Malicious Office (OLE) / .XLSX — malware analysis report

Static analysis result for SHA-256 fa8f82c8dfa52240…

MALICIOUS

Office (OLE) / .XLSX

597.5 KB Created: 2021-06-07 14:29:17 Authoring application: Microsoft Excel
MD5: c72b5321c62c54829b3300ee5d9441e1 SHA-1: a9338431d70f05bb4a9b40c1deaf21583e4b798c SHA-256: fa8f82c8dfa52240e1e110645e0f329f239e215dd9109f86d15b38c26bb82ed9
330 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.003 Windows Command Shell T1204.002 Malicious File

The sample contains a Workbook_Open VBA macro that utilizes Shell() and CreateObject() calls. This indicates the macro is designed to execute arbitrary commands, likely to download and run a second-stage payload from one of the embedded URLs. The presence of an appended OLE payload further supports this malicious intent.

Heuristics 10

  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • Reference to Windows Script Host high SC_STR_WSCRIPT
    Reference to Windows Script Host
  • OLE file has appended executable-looking payload bytes high OLE_APPENDED_PAYLOAD
    OLE compound file contains a large high-entropy region beyond the declared major streams and that region includes shellcode, PE, or loader API markers. This is a payload-carrier signal, not a specific CVE attribution by itself.
  • Workbook_Open macro high OLE_VBA_WBOPEN
    Workbook_Open macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — context-specific rules above attribute URLs they actually evaluated; this rule lists URLs that were present in the bytes but were not otherwise tied to a specific finding.
    URL https://sitiom[sz��
    • https://presen�F��Y�
    • https://sitiomorad+bSCBadosa+bSCBnjos.com.br/site/wa_p_albums/p_album_jua5tam80/jua5rcb3bz8x5s+bSCB/thumb+bSCB/GxbFZiKIXwFV.php
    • https://nil.quinte-gagn
    • https://main.bgsr.site/wp-rR:/!includes/sodium_comrR:/!patrR:/!/src/Core32/CharR:/!Cha20/d68Tou3ui1RoUA.php
    • https://makolet.nsmatrix3.H4iT(com/wp-contentH4iT(/plugins/woocommerce/teH4iT(mplates/auth/gnq4mYeZYgL4dN.H4iT(php
    • https://redblock.t*R2K-surispot.biz/wp-content/plugins/news-managet*R2K-r/css/images/REEt*R2K-iOXJt*R2K-f.php
    • https://babycakD|0Urrie.dexskD|0Uandbox.com/wp-contkD|0Uent/plugins/woocommerce/includes/abstracts/6EA24JwkKx2FA.php
    • https://present.fairdiGVA(pnand.world/wp-iGVA(pnGVA(pcludes/sodium_compat/srcGVA(p/CorGVA(pe/BasGVA(pe64/SQcjTrqxwx.php

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
442102ebc55c95596aeb3ae55d09a06750a5453369af1a6cdcf22299923b1e7c		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 128161 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.