Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 13f3d3629749df4e…

MALICIOUS

Office (OOXML)

41.6 KB Created: 2021-06-22 12:43:05 UTC Authoring application: Microsoft Excel 16.0300
MD5: ff17fc15b74d8f363655175cabe95e9c SHA-1: 0affb0e65240b525112ad2c56575816ab7e1e50c SHA-256: 13f3d3629749df4e046f4c83175b45eda6184d75079cf7fa3d9ab85cb1e682f4
160 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.001 PowerShell T1059.003 Windows Command Shell

The sample is an Office document containing VBA macros. Heuristics indicate the presence of PowerShell and cmd.exe references within the VBA code, suggesting an attempt to execute external commands. The VBA code itself appears to be obfuscated, but the presence of these references strongly implies a downloader or execution mechanism for a second-stage payload.

Heuristics 4

  • PowerShell reference in VBA critical OLE_VBA_PS
    PowerShell reference in VBA
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
  • cmd.exe reference in VBA high OLE_VBA_CMD
    cmd.exe reference in VBA
  • VBA project inside OOXML medium OOXML_VBA
    Document contains a VBA project — VBA macros present

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
591f83bad917f200776b7d480325f9623fc301e0268920aab1dc6c5610211d39		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 35036 bytes
vbaProject_00.bin
bb1577b21a1e2670521d2a13b207ea2fbbe36b819c52b17776966e88e73d8314		 vba-project OOXML VBA project: xl/vbaProject.bin 11264 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.