Office (OOXML) malware analysis — malicious · fa8e364aeadf7133

MALICIOUS

Office (OOXML)

320.0 KB Created: 2015-06-05 18:19:34 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2026-06-04

MD5: 12087b1b9a14208da69d0a9f9cd619ea SHA-1: 97f753b9515c8f7ba1090e6002b98c28f6185caa SHA-256: fa8e364aeadf7133e3acabf88ddd153b843da994c021a5b9ddd87a1436a7ec86

64 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic

The file is an OOXML document containing VBA macros, indicated by the 'OOXML_VBA' and 'OLE_VBA_PCODE_AUTOEXEC_EXEC' heuristics. The document body describes a process for purchasing and using a macro-enabled Excel file for contact management, suggesting a social engineering lure to encourage license purchase. The embedded URLs are confirmed benign, and no malicious scripts were extracted.

Heuristics 4

VBA project inside OOXML medium 1 related finding OOXML_VBA

Document contains a VBA project — VBA macros present
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://www.icloud.com/)�� In document text (OOXML body / shared strings)
- https://photopalaces.booth.pm/items/1322274In document text (OOXML body / shared strings)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`vbaProject_00.bin`	vba-project	OOXML VBA project: xl/vbaProject.bin	215040 bytes
SHA-256: `7f6696981b908468b1bf9bd224a2f6d807e640d9866f3539fc7b993aa81b95d4`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 long base64-like blob(s).

Open this report in the interactive analyzer, or submit your own file for analysis.