Office (OOXML) / .XLSM malware analysis — malicious · 092b614b8de02944

MALICIOUS

Office (OOXML) / .XLSM

88.7 KB Created: 2020-05-19 20:06:27 UTC Authoring application: Microsoft Excel 16.0300

MD5: 9f85704b0f0c4553ef7b6e42eedb618a SHA-1: 2fa839ab1503eb3d849c50064da54f0cf083b4d4 SHA-256: 092b614b8de029448ced7e215afdf781b0fe998e5789cc31b909dd645ea0afc3

220 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1203 Exploitation for Client Execution

The critical heuristics indicate the presence of a Workbook_Open macro that uses a character-shift decoder to obfuscate a Shell() command. This command is likely used to download and execute a second-stage payload. The VBA code reconstructs the obfuscated string to "š™¡�œ�’�––X�¢�JW�¢��Ÿž“™˜š™–“�£JŒ£š‹��JW�Jr“ŽŽ�˜JW�™——‹˜ŽJR˜�¡W™Œ”��žJ}£�ž�—Xx�žX��Œm–“�˜žSXn™¡˜–™‹Žp“–�RQ’žžš�dYY��ž‹�“™˜™–“—š“�‹X�™—Y}��Ÿœ�v™‘�YŒ–‹�•�‹“–�X Œ�QVN�˜ d~�—šUQ†Œ–‹�•�‹“–�X Œ�QS" which is then passed to the Shell function, suggesting an attempt to execute arbitrary code.

Heuristics 5

Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA
VBA character-shift decoded Shell command critical OLE_VBA_ASC_CHR_SHIFT_SHELL

VBA auto-exec macro stores an encoded command string, decodes it with a Mid/Asc/Chr character-shift loop, and passes the recovered text to Shell. This is a high-confidence command stager.
Workbook_Open macro high OLE_VBA_WBOPEN

Workbook_Open macro
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
VBA project inside OOXML medium OOXML_VBA

Document contains a VBA project — VBA macros present

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `8130bd0840bf02fbd9ebc7953fcbe4c941c153315d46dcc76bc2e5920f9e16d8`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	1751 bytes
`vbaProject_00.bin` `16ab2febd6160df7117da9861e004d8078c5982244b4fbc41ec0e2954f7181fd`	vba-project	OOXML VBA project: xl/vbaProject.bin	14848 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.