Malicious Office (OOXML) / .XLSX — malware analysis report

Static analysis result for SHA-256 092445a144289e58…

MALICIOUS

Office (OOXML) / .XLSX

59.7 KB Created: 2020-05-21 06:59:53 UTC Authoring application: Microsoft Excel 16.0300
MD5: c540384373d91ef6d58fc0f019be9ebe SHA-1: 67e486f374a419e44ad16e64db3db1e3c62e414b SHA-256: 092445a144289e58dc6ea7fcd95e4b385d0089090b1d2d2a3dd3af5d51a06d90
240 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The file is an Excel spreadsheet containing VBA macros. The macros utilize WScript.Shell and the Shell() function, indicating an attempt to execute arbitrary commands. The ClamAV detection 'Doc.Dropper.Agent-7863714-0' suggests this dropper functionality is intended to download and execute a secondary payload. The VBA code appears to construct a command string from constants within the document, which is then executed.

Heuristics 5

  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
  • ClamAV: Doc.Dropper.Agent-7863714-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-7863714-0
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA project inside OOXML medium OOXML_VBA
    Document contains a VBA project — VBA macros present

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
6cd89edc222496ec4d16f4c22cb6a60f1eb3b28a5fa0e362898332e6bd288921		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 1274 bytes
vbaProject_00.bin
2853d0207b1a8a0ebc20537518581eae67b0882f453d645aa86995bfe0f37903		 vba-project OOXML VBA project: xl/vbaProject.bin 16896 bytes
emf_00.emf
765ef826e4c0f85a4b7d1bb4d529403984a4a3edafb147897d9544801de2e9ae		 ooxml-emf OOXML EMF part: xl/media/image1.emf 2796 bytes
emf_01.emf
1ba28807701f1477cac770c3cc12a7164ebb0db67f3a65a37e43271a037a86bd		 ooxml-emf OOXML EMF part: xl/media/image2.emf 1408 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.