Office (OOXML) / .XLSX malware analysis — malicious · dd76fa4057fe8009

MALICIOUS

Office (OOXML) / .XLSX

52.8 KB Created: 2026-03-03 08:38:25 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2026-03-06

MD5: db1b11b63d631e2d0cebdefb322c2e7a SHA-1: 962388fe6fc2ab711ca07e29e8b7728fb4b9c001 SHA-256: dd76fa4057fe80097239ce1083ad02470c95f8cc6f46f45625bea944d195f456

570 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1566.001 Spearphishing Attachment T1059.005 Visual Basic

The file is an OOXML document containing VBA macros, with critical heuristics indicating the use of Shell(), WScript.Shell, and PowerShell. The presence of a Document_Open or Workbook_Open macro suggests automatic execution upon opening. The extracted VBA macro 'macros.bas' contains references to WScript.Shell and cmd.exe, and the heuristic 'OLE_VBA_PS' strongly suggests PowerShell execution. This indicates the macro is designed to download and execute a second-stage payload. The ClamAV detection 'Doc.Malware.Valyria-10013249-0' further confirms its malicious nature.

Heuristics 14

Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA
WScript.Shell usage critical OLE_VBA_WSCRIPT

WScript.Shell usage
PowerShell reference in VBA critical OLE_VBA_PS

PowerShell reference in VBA
ClamAV: Doc.Malware.Valyria-10013249-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Malware.Valyria-10013249-0
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
Document_Open macro high OLE_VBA_DOCOPEN

Document_Open macro
Workbook_Open macro high OLE_VBA_WBOPEN

Workbook_Open macro
Auto_Open macro high OLE_VBA_AUTO

Auto_Open macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
cmd.exe reference in VBA high OLE_VBA_CMD

cmd.exe reference in VBA
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
VBA project inside OOXML medium OOXML_VBA

Document contains vbaProject.bin — VBA macros present
Environ() call (env variable access) low OLE_VBA_ENVIRON

Environ() call (env variable access)
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://www.google.com
- http://www.microsoft.com

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `6dac06e764ef825a0f4d0a2ceb81cdf5e580dd05bfadb97d0ae7e7fec92df11f`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	44116 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 10 shell/COM execution token(s). Carved artifact contains 28 Chr/ChrW string-construction calls. Carved macro source contains an auto-exec entry point and execution/download terms.
`vbaProject_00.bin` `3d9600575120caba03b7fcc1034a249090bdcf830b91e24c9d351a04fca4deda`	vba-project	OOXML VBA project: xl/vbaProject.bin	111616 bytes
Detection ClamAV: Doc.Malware.Valyria-10013249-0 Obfuscation or payload: likely Carved artifact contains 8 shell/COM execution token(s). Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.