Malicious Office (OOXML) / .XLSX — malware analysis report

Static analysis result for SHA-256 fdf08eb6737317b8…

MALICIOUS

Office (OOXML) / .XLSX

67.0 KB Created: 2018-10-19 11:39:03 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2026-06-14
MD5: e651528bb11d05929828133b8468cc43 SHA-1: 83a18e58ed19cf02e6a8b9ee32a7d4cb4ab074a5 SHA-256: fdf08eb6737317b80f108d3ea29ad5392b3a38aaefc4041428528c7dbaa316c1
70 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is an Excel spreadsheet containing a Workbook_Open VBA macro. This macro attempts to insert a picture from a remote URL, specifically http://safe-browsing.de/d57b3d4d-f3d2-4193-bf00-6c286c425ec5, which is also referenced in the document body and as an external relationship. This behavior suggests an attempt to lure the user with potentially malicious content or to track user engagement, characteristic of phishing or credential harvesting campaigns.

Heuristics 5

  • VBA project inside OOXML medium 1 related finding OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Sub Workbook_Open()
  • Remote image (web beacon / tracking pixel) medium OOXML_IMAGE_BEACON
    Document references an external image URL — loads automatically on open, revealing IP address and timestamp to the server (used for phishing tracking and NTLM hash theft on corporate networks)
  • External relationship medium OOXML_EXTERNAL_REL
    External target in xl/drawings/_rels/drawing1.xml.rels: http://safe-browsing.de/d57b3d4d-f3d2-4193-bf00-6c286c425ec5
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://safe-browsing.de/fb599300-ea32-432e-91ad-b0e699104769 In document text (OOXML body / shared strings)
    • http://safe-browsing.de/d57b3d4d-f3d2-4193-bf00-6c286c425ec5OOXML external relationship
    • http://schemas.openxmlformats.org/package/2006/content-typesIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/package/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships/extended-propertiesIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/package/2006/relationships/metadata/core-propertiesIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships/officeDocumentIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships/stylesIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships/themeIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships/worksheetIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/2006/relationships/vbaProjectIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships/sharedStringsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/spreadsheetml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2010/11/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2014/revisionIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2016/revision6In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2016/revision10In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2015/revision2In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2010/11/acIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships/imageIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships/drawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships/printerSettingsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/thememl/2012/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2009/9/acIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2015/02/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2009/9/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2016/revision3In document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/spreadsheetDrawingIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2014/mainIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/package/2006/metadata/core-propertiesIn document text (OOXML body / shared strings)
    • http://purl.org/dc/elements/1.1/In document text (OOXML body / shared strings)
    • http://purl.org/dc/terms/In document text (OOXML body / shared strings)
    • http://purl.org/dc/dcmitype/In document text (OOXML body / shared strings)
    • http://www.w3.org/2001/XMLSchema-instanceIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/extended-propertiesIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/docPropsVTypesIn document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 755 bytes
SHA-256: 7206d4f1e77c5df473864eff0cfdc99478940d95b300ae3344caf65361bfd31a
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Sub Workbook_Open()

    Dim imagePath As String
    imagePath = Cells(58, 19)
    ActiveSheet.Pictures.Insert (imagePath)
    
End Sub



Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
vbaProject_00.bin vba-project OOXML VBA project: xl/vbaProject.bin 14336 bytes
SHA-256: 66e764863080811ffc34a9e44a23257167078831a6114970cc91450047aa6129

Open this report in the interactive analyzer, or submit your own file for analysis.