Office (OOXML) malware analysis — malicious · 34645d773c9407a4

MALICIOUS

Office (OOXML)

12.5 KB Created: 2015-06-05 18:19:34 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2021-11-21

MD5: de795ff4be1cf8e7b6a81385b755cc49 SHA-1: f28f54808036c0a6446f9dfb9d3b4cfcdf765f9a SHA-256: 34645d773c9407a4c2cc5755edd202c4c95a121b5d073be7af600ff4d9920add

220 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1059.001 PowerShell T1059.003 Windows Command Shell T1204.002 Malicious File

The VBA macro contains an AutoOpen subroutine that executes 'cmd.exe /c notepad.exe & powershell'. This indicates the macro's intent is to launch a command shell to run notepad and then immediately execute PowerShell, a common technique for downloading and executing further malicious content. The presence of critical heuristics for Shell() and PowerShell references in VBA, along with a high heuristic for cmd.exe, strongly supports this analysis.

Heuristics 5

VBA project inside OOXML medium 4 related findings OOXML_VBA

Document contains a VBA project — VBA macros present
Potential Shell call in VBA critical OLE_VBA_SHELL

Potential Shell call in VBA
Matched line in script
```
Sub autoipen()
  Shell ("cmd.exe /c notepad.exe & powershell")
End Sub
```
PowerShell reference in VBA critical OLE_VBA_PS

PowerShell reference in VBA
Matched line in script
```
Sub autoipen()
  Shell ("cmd.exe /c notepad.exe & powershell")
End Sub
```
cmd.exe reference in VBA high OLE_VBA_CMD

cmd.exe reference in VBA
Matched line in script
```
Sub autoipen()
  Shell ("cmd.exe /c notepad.exe & powershell")
End Sub
```
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	734 bytes
SHA-256: `0d26872833015f61af9d0dccc79af74d8792ba9c9db9c0b32c2785c464dffaee`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "Workbook______________" Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Attribute VB_Name = "Worksheet______1" Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Attribute VB_Name = "Module1" Sub autoipen() Shell ("cmd.exe /c notepad.exe & powershell") End Sub
`vbaProject_00.bin`	vba-project	OOXML VBA project: xl/vbaProject.bin	14848 bytes
SHA-256: `408e0a77126a01dee2d2ed2510453be4b1c8602ec0ce04631103d7bfd52f11f1`

Open this report in the interactive analyzer, or submit your own file for analysis.