Malicious Office (OOXML) / .XLSX — malware analysis report

Static analysis result for SHA-256 22d0f84d94605494…

MALICIOUS

Office (OOXML) / .XLSX

87.8 KB Created: 2018-10-19 11:39:03 UTC Authoring application: Microsoft Excel 16.0300
MD5: fd922849f5394e5e7948854c4279f374 SHA-1: bd45d75fe615b076036bf73eb138d4519741e2de SHA-256: 22d0f84d94605494648e51a831aa2272e3461d5b2cb653465e30b8cf396a857e
100 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.005 Visual Basic

The sample is an OOXML spreadsheet containing a Workbook_Open VBA macro, indicating it's designed to execute code upon opening. The presence of a remote image beacon and an external relationship pointing to 'http://datazo.safe-browsing.de/Trx-d4qV' suggests this URL is used for malicious purposes, likely to download and execute a second-stage payload. The macro's execution is the primary attack vector.

Heuristics 5

  • Workbook_Open macro high OLE_VBA_WBOPEN
    Workbook_Open macro
  • VBA project inside OOXML medium OOXML_VBA
    Document contains vbaProject.bin — VBA macros present
  • Remote image (web beacon / tracking pixel) medium OOXML_IMAGE_BEACON
    Document references an external image URL — loads automatically on open, revealing IP address and timestamp to the server (used for phishing tracking and NTLM hash theft on corporate networks)
  • External relationship medium OOXML_EXTERNAL_REL
    External target in xl/drawings/_rels/drawing1.xml.rels: http://datazo.safe-browsing.de/Trx-d4qV
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://datazo.safe-browsing.de/mdn-t7gM
    • http://datazo.safe-browsing.de/Trx-d4qV
    • http://schemas.openxmlformats.org/package/2006/content-types
    • http://schemas.openxmlformats.org/package/2006/relationships
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships/extended-properties
    • http://schemas.openxmlformats.org/package/2006/relationships/metadata/core-properties
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships/officeDocument
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships/styles
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships/theme
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships/worksheet
    • http://schemas.microsoft.com/office/2006/relationships/vbaProject
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships/sharedStrings
    • http://schemas.openxmlformats.org/spreadsheetml/2006/main
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships
    • http://schemas.openxmlformats.org/markup-compatibility/2006
    • http://schemas.microsoft.com/office/spreadsheetml/2010/11/main
    • http://schemas.microsoft.com/office/spreadsheetml/2014/revision
    • http://schemas.microsoft.com/office/spreadsheetml/2016/revision6
    • http://schemas.microsoft.com/office/spreadsheetml/2016/revision10
    • http://schemas.microsoft.com/office/spreadsheetml/2015/revision2
    • http://schemas.microsoft.com/office/spreadsheetml/2010/11/ac
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships/image
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships/drawing
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships/printerSettings
    • http://schemas.openxmlformats.org/drawingml/2006/main
    • http://schemas.microsoft.com/office/thememl/2012/main
    • http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac
    • http://schemas.microsoft.com/office/spreadsheetml/2015/02/main
    • http://schemas.microsoft.com/office/spreadsheetml/2009/9/main
    • http://schemas.microsoft.com/office/spreadsheetml/2016/revision3
    • http://schemas.openxmlformats.org/drawingml/2006/spreadsheetDrawing
    • http://schemas.microsoft.com/office/drawing/2014/main
    • http://schemas.microsoft.com/office/drawing/2010/main
    • http://schemas.openxmlformats.org/officeDocument/2006/extended-properties
    • http://schemas.openxmlformats.org/officeDocument/2006/docPropsVTypes
    • http://schemas.openxmlformats.org/package/2006/metadata/core-properties
    • http://purl.org/dc/elements/1.1/
    • http://purl.org/dc/terms/
    • http://purl.org/dc/dcmitype/
    • http://www.w3.org/2001/XMLSchema-instance

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
7206d4f1e77c5df473864eff0cfdc99478940d95b300ae3344caf65361bfd31a		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 755 bytes
vbaProject_00.bin
5e6aa1c49656ab2e7de36bbfb6ad85a2bd0edac54472df86bc4e92af70c519d0		 vba-project OOXML VBA project: xl/vbaProject.bin 14336 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.