Office (OOXML) / .XLSX malware analysis — malicious · bba7976015241f08

MALICIOUS

Office (OOXML) / .XLSX

33.2 KB Created: 2020-11-16 05:28:55 UTC Authoring application: Microsoft Excel 16.0300

MD5: 3cec3394a341ab1c5d5a4894cf50a768 SHA-1: 31cbc4bfdb39eab41c5662f1fdf90a8a0c88c554 SHA-256: bba7976015241f087d25c6d7d69b21b73918a560acf87c81b4d332002bf6a9b5

160 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1059 Command and Scripting Interpreter

The OOXML file contains VBA macros, specifically a Workbook_Open macro that utilizes the Shell() function. This indicates an attempt to execute arbitrary commands, commonly used to download and run additional malicious content. The presence of these high-severity heuristics strongly suggests a malicious downloader.

Heuristics 4

Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA
Workbook_Open macro high OLE_VBA_WBOPEN

Workbook_Open macro
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
VBA project inside OOXML medium OOXML_VBA

Document contains vbaProject.bin — VBA macros present

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `edb56740b359681ed8cc7b721fd573f456322bc88430b89aef001b00f957fba3`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	1692 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved macro source contains an auto-exec entry point and execution/download terms.
`vbaProject_00.bin` `cf7591ded1d1c431bb02550c9ee47be2cff53229ab1267a9066743e3b7b6ce43`	vba-project	OOXML VBA project: xl/vbaProject.bin	13824 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.