Office (OOXML) / .XLSM malware analysis — malicious · c29e9174d9c04bfb

MALICIOUS

Office (OOXML) / .XLSM

45.6 KB Created: 2021-05-11 07:48:39 UTC Authoring application: 16.0300

MD5: 589908c69f247ea72c95f5ddb73cc754 SHA-1: fd09c95120b2e9a9cbfaabc020692ef6033de489 SHA-256: c29e9174d9c04bfbfdea49fe3804230bec0d893a1e6c6efa8fd5a6f9df59aaec

88 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic

The critical ClamAV detection and the presence of VBA macros within an OOXML file strongly indicate malicious intent. The heuristic for a hidden worksheet suggests an attempt to conceal malicious content. While no specific URLs or scripts were detailed in the provided evidence, the overall structure points to a macro-based downloader. The file's purpose is likely to execute a second-stage payload.

Heuristics 3

ClamAV: Win.Malware.Agent-9860937-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Win.Malware.Agent-9860937-0
VBA project inside OOXML medium OOXML_VBA

Document contains vbaProject.bin — VBA macros present
Hidden worksheet (hidden) low OOXML_HIDDEN_SHEET

Excel workbook contains 1 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `21331788b2314ca6fef1b9d0bafbf5419f6153fc90f2be6b8e70f4b2d831e792`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	2356 bytes
`vbaProject_00.bin` `ed4325e08027ab8b9b4dec04fae5e606e4925bb7c0d61009ecbed17e8107991b`	vba-project	OOXML VBA project: xl/vbaProject.bin	22528 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.