Office (OOXML) / .XLSX malware analysis — malicious · fdaad14f5c83320a

MALICIOUS

Office (OOXML) / .XLSX

153.7 KB Created: 2015-06-05 18:17:20 UTC Authoring application: Microsoft Excel 16.0300

MD5: 30e95bfee5d8c17c5bb63f0d04981d22 SHA-1: 2385bdfd57c63662b5b6daa899a034f547ec4a4d SHA-256: fdaad14f5c83320a913b69958e61343f9bf17f8b3a05baca81ae96da6abdedb5

180 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1059.003 Windows Command Shell

The sample is an Excel file containing a Workbook_Open macro. This macro constructs a command string by concatenating values from cells (2,7) and (3,7) and then executes it using ShellExecute. The specific command executed is not fully reconstructible without knowing the cell contents, but the intent is to run an arbitrary command on the system. This indicates a macro-based execution attack.

Heuristics 5

Workbook_Open macro high OLE_VBA_WBOPEN

Workbook_Open macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
CallByName call high OLE_VBA_CALLBYNAME

CallByName call
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
VBA project inside OOXML medium OOXML_VBA

Document contains vbaProject.bin — VBA macros present

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `b8e4258cddc6e3e978c66f852d02535b47586923ee4255420df72dd2f8a091c2`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	1238 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved macro source contains an auto-exec entry point and execution/download terms.
`vbaProject_00.bin` `74e57bb45848429097183ad6a79944dc5fe268670d9caf89b5e241d2d30bc5f5`	vba-project	OOXML VBA project: xl/vbaProject.bin	14848 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.