Office (OOXML) malware analysis — malicious · 1dbe55ed696f7c3a

MALICIOUS

Office (OOXML)

41.6 KB Created: 2021-06-22 12:43:05 UTC Authoring application: Microsoft Excel 16.0300

MD5: f11120df3f5a36fb1c065b8994bce44d SHA-1: e4446ba3387619d87e31719874a7f9cbbc8dcff7 SHA-256: 1dbe55ed696f7c3a9bfd7d46365e9e44e6cfea97e960a66fcf495ee37cf81805

160 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1059.001 PowerShell T1059.003 Windows Command Shell

The file contains VBA macros that reference PowerShell and cmd.exe, indicating an attempt to execute external commands. The presence of a Base64 decoding function suggests that malicious code is likely obfuscated within the macro and then executed. This pattern is commonly used to download and run further malicious payloads.

Heuristics 4

PowerShell reference in VBA critical OLE_VBA_PS

PowerShell reference in VBA
GetObject call high OLE_VBA_GETOBJ

GetObject call
cmd.exe reference in VBA high OLE_VBA_CMD

cmd.exe reference in VBA
VBA project inside OOXML medium OOXML_VBA

Document contains a VBA project — VBA macros present

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `ce067511507b124cdac1f4ca0ad03d4e5849b3b42fc9ceaf7ab4777ef0a6a344`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	35036 bytes
`vbaProject_00.bin` `08ab8ecef0ecc487d63c2b05f5f1b3c6a19947184824d0b224b13f0dcf84b11d`	vba-project	OOXML VBA project: xl/vbaProject.bin	11264 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.