Office (OOXML) / .XLSX malware analysis — malicious · e53ea50a016d04ca

MALICIOUS

Office (OOXML) / .XLSX

54.8 KB Created: 2006-10-11 04:02:12 UTC Authoring application: WPS Office 12.0000

MD5: 78a4d352080a2d97b7b9b16130001c6c SHA-1: cb9bcf57f96f1668f26d0a79c7f21a659fff8230 SHA-256: e53ea50a016d04caea039d864a0aee4d6200a1818b09e9f6acb789e1673341c7

128 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.005 Visual Basic

The document contains VBA macros, indicated by the OOXML_VBA heuristic, and references a LOLBin, suggesting malicious code execution. The DOC BODY text presents a fake invoice, aligning with the SE_INVOICE_LURE heuristic. The presence of VBA macros and the invoice lure strongly suggest a phishing attempt designed to execute malicious code. No specific family could be identified.

Heuristics 5

LOLBin reference in VBA critical OLE_VBA_LOLBIN

LOLBin reference in VBA
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
VBA project inside OOXML medium OOXML_VBA

Document contains vbaProject.bin — VBA macros present
Fake invoice / payment lure low SE_INVOICE_LURE

Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://www.j.mp/ajddjsdjkldkosdj

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `ebdf771c1510acf65359467f24dd2db2aa3b122a347c669b6696416a16a7e4e1`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	1845 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 shell/COM execution token(s).
`vbaProject_00.bin` `2fd4e9b75c11b009bfd7714c03f12e95f5a9d2e36bd0fe936f770a613671d91f`	vba-project	OOXML VBA project: xl/vbaProject.bin	14848 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 2 shell/COM execution token(s). Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.