Office (OOXML) / .XLSM malware analysis — malicious · ed028d915fba2352

MALICIOUS

Office (OOXML) / .XLSM

30.1 KB Created: 2021-02-14 18:48:55 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2022-04-17

MD5: 05e99e800d1fddef1ccc9adbf1ef4183 SHA-1: 8886aa3be5ac9afe95e58dc19379a2b6a9628fa8 SHA-256: ed028d915fba2352e4482679be653f56e572c8cd0f08193626f4d6c4ec1e30c9

320 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1059.003 Windows Command Shell T1204.002 Malicious File T1059.005 Visual Basic

The Workbook_Open macro executes a command to download 'um.exe' from the WebDAV share '\\20.69.97.31\webdav\um.exe' to 'C:\Windows\Temp\um.exe'. It then executes the downloaded file. The document body explicitly instructs the user to enable editing and content, a common lure for macro-enabled malware.

Heuristics 8

Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA
WScript.Shell usage critical OLE_VBA_WSCRIPT

WScript.Shell usage
Workbook_Open macro high OLE_VBA_WBOPEN

Workbook_Open macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
cmd.exe reference in VBA high OLE_VBA_CMD

cmd.exe reference in VBA
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
VBA project inside OOXML medium OOXML_VBA

Document contains vbaProject.bin — VBA macros present
Macro/content-enable lure medium SE_ENABLE_LURE

Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `7e39b4c167558bb643bf55776100f47fecdf5f5f4d34769782e01e72db664816`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	1477 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 2 shell/COM execution token(s). Carved macro source contains an auto-exec entry point and execution/download terms.
`vbaProject_00.bin` `0fbc3732a7b796dbb6bef81afe2cb1691869862508f39aaa9d611725cfd63fa3`	vba-project	OOXML VBA project: xl/vbaProject.bin	12288 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 2 shell/COM execution token(s). Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.