Office (OOXML) / .XLSX malware analysis — malicious · c78a4663379823e0

MALICIOUS

Office (OOXML) / .XLSX

60.6 KB Created: 2006-10-11 04:02:12 UTC Authoring application: WPS Office 12.0000

MD5: 2513bdc618624f67bfdd1a94fd483f3d SHA-1: 017ab7785b310dce4a3f29aac1c51e6f4a940564 SHA-256: c78a4663379823e03dbb6aca0b9258d4ff5e7785751d855eb58fbf35650c1b87

108 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.005 Visual Basic

The file is an OOXML document containing VBA macros, indicated by the 'OOXML_VBA' and 'EXTRACTED_FILE_STATIC_TRIAGE' heuristics. The 'SE_INVOICE_LURE' heuristic and the document body content suggest a fake invoice lure. The presence of VBA macros implies an attempt to execute malicious code, likely to download a second-stage payload or establish persistence, though the specific actions are not detailed in the provided evidence.

Heuristics 4

External relationship high OOXML_EXTERNAL_REL

External target in xl/externalLinks/_rels/externalLink2.xml.rels: file:///\\Sskim\최종선적현황\7-9BUY\HS VINA 7-9BUY 최종선적분.xls
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
VBA project inside OOXML medium OOXML_VBA

Document contains vbaProject.bin — VBA macros present
Fake invoice / payment lure low SE_INVOICE_LURE

Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `eac9bb378ca4e8b3dc75c9a4f2aa230a97a33c0a81e3931672453a802c1c8c69`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	2313 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 3 shell/COM execution token(s).
`vbaProject_00.bin` `7ab60be9eb0c29dcc21ea6a4481504bfbd9f3a8fff5b80f1782e0d4a04d808bd`	vba-project	OOXML VBA project: xl/vbaProject.bin	16896 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 3 shell/COM execution token(s). Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.