Malicious Office (OOXML) / .XLSM — malware analysis report

Static analysis result for SHA-256 25f1b3cde8232f81…

MALICIOUS

Office (OOXML) / .XLSM

49.7 KB Created: 2020-10-14 12:21:49 UTC Authoring application: Microsoft Excel 16.0300
MD5: 877904d3f0fded9f76d5e676e62950a4 SHA-1: 944cfe32a51aacd0be5455dac879769e439f2ab5 SHA-256: 25f1b3cde8232f81ef85ee53c333a20311cff00fdd3aa4aef80f01d13de4dd66
80 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.001 PowerShell T1204.002 Malicious File

The critical heuristic 'OLE_VBA_ACTIVEX_XLM_STAGER' indicates that VBA code is used to launch decoded Excel4 macros. The VBA script 'macros.bas' contains functions that appear to deobfuscate and reconstruct a long string of URLs. These URLs are likely used to download and execute a second-stage payload. The script's obfuscation and the use of multiple download URLs suggest a downloader or droppper functionality.

Heuristics 2

  • VBA ActiveX event launches decoded Excel4 macro critical OLE_VBA_ACTIVEX_XLM_STAGER
    The compiled VBA p-code (identifier table) references an auto-firing ActiveX/control event together with ExecuteExcel4Macro, while the decompressed source does not — the VBA-stomping shape of the ActiveX-event XLM stager. The control event bridges into XLM formula execution to call Win32 / drop payloads, hidden from source-level scanners.
  • VBA project inside OOXML medium OOXML_VBA
    Document contains vbaProject.bin — VBA macros present

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
8cff63167ca151ae6047c476dd35fb04dcd6ba89c39b02856ff0175b8754bd4d		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 2120 bytes
vbaProject_00.bin
cab66fdd6bb7c24a2805b0d3791d9789adf31f876ee2a5754559439d0c88a355		 vba-project OOXML VBA project: xl/vbaProject.bin 20992 bytes
emf_00.emf
8357e7f07f41a1e53a6ef35edda5f8d6ef14c676e025cb302cff4e47f3ae55a8		 ooxml-emf OOXML EMF part: xl/media/image1.emf 2024 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.