Office (OOXML) / .XLSM malware analysis — malicious · 406ae986c7238223

MALICIOUS

Office (OOXML) / .XLSM

29.7 KB Created: 2020-11-16 12:25:15 UTC Authoring application: 16.0300

MD5: ef3b7f93392bee34ef3a27b9dd95b148 SHA-1: f35848fdcc1900e68d7bae5818f0dbe6b58ebe48 SHA-256: 406ae986c72382231fae46850d054ce174f5a70ccf948d21d8e48663c16ec081

80 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic for Applications T1059.005 Visual Basic for Applications T1566.002 Spearphishing Attachment

The critical heuristic 'OLE_VBA_ACTIVEX_XLM_STAGER' indicates that the VBA code within the OOXML document is designed to launch a decoded Excel 4.0 macro. This stager mechanism is commonly used to download and execute further malicious content. The presence of embedded URLs and the obfuscated nature of the document body suggest a downloader or droppper functionality. The specific IOCs are derived from the obfuscated strings within the document body, which likely represent parts of the decoding or execution routine.

Heuristics 2

VBA ActiveX event launches decoded Excel4 macro critical OLE_VBA_ACTIVEX_XLM_STAGER

VBA code attached to an ActiveX/UserForm event decodes strings from worksheet cells through a Mid/Asc/Chr character-shift loop and passes the recovered formula text to ExecuteExcel4Macro. This is a high-confidence macro stager that bridges VBA event activation into XLM formula execution rather than a specific Office parser CVE.
VBA project inside OOXML medium OOXML_VBA

Document contains vbaProject.bin — VBA macros present

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `bb395f56140a6cc0cafc305f44c7e513b46c41fef80c6c9e1db5f90e088c183a`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	2196 bytes
`vbaProject_00.bin` `2d8638a5d3e8d0c680cc16d6ffe4ec4f9fdc076f377513aaf2567ad0046bd445`	vba-project	OOXML VBA project: xl/vbaProject.bin	19456 bytes
`emf_00.emf` `18442f66fc184308368fb113b1c28494dce7331a052469405fcf94f2ee8085b5`	ooxml-emf	OOXML EMF part: xl/media/image1.emf	2024 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.