Office (OOXML) malware analysis — malicious · 2b40553570936e50

MALICIOUS

Office (OOXML)

264.5 KB Created: 2021-06-18 16:09:13 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2021-06-28

MD5: 85831e9e530308a23fefbb043580db9f SHA-1: 697466b207cb9a170b6afd342733406e12f7eaaa SHA-256: 2b40553570936e505438bd774a2ebc7a36ae7d16e7204ec1074142b5d95c97ae

120 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1203 Exploitation for Client Execution

The critical heuristic firing indicates the presence of Excel 4.0 macros, which are known to be used for malicious purposes. The VBA script contains a `CreateObject` call and a function that appears to obfuscate strings, suggesting it's preparing to execute commands. The Excel 4.0 macro sheet contains references to `cmd`, indicating command execution is intended. These elements together suggest the file is a downloader for a second-stage payload.

Heuristics 3

Excel 4.0 macro sheet (1 sheet(s)) critical OOXML_XLM_MACROSHEET

Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks. The macro sheet is stored as XLSB/BIFF12 binary content, which many XML-only OOXML scanners miss.
VBA project inside OOXML medium 1 related finding OOXML_VBA

Document contains a VBA project — VBA macros present
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	683 bytes
SHA-256: `30fb8fee99175d290080d8a0fac253fde45640fd92380e068ac5bfb0025baabd`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisWorkbook" Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Attribute VB_Name = "Module1" Public Function FovNYIgtnN(ZeelHNmQnd As String, UghwHxs As String) As String Set x0ZAdOywm = CreateObject(UghwHxs) yxbsTpaGkJ = Array(ZeelHNmQnd) With x0ZAdOywm .Pattern = "B\|Y\|U\|v\|w\|D\|q\|V\|F\|j\|P\|I\|X\|L\|O\|Q\|G\|M\|N\|K\|H\|z\|Z" .Global = True End With FovNYIgtnN = x0ZAdOywm.Replace(yxbsTpaGkJ(0), "") End Function
`vbaProject_00.bin`	vba-project	OOXML VBA project: xl/vbaProject.bin	12288 bytes
SHA-256: `b71fc5fd62da4a8922932c6386b1ee753373752dd4cbff92c272b96ad1eb8ffb`
`xlm_sheet_00.bin`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/sheet1.bin	2548 bytes
SHA-256: `26945f24b1ffb80a17be94c60d4ab3f4bed86c0d8eec4b41c69c19d8c72ba038`
Preview script First 1,000 lines of the extracted script � � � @ �� % �� & � � @ d � $ � � % �� & � �� , � < < �? $ � � % �� & , Q 7 # $ �D �D � D � D � D � B � % �� & , Q 7 # $ �D �D � D � D � D � B � % �� & , Q 7 # $ �D �D � D � D � D � B � % �� & , Q 7 # $ �D �D � D � D � D � B � % �� & , Q 7 # $ �D �D � D � D � D � B � % �� & , Q 7 # $ �D �D � D � D � D � B � % �� & , Q 7 # $ �D �D � D � D � D � B � % �� & , Q 7 # $ �D �D � D � D � D � B � % �� & , M 3 D �D �D � J I Z Z L E F I B � % �� & , C ) # $ � c m d $ � B � % �� & , A ' AJ @ 0 0 : 0 0 : 0 4 @ B �� % �� & , A ' # $ �$ �$ � B � % �� & , ? % AJ @ 0 0 : 0 0 : 9 @ B �� % �� & , C ) # $ � c m d $ � B � % �� & , B 6 � � � �� @ ��Kmd[�U5M��,�� Ҁ� ��BC� h�D= ��C��n ��E ��U�&X8��nU٤VK � D'�$�셨m�� S H A - 5 1 2 � B � Po� 0ffffff�?ffffff�? �? �?333333�?333333�?� . d X X r I d 2 % �� & �

Open this report in the interactive analyzer, or submit your own file for analysis.