Office (OOXML) malware analysis — malicious · 56901ef5770267a0

MALICIOUS

Office (OOXML)

60.8 KB Created: 2021-07-13 12:00:46 UTC Authoring application: Microsoft Excel 16.0300

MD5: d6fea14fb959bfebdfbf9ebbb961353f SHA-1: f53e9226435affb3a59110422b011a33356c691b SHA-256: 56901ef5770267a09af9ea1bfa253c2887f7f489fa3515ba525c808cf79ec783

162 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1218.011 System Binary Proxy Execution: Rundll32

The file is an Excel document containing a Workbook_Open macro that references PowerShell and cmd.exe. The embedded VBA script implements the RunPE technique, which is designed to execute a secondary payload. The script explicitly mentions downloading and executing files, and references GitHub repositories related to RunPE and malware development, indicating a malicious intent to download and run further stages.

Heuristics 5

PowerShell reference in VBA critical OLE_VBA_PS

PowerShell reference in VBA
Workbook_Open macro high OLE_VBA_WBOPEN

Workbook_Open macro
cmd.exe reference in VBA high OLE_VBA_CMD

cmd.exe reference in VBA
VBA project inside OOXML medium OOXML_VBA

Document contains a VBA project — VBA macros present
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://github.com/itm4n/VBA-RunPE
- https://github.com/hasherezade/
- https://www.nirsoft.net/kernel_struct/vista/IMAGE_DOS_HEADER.html
- https://msdn.microsoft.com/fr-fr/library/windows/desktop/ms680305(v=vs.85).aspx
- https://msdn.microsoft.com/fr-fr/library/windows/desktop/ms680313(v=vs.85).aspx
- https://msdn.microsoft.com/en-us/library/windows/desktop/ms680339(v=vs.85).aspx
- https://msdn.microsoft.com/fr-fr/library/windows/desktop/ms680336(v=vs.85).aspx
- https://www.nirsoft.net/kernel_struct/vista/IMAGE_SECTION_HEADER.html
- https://msdn.microsoft.com/fr-fr/library/windows/desktop/ms684873(v=vs.85).aspx
- https://msdn.microsoft.com/en-us/library/windows/desktop/ms686331(v=vs.85).aspx
- https://www.nirsoft.net/kernel_struct/vista/FLOATING_SAVE_AREA.html
- https://msdn.microsoft.com/en-us/library/windows/desktop/ms679284(v=vs.85).aspx
- https://www.nirsoft.net/kernel_struct/vista/IMAGE_DOS_HEADER.html�

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `e7279298a39b45be63e7c3b22fb21a8fb1dd6315042dd8e941f9f5c7f18c0b08`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	53607 bytes
`vbaProject_00.bin` `d59643fbb05f9805baf3046cd45a9a36c51b647a32cdaf424394a08db09c57d4`	vba-project	OOXML VBA project: xl/vbaProject.bin	128000 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.