Office (OOXML) / .XLSM malware analysis — malicious · 10fc80f6e2d5a215

MALICIOUS

Office (OOXML) / .XLSM

90.0 KB Created: 2020-12-24 03:23:15 UTC Authoring application: Microsoft Excel 15.0300

MD5: 0a7702d1bca80e380618b3c4ff48a755 SHA-1: 77b88402e401910f219b78328c712dec1c55632c SHA-256: 10fc80f6e2d5a215044d38975f99f9b4cb2e7d5913927a3b83cf5a2675776006

260 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1204.002 Malicious File

The sample is an XLSM file containing a Workbook_Open macro that executes obfuscated VBA code. This code attempts to use 'WScript.Shell' to execute a command. The obfuscated string 'fpg#2f#srzhuvkhoo#0HqfrghgFrppdqg#NDExDJXDgzDwDJ;D\jEtDJXD\zE3DFDDOTEmDJ;DeTDjDIPDdDEoDJzDeDDxDHHDfDEzDJzDdTEmDJHDgDEsDJ;DejDsDF7DXzErDJXDeDEvDHXDhDEoDJPDgTE3DJXDNDDnDJXDejE5DGrDTTEzDKDDUDEkDKTD\TDuDFfD[DE6DHvDUDEXDH\DOjEoDKjD]TDqDFnDLDD@' is likely a deobfuscated command or URL that would download and execute a second-stage payload. The use of Shell() and CreateObject() with obfuscated API names points to a downloader or droppper malware.

Heuristics 6

Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA
Dangerous API name reassembled from split string literals critical OLE_VBA_SPLIT_KEYWORD_OBFUSCATION

VBA concatenates short string literals that reassemble a dangerous API/ProgID/LOLBin name (e.g. Scripting.FileSystemObject, WScript.Shell, powershell, URLDownloadToFile) which appears in no single literal. Splitting an API name across string concatenation is done only to evade keyword scanning.
Workbook_Open macro high OLE_VBA_WBOPEN

Workbook_Open macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
VBA project inside OOXML medium OOXML_VBA

Document contains a VBA project — VBA macros present

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `a521f697bdcd4c9a6865d20332380011d20c1d02f45fc6a18e208ab5cdb552f1`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	2653 bytes
`vbaProject_00.bin` `bad60b47f7a9e549c2ce818bd1eb1cb8367703a39d6ee630a87169bf475bdb79`	vba-project	OOXML VBA project: xl/vbaProject.bin	18944 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.