Sagent Office (OOXML) / .XLSM malware analysis — malicious · e33f2f65cb6c105b

MALICIOUS

Office (OOXML) / .XLSM

60.3 KB Authoring application: Microsoft Excel 16.0300 First seen: 2024-09-06

MD5: 6f37fb22baee68fa232d421764049afc SHA-1: a78e561cf3e844e975a2d68c9be1586bb6f5846e SHA-256: e33f2f65cb6c105bc22d0aaf0ec576fe3e4b3f3634276921eabdd221817f3da6

222 Risk Score

Malware Insights

Sagent · confidence 95%

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File T1059.005 Visual Basic

The sample is an XLSM file containing VBA macros. The macros utilize `CreateObject` to execute a PowerShell command that downloads a file named `vbs.exe` from `http://194.11.246.195/vbs.exe` and saves it to `C:\Users\Public\gnubjswxbodycvrodva.exe`, then executes it. This indicates a downloader functionality, consistent with the Sagent malware family identified by ClamAV.

Heuristics 6

ClamAV: Xls.Malware.Sagent-10035294-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Malware.Sagent-10035294-0
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND

Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
VBA project inside OOXML medium OOXML_VBA

Document contains a VBA project — VBA macros present
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://194.11.246.195/vbs.exe

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `e6730b46307e35991455bdd51c84ee7471f2bf7bbdda42f8041b70cd1b43d0ef`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	1385 bytes
`vbaProject_00.bin` `5bfb86e17591bfb83d90b15a9c32241ad72cdfd22d38906dd8f02402fd0f0f54`	vba-project	OOXML VBA project: xl/vbaProject.bin	9728 bytes
Detection ClamAV: Xls.Malware.Sagent-10035294-0 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.