Office (OOXML) / .XLSX malware analysis — malicious · d6084912b3ce234f

MALICIOUS

Office (OOXML) / .XLSX

54.9 KB Created: 2006-10-11 04:02:12 UTC Authoring application: WPS Office 12.0000

MD5: 2e284555e602b676bac1c978aa857eb0 SHA-1: f32b006a58bf0c12021b7169ebb0abddb34031e0 SHA-256: d6084912b3ce234f061ee05bf35d3e4b8a10cb8c7ea4e9ca1d008a5dd7dde082

128 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.005 Visual Basic T1204.002 Malicious File

The sample is an OOXML document containing VBA macros, indicated by the 'OOXML_VBA' and 'EXTRACTED_FILE_STATIC_TRIAGE' heuristics. The 'SE_INVOICE_LURE' heuristic suggests the document body is designed to trick the user into enabling macros, likely by posing as an invoice. The presence of VBA macros and a reference to a LOLBin within the VBA code strongly suggests that the macros are intended to execute arbitrary code. No specific family could be identified.

Heuristics 5

LOLBin reference in VBA critical OLE_VBA_LOLBIN

LOLBin reference in VBA
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
VBA project inside OOXML medium OOXML_VBA

Document contains vbaProject.bin — VBA macros present
Fake invoice / payment lure low SE_INVOICE_LURE

Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://www.j.mp/ajdddsdsdjsjcjosdj

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `fc993d58fb69f2167e3152add228709c48939d550fa4ddc207b13d1abf7813c2`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	1847 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 shell/COM execution token(s).
`vbaProject_00.bin` `2f9f7491daa027bc3eddc7f75e036bd31454f4b6f312c718096a6c214f6810e0`	vba-project	OOXML VBA project: xl/vbaProject.bin	14848 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 2 shell/COM execution token(s). Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.