Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 1735cee8ae52272b…

MALICIOUS

Office (OOXML)

41.6 KB Created: 2021-06-22 12:43:05 UTC Authoring application: Microsoft Excel 16.0300
MD5: e0970a736829207ee8becc4eefe92a54 SHA-1: dcd3b91465aa386b308fcf0a8bd437855558c3d3 SHA-256: 1735cee8ae52272b7bdf9324de0a1d587c429b8ed882598b45a6673cc0e07b75
160 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1059.003 Windows Command Shell T1566.001 Spearphishing Attachment

This Excel document contains VBA macros that reference PowerShell and cmd.exe. The presence of these references, along with the GetObject call, strongly suggests the macro is designed to download and execute a malicious payload. The VBA code itself appears to be obfuscated, making a precise determination of the payload difficult without further dynamic analysis.

Heuristics 4

  • PowerShell reference in VBA critical OLE_VBA_PS
    PowerShell reference in VBA
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
  • cmd.exe reference in VBA high OLE_VBA_CMD
    cmd.exe reference in VBA
  • VBA project inside OOXML medium OOXML_VBA
    Document contains a VBA project — VBA macros present

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
37a621c349284aad66c1ccc1291c448a1b6582395329dd033d2080c065b0c26c		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 35036 bytes
vbaProject_00.bin
0046e35fb5eead25667ba3f65f4aabb0decc25bf5bbd50b92c3afb3dfea0f345		 vba-project OOXML VBA project: xl/vbaProject.bin 11264 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.