Office (OOXML) malware analysis — malicious · 4e6bb1da0468a325

MALICIOUS

Office (OOXML)

41.5 KB Created: 2021-06-22 12:43:05 UTC Authoring application: Microsoft Excel 16.0300

MD5: cd873be1abb18f48d132af6f9e52d161 SHA-1: 598bee16359870c26f516bf7e8d9d0111332340e SHA-256: 4e6bb1da0468a325a0f56e6a7ee608548fc9febccd5f2100a192923464c67b6f

160 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1059.003 Windows Command Shell T1566.001 Spearphishing Attachment

The OOXML file contains VBA macros that reference cmd.exe and PowerShell. The GetObject call and the presence of a VBA project indicate macro execution is intended. The VBA code itself appears to be heavily obfuscated, but the critical heuristic firing suggests PowerShell is invoked, likely to download and execute a second-stage payload. No specific family could be identified due to the obfuscation.

Heuristics 4

PowerShell reference in VBA critical OLE_VBA_PS

PowerShell reference in VBA
GetObject call high OLE_VBA_GETOBJ

GetObject call
cmd.exe reference in VBA high OLE_VBA_CMD

cmd.exe reference in VBA
VBA project inside OOXML medium OOXML_VBA

Document contains a VBA project — VBA macros present

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `ebda256233e7ac98390c20a2bf53fbacdbb8f3132914ed8b8bb4ce48253613b1`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	34430 bytes
`vbaProject_00.bin` `c655588fe861e933f174b4e032b7190ca25f227da3c8cb4c66c00499737071d6`	vba-project	OOXML VBA project: xl/vbaProject.bin	11264 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.