Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 38c12c6ab6cf1ba1…

MALICIOUS

Office (OOXML)

41.6 KB Created: 2021-06-22 12:43:05 UTC Authoring application: Microsoft Excel 16.0300
MD5: b023aa79b6dfcda6b1f4f0ee6a08d4c7 SHA-1: b0eec1791d9306e099362ff9bc2fe8a82e59ef05 SHA-256: 38c12c6ab6cf1ba17fcc12d5a56e3e9b3133d08df5dae89a8662c39274757fad
160 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.001 PowerShell T1204.002 Malicious File

The OOXML document contains VBA macros that reference cmd.exe and PowerShell. The GetObject call and the presence of VBA macros suggest an attempt to execute arbitrary code. The VBA code includes a Base64 decoding function, indicating that it likely decodes and executes a malicious payload, possibly downloaded from an external source.

Heuristics 4

  • PowerShell reference in VBA critical OLE_VBA_PS
    PowerShell reference in VBA
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
  • cmd.exe reference in VBA high OLE_VBA_CMD
    cmd.exe reference in VBA
  • VBA project inside OOXML medium OOXML_VBA
    Document contains a VBA project — VBA macros present

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
199bb7f0f7a3c865984cb6f890b71f505af5b82cef9eca5383e879f8b27b63a0		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 35036 bytes
vbaProject_00.bin
02f302e47cb3d6166b35148e151c906a7a11da48512df9b0c0b705c689195a36		 vba-project OOXML VBA project: xl/vbaProject.bin 11264 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.