Office (OOXML) / .XLSX malware analysis — malicious · cc9cefa7960d991d

MALICIOUS

Office (OOXML) / .XLSX

15.9 KB Created: 2021-05-05 09:36:34 UTC Authoring application: Microsoft Excel 15.0300

MD5: 399563af4221cc2c176d8f218d6a563d SHA-1: 72251218c8127abeab4c04944445c18bdac2688f SHA-256: cc9cefa7960d991d414051f5fe153ffa514a2e687143dd2b1b6966edbbcadbec

140 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1546.003 Event Triggered Execution: Windows Management Instrumentation

The presence of a Workbook_Open macro indicates that malicious VBA code is designed to execute automatically when the Excel file is opened. The CreateObject heuristic further suggests that the macro likely attempts to instantiate and run objects, potentially to download and execute a second-stage payload. No specific family could be identified from the available heuristics.

Heuristics 4

Workbook_Open macro high OLE_VBA_WBOPEN

Workbook_Open macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
VBA project inside OOXML medium OOXML_VBA

Document contains vbaProject.bin — VBA macros present

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `03a365713a6756bc6b75843143ded729f50e21ccca7f9be316d86af9dc71d8d4`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	4498 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved macro source contains an auto-exec entry point and execution/download terms.
`vbaProject_00.bin` `66b023d6eab5c00bc4748ba50a5483f4411d3428aa8c8096f654cec370adc4c4`	vba-project	OOXML VBA project: xl/vbaProject.bin	21504 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.