Office (OOXML) / .XLSM malware analysis — malicious · 1a9d37c12f4cf983

MALICIOUS

Office (OOXML) / .XLSM

46.9 KB Created: 2020-02-01 18:28:07 UTC Authoring application: Microsoft Excel 12.0000

MD5: bf5c21dadabdbaca03d0c40af19a512d SHA-1: 05a0607930ea4ba08d70da2e741b453de2bfa35d SHA-256: 1a9d37c12f4cf983179534671f6218ba15fca41fc047e9dae8f2171e24f33d79

320 Risk Score

Malware Insights

MITRE ATT&CK

T1204.002 Malicious File Execution: Malicious File T1059.003 Command and Scripting Interpreter: Windows Command Shell T1566.001 Phishing: Spearphishing Attachment

The file is an XLSM document containing VBA macros, including an Auto_Open macro. It exploits CVE-2017-11882 through an embedded Equation Editor object. The embedded object contains a command stager that attempts to execute 'cmd /c ren %tmp%\mm v&cSCripT %tmp%\v..wsf ..C.......................................................', indicating it downloads and executes a second-stage payload.

Heuristics 8

CVE-2017-11882 — Equation Editor command stager critical CVE likely CVE_2017_11882_EQUATION_NATIVE_CMD

Embedded Equation Editor OLE data contains an invalid Equation Native/MTEF stream with an embedded command stager. This is likely CVE-2017-11882 exploitation because the vulnerable Equation Editor component is reached and the malformed native stream directly carries process-launch bytes.
Equation Editor OLE object high CVE related OLE_EQUATION_EDITOR

Embedded OLE object xl/embeddings/oleObject3.bin contains the Equation Editor CLSID, the legacy component exploited by CVE-2017-11882, CVE-2018-0802, and CVE-2018-0798.
ClamAV: Xls.Malware.Generic-8058593-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Malware.Generic-8058593-0
Auto_Open macro high OLE_VBA_AUTO

Auto_Open macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
VBA project inside OOXML medium OOXML_VBA

Document contains vbaProject.bin — VBA macros present
Embedded OLE object medium OOXML_OLE_OBJECT

Document contains an embedded OLE object

Extracted artifacts 9

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `62a98eb1c65960c6a90762832ff4207eb3ad3757522f1ae7a0514b145339211f`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	27626 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s). Carved macro source contains an auto-exec entry point and execution/download terms.
`ooxml_oleobject_00.bin` `d221af179df67e2ec0b600cd56c16e30b533380e6554d86b158667a0e0a58aea`	ooxml-ole-object	OOXML embedded OLE part: xl/embeddings/oleObject2.bin	12288 bytes
`ooxml_oleobject_00_ole10native_00.bin` `d7e09a547a49d84fe58958bcd5ac1460819aa3a72ea440955ee2014df04cb1f6`	ole-package	OOXML xl/embeddings/oleObject2.bin Ole10Native stream: Ole10Native	9473 bytes
`ooxml_oleobject_01.bin` `a584b820a2992d568309d29a53553719335cf38a9df44dc68a0604a6cca73f49`	ooxml-ole-object	OOXML embedded OLE part: xl/embeddings/oleObject1.bin	3584 bytes
`ooxml_oleobject_01_ole10native_00.bin` `f6cb57a07162be208979a032f45da4c4f20a53852a8066e47c23f6ed11fac834`	ole-package	OOXML xl/embeddings/oleObject1.bin Ole10Native stream: Ole10Native	1275 bytes
`ooxml_oleobject_02.bin` `a3744ee795040893ff0f6f6f0294c79e77b4adcb20de320cc05040edf6ef5ed5`	ooxml-ole-object	OOXML embedded OLE part: xl/embeddings/oleObject3.bin	5936 bytes
`ooxml_oleobject_03.bin` `f4183948c0340c10ba5f8d59f1e58673391cb0744887f9f8e340e98c6ca9717b`	ooxml-ole-object	OOXML embedded OLE part: xl/vbaProject.bin	46080 bytes
`emf_00.emf` `979dde2aed02f077c16ae53546c6df9eed40e8386d6db6fc36aee9f966d2cb82`	ooxml-emf	OOXML EMF part: xl/media/image1.emf	4968 bytes
`emf_01.emf` `4d4d1e7b04c99dcb8e885915068ad6f74cc2333e91580cdae5ccaa00c427247f`	ooxml-emf	OOXML EMF part: xl/media/image2.emf	1536 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.