Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 16a18c2623146fe8…

MALICIOUS

Office (OOXML)

63.7 KB Created: 2021-07-28 13:23:45 UTC Authoring application: Microsoft Excel 16.0300
MD5: 2b9a5bc079249ed28095dd4d3d9ba2da SHA-1: dfce56ecd65fa035f8fafc5979a8e59be775445d SHA-256: 16a18c2623146fe869ed491a37172c089749d1e319286ec4ffdb4df80bbfbec1
250 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1105 Ingress Tool Transfer T1204.002 Malicious File

The sample is an OOXML file containing VBA macros that utilize Shell(), WScript.Shell, and CreateObject() functions. Crucially, it employs URLDownloadToFile to fetch a payload from the URL 'https://github.com/florentbr/SeleniumBasic/releases/download/v2.0.9.0/SeleniumBasic-2.0.9.0.*'. This indicates a downloader or droppper functionality, aiming to execute further malicious code.

Heuristics 7

  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
  • URLDownloadToFile in VBA critical OLE_VBA_DOWNLOAD
    URLDownloadToFile in VBA
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA project inside OOXML medium OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://github.com/florentbr/SeleniumBasic/releases/download/v2.0.9.0/SeleniumBasic-2.0.9.0.*
    • https://developer.microsoft.com/en-us/microsoft-edge/tools/webdriver/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
bb9e24bbc4deadffdce0d6ccfc9613049c41825435e89d270b3d4e82f2da2c18		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 14171 bytes
vbaProject_00.bin
120750df7e0d09b8ee44b7aeda59467d4e5c4751938c3d42602333b79ae16296		 vba-project OOXML VBA project: xl/vbaProject.bin 48128 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.