Office (OOXML) / .XLSX malware analysis — malicious · 350856665e0c497c

MALICIOUS

Office (OOXML) / .XLSX

43.1 KB Created: 2020-01-28 19:47:00 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2021-10-27

MD5: 53d38f8aec071ed1464871f36ceb058b SHA-1: 498f95fdfb05bf30036a6dafc72a22abcc4967ab SHA-256: 350856665e0c497c90a091be624825002a59df1b65404fdb9f82fe58013277c5

110 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File T1059.005 Visual Basic

The sample is an Excel document containing VBA macros. A heuristic firing indicates the document uses a macro-enable lure. The VBA script contains obfuscated code that, when decoded, reveals it uses PowerShell to download a second-stage executable from 'http://xamp.chickenkiller.com/MAAM/ConsoleApp1.exe' and then executes it. The PowerShell command constructed is 'powershell -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\SysWOW64\1.0\powershell.exe"'.

Heuristics 5

Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA
VBA project inside OOXML medium OOXML_VBA

Document contains vbaProject.bin — VBA macros present
Macro/content-enable lure medium SE_ENABLE_LURE

Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
External hyperlinks (3) low OOXML_EXTERNAL_HYPERLINKS

Document contains 3 external hyperlinks — clickable URLs are stored as external relationships. First target: http://go.microsoft.com/fwlink/?LinkId=846285
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://go.microsoft.com/fwlink/?LinkId=846285
- http://go.microsoft.com/fwlink/?LinkId=844969

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `989f1e52798c124f5680a3d0ed19df099a65637a7461a84444769d328aec3dcd`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	2859 bytes
`vbaProject_00.bin` `cd0163d4a98a78c27a95f0980635220838a40c8922bded47cbb182bf62246b4d`	vba-project	OOXML VBA project: xl/vbaProject.bin	6656 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.