Office (OOXML) / .XLSM malware analysis — malicious · fc2eca27d4ceaf13

MALICIOUS

Office (OOXML) / .XLSM

32.9 KB Created: 2021-02-14 18:48:55 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2022-04-17

MD5: 7a300b49ef5af319c91821cf2674d2b9 SHA-1: 81d2aa55f439ff598b4db82295cb8ab930f15fed SHA-256: fc2eca27d4ceaf134867b988ec20a27d2b4e11f89539975e31ea37827de9a6fd

320 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1059.003 Windows Command Shell T1204.002 Malicious File T1059.005 Visual Basic T1105 Ingress Tool Transfer

The Workbook_Open macro executes a command to download a file named 'um.exe' from the SMB share \\20.69.97.31\webdav\um.exe to C:\Windows\Temp\um.exe using findstr.exe. It then executes the downloaded file. The document body explicitly instructs the user to 'Enable Editing' and 'Enable Content', which is a common lure for macro-based malware. The use of WScript.Shell and cmd.exe confirms the execution of these commands.

Heuristics 8

Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA
WScript.Shell usage critical OLE_VBA_WSCRIPT

WScript.Shell usage
Workbook_Open macro high OLE_VBA_WBOPEN

Workbook_Open macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
cmd.exe reference in VBA high OLE_VBA_CMD

cmd.exe reference in VBA
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
VBA project inside OOXML medium OOXML_VBA

Document contains vbaProject.bin — VBA macros present
Macro/content-enable lure medium SE_ENABLE_LURE

Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `d6cd577d0b73e9b593ef62cc2ed962c38614a361c1068957b036d6f9d20b150e`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	1490 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 2 shell/COM execution token(s). Carved macro source contains an auto-exec entry point and execution/download terms.
`vbaProject_00.bin` `ecacdfe27d2b91f295e5db5a7c1493457a0b8e3d22072cb1e13078a98206f6c4`	vba-project	OOXML VBA project: xl/vbaProject.bin	20992 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 2 shell/COM execution token(s). Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.