Malicious Office (OOXML) / .XLSM — malware analysis report

Static analysis result for SHA-256 0be0253ef0653fae…

MALICIOUS

Office (OOXML) / .XLSM

40.4 KB Created: 2020-10-07 12:17:24 UTC Authoring application: Microsoft Excel 16.0300
MD5: 9fe0aaa8e2fce7e0f7edb992b80b94ae SHA-1: 9bf712b44bfe3068c29e8a387ec5d33e9b107545 SHA-256: 0be0253ef0653faeda6da8f44b05e5c63035d1142efd90d63b41568d28458959
140 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is an XLSM file containing VBA macros. The critical heuristic 'OLE_VBA_ACTIVEX_XLM_STAGER' indicates that an ActiveX event triggers the execution of an Excel 4.0 macro. The VBA script contains a function 'uji' that decodes strings and a function 'okd' that executes decoded strings using 'ExecuteExcel4Macro'. The script iterates through cells, decodes strings, and then executes them. The decoded strings appear to be URLs, suggesting the script's purpose is to download and execute a second-stage payload. The ClamAV detection further confirms its malicious nature.

Heuristics 3

  • VBA ActiveX event launches decoded Excel4 macro critical OLE_VBA_ACTIVEX_XLM_STAGER
    The compiled VBA p-code (identifier table) references an auto-firing ActiveX/control event together with ExecuteExcel4Macro, while the decompressed source does not — the VBA-stomping shape of the ActiveX-event XLM stager. The control event bridges into XLM formula execution to call Win32 / drop payloads, hidden from source-level scanners.
  • ClamAV: Win.Malware.Agent-9775227-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Malware.Agent-9775227-0
  • VBA project inside OOXML medium OOXML_VBA
    Document contains a VBA project — VBA macros present

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
623145e62ae451ad2147b8224c75239b52e3a236b72d6eeac15e05c66710b4b6		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 1868 bytes
vbaProject_00.bin
7ce77e6ef3c160e0148a01d1baadd3c44ca7315266ed30d385d22da30944137a		 vba-project OOXML VBA project: xl/vbaProject.bin 18944 bytes
emf_00.emf
9fdea40291be12a7d4918e8406a877c37da2a55fc80dd99269c5fb7391624e51		 ooxml-emf OOXML EMF part: xl/media/image1.emf 2352 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.