Malicious Office (OOXML) / .XLSM — malware analysis report

Static analysis result for SHA-256 0275b7bd62327e6b…

MALICIOUS

Office (OOXML) / .XLSM

199.4 KB Created: 2021-03-24 13:10:23 UTC Authoring application: Microsoft Excel 15.0300
MD5: 1fd8680331c0e47f178ae6992574c402 SHA-1: 4aff22939a2a78df037fde10d23be5b01ed3c595 SHA-256: 0275b7bd62327e6be83d3cd154d50b693eabe42e85e5c9b5c11f5ed6a6a04ec2
200 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The XLSM file contains a Workbook_Open macro that triggers obfuscated VBA code. This code appears to be designed to execute system commands, as indicated by the presence of 'wmic os get VIEW/PRINT' and the 'GetObject' call. The obfuscation and auto-execution nature suggest a downloader or initial execution stage for further malicious activity.

Heuristics 5

  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
  • Workbook_Open macro high OLE_VBA_WBOPEN
    Workbook_Open macro
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • VBA project inside OOXML medium OOXML_VBA
    Document contains a VBA project — VBA macros present

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
2dbc5799949a65893cc9f808acab552ee3dcdddbcea6bbce707a09e87b8c3a3a		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 7814 bytes
vbaProject_00.bin
6dfd3b8f8250f3b3a681aeb38682af6800160010702e97a22fe8dd717a5b7d8b		 vba-project OOXML VBA project: xl/vbaProject.bin 65024 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.