Office (OLE) / .XLSX malware analysis — malicious · ce77fa16a137ff7f

MALICIOUS

Office (OLE) / .XLSX

777.0 KB Created: 2022-02-07 07:23:36 Authoring application: Microsoft Excel First seen: 2023-02-06

MD5: 1c8db552adab7153cf180960e2081ce0 SHA-1: 93a17f2d9b862b157d81fe71183aefc4185b468b SHA-256: ce77fa16a137ff7f7e1494a37715467f6a80797c0b8962cffd6d6f7e2ce4e4a1

168 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.005 Visual Basic T1059.001 PowerShell T1547.001 Registry Run Keys / Startup Folder

The file is identified as malicious by ClamAV and contains VBA macros, including Auto_Open and Auto_Close functions, indicating an attempt to execute malicious code upon opening and closing the document. The document body contains elements suggestive of an invoice or payment lure. The Auto_Open macro attempts to save a copy of itself to the startup folder as 'mypersonnel.xls' and 'mypersonel.xls', establishing persistence.

Heuristics 5

ClamAV: Xls.Malware.ExcelSic-10004731-1 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Malware.ExcelSic-10004731-1
Auto_Open macro high OLE_VBA_AUTO

Auto_Open macro
Auto_Close macro high OLE_VBA_AUTOCLOSE

Auto_Close macro
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code
Fake invoice / payment lure low SE_INVOICE_LURE

Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `0e027d7c75d49f79cc7aa4389acfebf7b55f41d2ad86258589318b07847f19ae`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	1816 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.