Malicious Office (OOXML) / .XLSX — malware analysis report

Static analysis result for SHA-256 173f0bd241e73d37…

MALICIOUS

Office (OOXML) / .XLSX

9.3 KB Created: 2023-01-22 11:25:16 UTC Authoring application: Microsoft Excel 15.0300 First seen: 2023-10-02
MD5: 27e1472a34aa41ede7a05b114cb12dd2 SHA-1: b1bc20f8e5eb56a36979d76a5dbb9f3a44619996 SHA-256: 173f0bd241e73d379ce82313d26bf465ce26e047ce822d1a16e7d0ad0049966a
282 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.001 PowerShell T1059.003 Windows Command Shell T1105 Ingress Tool Transfer

The Workbook_Open macro contains obfuscated VBA code that, when deobfuscated, constructs and executes a PowerShell command. This command downloads a file from http://95.164.22.183/ry/IMG_8977390.exe and executes it. The use of WScript.Shell and CreateObject indicates a high likelihood of malicious intent to download and run a secondary payload.

Heuristics 7

  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
  • Obfuscated VBA Shell command with URL critical OLE_VBA_OBFUSCATED_SHELL_URL
    VBA macro invokes Shell with command text assembled through decoder or string-manipulation functions and includes a URL. This is a high-confidence downloader/dropper pattern, stronger than Shell or URL evidence on their own.
  • Workbook_Open macro high OLE_VBA_WBOPEN
    Workbook_Open macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA project inside OOXML medium OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://95.164.22.183/ry/IMG_8977390.exe

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
070ff5913d3cfd74d09e44ae4b2cb1b53f849bab60351d7b09baed4165134250		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 1286 bytes
vbaProject_00.bin
5a259bd76f29516d6e1501d007279a9a1a6a510c31f0ee6cb6164cfef7db4030		 vba-project OOXML VBA project: xl/vbaProject.bin 4608 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.