_00.bin
a6524654d6d2f9150cf6b98ad5cb24b867fc0c314688c2c6ca546745c4ff9135		 vba-project OOXML VBA project: xl/vbaProject.bin 14336 bytes
Detection
ClamAV: Xls.Downloader.Obfuse-9382072-0
Obfuscation or payload: likely
Carved artifact contains 1 shell/COM execution token(s). Carved artifact contains 1 long base64-like blob(s). Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.