MALICIOUS
120
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious File
T1059.005 Visual Basic
The sample is an Excel spreadsheet containing VBA macros, specifically a Workbook_Open macro, which is a common technique for malware delivery. The document body instructs the user to 'Please Enable Macros to View BoQ information', acting as a lure to bypass security settings. The presence of VBA macros and the explicit instruction to enable them strongly suggest a macro-based attack pattern aimed at tricking the user into executing malicious code. No specific family could be identified, but the behavior is consistent with a downloader or initial access payload.
Heuristics 4
-
Workbook_Open macro high OLE_VBA_WBOPENWorkbook_Open macro
-
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGEOne or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
-
VBA macros detected medium OLE_VBA_MACROSDocument contains VBA macro code
-
Macro/content-enable lure medium SE_ENABLE_LUREDocument instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.basce40dc62676129a7ffb78c501c2875efa6b3f6f9f8a8cc697ee188fdca492f38 |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 82789 bytes |
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
Carved artifact contains 71 Chr/ChrW string-construction calls.
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.