Malicious Office (OOXML) / .XLSM — malware analysis report

Static analysis result for SHA-256 ba5942dbbe9ab4b8…

MALICIOUS

Office (OOXML) / .XLSM

15.1 KB Created: 2020-10-08 22:48:21 UTC Authoring application: Microsoft Excel 16.0300
MD5: 5aff665db4a76e24f9dd960a9c5a94a6 SHA-1: 9d19798d37ea56ace03745b4cf1ce95940592972 SHA-256: ba5942dbbe9ab4b896fd2d10025192784c595839c4d0a0a5a5f4f45b5a6f08ae
162 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.002 Spearphishing Attachment

The file is an XLSM document containing a Workbook_Open macro, indicating an attempt to execute code upon opening. The VBA code is heavily obfuscated, but the presence of a GetObject call suggests it is attempting to interact with external objects or resources. The Excel 4.0 macro sheet further supports the malicious intent. The primary attack pattern is likely a macro-based download and execution of a secondary payload.

Heuristics 5

  • Excel 4.0 macro sheet (1 sheet(s)) critical OOXML_XLM_MACROSHEET
    Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks.
  • Workbook_Open macro high OLE_VBA_WBOPEN
    Workbook_Open macro
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
  • VBA project inside OOXML medium OOXML_VBA
    Document contains vbaProject.bin — VBA macros present
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/spreadsheetml/2006/main
    • http://schemas.microsoft.com/office/excel/2006/main
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships
    • http://schemas.openxmlformats.org/markup-compatibility/2006
    • http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac
    • http://schemas.microsoft.com/office/spreadsheetml/2014/revision
    • http://schemas.microsoft.com/office/spreadsheetml/2015/revision2
    • http://schemas.microsoft.com/office/spreadsheetml/2016/revision3
    • http://schemas.microsoft.com/office/spreadsheetml/2016/revision6

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
8cfbc3ad9ea945982aa7722c48824a14621cd7133d0310eff9461c46ffc829d8		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 3123 bytes
vbaProject_00.bin
18f02ca05fbf5d281683a8faed27e5014009f778be99f2d7df60e02d853ee35e		 vba-project OOXML VBA project: xl/vbaProject.bin 12800 bytes
xlm_sheet_00.xml
796f3cafa583d6676198b9fa426921281eae76275267c4e73fc6bfc784b740b0		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet1.xml 1234 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.