Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 29b312ed869bdac7…

MALICIOUS

Office (OOXML)

41.5 KB Created: 2021-06-22 12:43:05 UTC Authoring application: Microsoft Excel 16.0300
MD5: eb06d8184ffd0c386d40941e23924b9f SHA-1: d4a86b7ffd914a60013d37b8c30ce7bfec5d6588 SHA-256: 29b312ed869bdac794da1b169d2fda37fd765b60a70cc4eea00c848f5fb484f6
160 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.001 PowerShell T1059.003 Windows Command Shell T1204.002 Malicious File

The file is an Office document containing VBA macros. Heuristics indicate the VBA code references PowerShell and cmd.exe, and uses GetObject. The VBA code itself appears to be heavily obfuscated, but its structure suggests it is designed to download and execute a secondary payload. The presence of these indicators strongly suggests a malicious intent, likely for initial execution and payload delivery.

Heuristics 4

  • PowerShell reference in VBA critical OLE_VBA_PS
    PowerShell reference in VBA
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
  • cmd.exe reference in VBA high OLE_VBA_CMD
    cmd.exe reference in VBA
  • VBA project inside OOXML medium OOXML_VBA
    Document contains a VBA project — VBA macros present

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
edc4a82de869e40be293c488964656394d77ebe447881a6120496d54af86a587		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 34430 bytes
vbaProject_00.bin
37307e83ac0e8ffdd87890dab6080391587adea3027a252f9c3a896ba094dde5		 vba-project OOXML VBA project: xl/vbaProject.bin 11264 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.