Office (OLE) / .XLSX malware analysis — malicious · f89115b6b774552e

MALICIOUS

Office (OLE) / .XLSX

892.5 KB Created: 2021-05-19 14:25:12 Authoring application: Microsoft Excel

MD5: c245d6f79bca2e8e87381a68b842c4d2 SHA-1: e5882ba4265daf7961b2e70604a7b0b204b4bb37 SHA-256: f89115b6b774552e0311b43a584ea5f754f736b4106b7bd7f62e347ba75da659

290 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1059.003 Windows Command Shell T1204.002 Malicious File

The sample contains VBA macros, specifically a Workbook_Open macro that utilizes WScript.Shell and CreateObject. This indicates the macro is designed to execute commands on the host system. The embedded URLs are likely used to download and execute a secondary payload, a common technique for initial access or further infection. No document body text was available for analysis.

Heuristics 9

WScript.Shell usage critical OLE_VBA_WSCRIPT

WScript.Shell usage
Reference to Windows Script Host high SC_STR_WSCRIPT

Reference to Windows Script Host
Workbook_Open macro high OLE_VBA_WBOPEN

Workbook_Open macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code
Environ() call (env variable access) low OLE_VBA_ENVIRON

Environ() call (env variable access)
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — context-specific rules above attribute URLs they actually evaluated; this rule lists URLs that were present in the bytes but were not otherwise tied to a specific finding.
URL https://notificacao.acessoeduk.com.br/FAIBRA/boleto/Ojjgl6TANm7k.php
- https://fate.sa/2EWZ1gzKbk.php
- https://agentsv2.ivm.mv/user_guide/_static/css/rjWMenNTq.php
- https://www.ktateeb.vision-building.com/public/graph/uploads/200x300/content_images/CByVubhIO51.php
- https://clodoaldofernandes.com.br/_privado/sistema/modulos/link/categoria/tqP8TJ220u.php
- https://www.ktateeb.vision-building.com/public/graph/uploads/200x300/content_images/CByVubhIO51.phpX
- https://agentsv2.ivm.mv/user_guide/_static/css/rjWMenNTq.phpD
- https://ciatran.com.co/wp-content/plugins/shortcodes-ultimate/inc/core/K2kGXKi6v5rC.phpBh|Vi$Q)V
- https://mail-call.us/76a7Sg6AAZRX.php#@gMhz
- https://canteraspalomino.com/firmas/img/UignuN7NTZsS.phpw/gvb%OT!#myla�
- https://proterra.med.br/wp-includes/js/tinymce/themes/advanced/Zg1TbiK17uVn.php3M#D|,E4rA#w$�
- https://aims1.ezicodes.com/wp-includes/js/tinymce/skins/lightgray/A2jVIUfifA7zwR.php
- https://proterra.med.br/wp-includes/js/tinymce/themes/advanced/Zg1TbiK17uVn.php3M#D|,E4rA#w$
- https://canteraspalomino.com/firmas/img/UignuN7NTZsS.phpw/gvb%OT!#myla

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `353545cc0ed98ac970b06c9ea5ad57fa36fdc6e874563e6fc1e4ad05184571b7`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	141115 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 shell/COM execution token(s). Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.