Office (OOXML) / .XLSM malware analysis — malicious · eb7e84049ea324f5

MALICIOUS

Office (OOXML) / .XLSM

41.6 KB Created: 2021-06-22 12:43:05 UTC Authoring application: Microsoft Excel 16.0300

MD5: 6e7f1dbc175b3d61c69226c9acb8150e SHA-1: 38149fbdc81fc2df2f656457ffb21239f9963c53 SHA-256: eb7e84049ea324f59431ad076bea0b6c0232ddd0ddf14be1d3956a3647753f01

180 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1059.003 Windows Command Shell

The sample is an XLSM file containing VBA macros. Heuristics indicate the presence of VBA macros that reference PowerShell and cmd.exe, and utilize the GetObject function. The VBA code appears to be obfuscated and includes a Base64 decoding function, suggesting it is designed to download and execute a second-stage payload. The primary intent is to leverage these VBA macros to execute arbitrary code, likely for further system compromise.

Heuristics 5

PowerShell reference in VBA critical OLE_VBA_PS

PowerShell reference in VBA
GetObject call high OLE_VBA_GETOBJ

GetObject call
cmd.exe reference in VBA high OLE_VBA_CMD

cmd.exe reference in VBA
VBA project inside OOXML medium OOXML_VBA

Document contains vbaProject.bin — VBA macros present
Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `7875656816bb3a04ab998daff420948945201246fd27e2b08a702a056676cca5`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	35036 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 2 shell/COM execution token(s).
`vbaProject_00.bin` `1047f319275de51996d6928a2b9d83b8d816b2d3c39137baa41f8bb145187019`	vba-project	OOXML VBA project: xl/vbaProject.bin	11264 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.