Office (OOXML) malware analysis — malicious · 56472abd5ea7d747

MALICIOUS

Office (OOXML)

41.5 KB Created: 2021-06-22 12:43:05 UTC Authoring application: Microsoft Excel 16.0300

MD5: 26a593114beef9b7b6b3f7a11da167b2 SHA-1: 7c38bf485a422af0bc8be3c9cacc077e41b1e130 SHA-256: 56472abd5ea7d747911f9d9e68f83d7d3caa7707353d694fccb4d01feb2c3ed5

160 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1059.001 PowerShell T1204.002 Malicious File

The OOXML file contains VBA macros that reference cmd.exe and PowerShell. The presence of a GetObject call further suggests an attempt to execute external code. The VBA code includes a Base64 decoding function, indicating that malicious content is likely obfuscated within the script and then decoded and executed. This pattern is typical of macro-based malware designed to download and run additional payloads.

Heuristics 4

PowerShell reference in VBA critical OLE_VBA_PS

PowerShell reference in VBA
GetObject call high OLE_VBA_GETOBJ

GetObject call
cmd.exe reference in VBA high OLE_VBA_CMD

cmd.exe reference in VBA
VBA project inside OOXML medium OOXML_VBA

Document contains a VBA project — VBA macros present

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `9c0d16787140fa48b526992c3c427cd1757290d6a00c554f1f1e2d5246892a43`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	34430 bytes
`vbaProject_00.bin` `3910a90a30feb5cc0f27385041e7490e085c05ed8a53a27637ba6aa2a8536ad6`	vba-project	OOXML VBA project: xl/vbaProject.bin	11264 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.