Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 3766e78776d93338…

MALICIOUS

Office (OOXML)

41.6 KB Created: 2021-06-22 12:43:05 UTC Authoring application: Microsoft Excel 16.0300
MD5: 3775542b6bfe3d20f315a7598915cd60 SHA-1: 33d035acfb4f34df21d55e427fb17355e442bcbf SHA-256: 3766e78776d9333800885fe126255876bedee99678f3f7a91db1c844e6f34f68
160 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.001 PowerShell T1204.002 Malicious File

The OOXML document contains VBA macros that reference cmd.exe and PowerShell. The GetObject call and the presence of a VBA project indicate that the document is designed to execute malicious code. The VBA code appears to be obfuscated, but the references to cmd.exe and PowerShell strongly suggest it's intended to download and execute a secondary payload.

Heuristics 4

  • PowerShell reference in VBA critical OLE_VBA_PS
    PowerShell reference in VBA
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
  • cmd.exe reference in VBA high OLE_VBA_CMD
    cmd.exe reference in VBA
  • VBA project inside OOXML medium OOXML_VBA
    Document contains a VBA project — VBA macros present

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
a4160819d1c7a94ddebad3e5e29cdfdc5d8896ba41328e16048e20a0e13661dc		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 35036 bytes
vbaProject_00.bin
cf65e1b74ee7e07aa7e9175b21e79c0a187457fc77abb4ca73e0aa968edf77ac		 vba-project OOXML VBA project: xl/vbaProject.bin 11264 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.