The file is in VT also since a couple of weeks and it has a very low detection rate
The document is blank and it requieres to enable macros
The interesting part is the content of the macros.
First, there is a base64 encoded PoweSshell command, which I will take a look later.
Then, there is some code to open a window with an error message. The windows message informs that the file is 'corrupted' and that it is necessary to restore the file from a backup.
In the end the VBA executes Application.quit which finishes MS Excel.
This means that once the document is opened, some code is executed and straight forward it exists with some error message. This behaviour fools the user thinking that the file is corrupted.
Taking a look to the base64 encode command in the beginning of the VBA, the content is as follow:
Very interesting stuff: a shellcode is somewhere around.
The code can be executed in PowerShell
Resulting in a TCP connection to 220.127.116.11 on port 443, but connection can't be established anymore.
spoofing the IP and running netcat I can see what's going what is being requested.
So basically, it is not a real SSL connection, but just a normal HTTP connection using port 443 trying to get a resource "BRJ8F'.
What's going on here? Basically, the VBA is exploiting some features of Powershell. This is not really a flaw at all, but just the way Powershell can work, which permits to run shellcodes.
For further information you can read this article:
 Exploiting Powershell's Features (Not Flaws) http://www.exploit-monday.com/2011/10/exploiting-powershells-features-not.html