Malicious Office (OOXML) / .XLSX — malware analysis report

Heuristics 4

• ClamAV: Php.Trojan.MSShellcode-107 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Php.Trojan.MSShellcode-107
• LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND
  Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
• Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
  Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://test/wsrpc In document text (OOXML body / shared strings)

  • http://examples.com/1.jpg|shIn document text (OOXML body / shared strings)
  • http://tempuri.org/GetFileAttIn document text (OOXML body / shared strings)
  • http://tempuri.org/In document text (OOXML body / shared strings)
  • http://www.exampletest.com/test.exeIn document text (OOXML body / shared strings)
  • http://tempuri.org/ioffice/udfmrIn document text (OOXML body / shared strings)
  • http://www.hb.sgcc.com.cnIn document text (OOXML body / shared strings)
  • https://rmt.hb.sgcc.com.cn/test/In document text (OOXML body / shared strings)
  • http://www.hb.sgcc.com.cn/error.html_x000D_In document text (OOXML body / shared strings)
  • http://www.w3.org/2001/XMLSchema-instanceIn document text (OOXML body / shared strings)
  • http://www.w3.org/2001/XMLSchemaIn document text (OOXML body / shared strings)
  • http://schemas.xmlsoap.org/soap/envelope/In document text (OOXML body / shared strings)
  • http://example.com/..%5C..%5C..%5Cdocview%5Ctest.jspIn document text (OOXML body / shared strings)

Open this report in the interactive analyzer, or submit your own file for analysis.