Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 2ce17ec483897eee…

MALICIOUS

Office (OOXML)

70.0 KB Created: 2021-07-28 13:23:45 UTC Authoring application: Microsoft Excel 16.0300
MD5: 7f6fedd3707b1585b21e239b22bc7bc8 SHA-1: e9847ea8629504a8e7f09df205cd4d2d1b5610f8 SHA-256: 2ce17ec483897eeef022b8115127a629148c29bc64656271e9f9feef02e3e2e6
250 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1105 Ingress Tool Transfer

The sample is an OOXML document containing VBA macros. Critical heuristics indicate the use of Shell(), WScript.Shell, and URLDownloadToFile, suggesting the macro is designed to download and execute a second-stage payload. The macro likely uses the provided GitHub URL to fetch this payload. The presence of these indicators strongly points to a malicious intent to compromise the user's system.

Heuristics 7

  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
  • URLDownloadToFile in VBA critical OLE_VBA_DOWNLOAD
    URLDownloadToFile in VBA
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA project inside OOXML medium OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://github.com/florentbr/SeleniumBasic/releases/download/v2.0.9.0/SeleniumBasic-2.0.9.0.*
    • https://developer.microsoft.com/en-us/microsoft-edge/tools/webdriver/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
296980905ad0140d1acea8e3e5a332ff0ffaadfeda122764c47cbfaaa3e9d9eb		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 14061 bytes
vbaProject_00.bin
6e7105aa4911e562d4e2ec5d2f0fc411be0ccdcc11eaed4f450909bfdbd213d9		 vba-project OOXML VBA project: xl/vbaProject.bin 67584 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.