Malicious Office (OOXML) / .XLSM — malware analysis report

Static analysis result for SHA-256 5ca061faa8e7a7ef…

MALICIOUS

Office (OOXML) / .XLSM

84.9 KB Created: 2021-02-17 17:32:03 UTC Authoring application: Microsoft Excel 16.0300
MD5: 20f158ab7c453b5793b7492e8c5679a5 SHA-1: 39b3ea7c2294c34a9782dab109d8cfbfa04a2b35 SHA-256: 5ca061faa8e7a7ef6f6d2ac3329966d1b8816421911e2813879497777e5622e7
220 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution

The sample is an XLSM file containing a Workbook_Open macro that utilizes obfuscated VBA code to execute a command via the Shell function. The obfuscation involves character shifting and concatenation, likely to hide the true nature of the command. The reconstructed string suggests a command that would download and execute a payload, indicating a downloader or droppper functionality.

Heuristics 5

  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • VBA character-shift decoded Shell command critical OLE_VBA_ASC_CHR_SHIFT_SHELL
    VBA auto-exec macro stores an encoded command string, decodes it with a Mid/Asc/Chr character-shift loop, and passes the recovered text to Shell. This is a high-confidence command stager.
  • Workbook_Open macro high OLE_VBA_WBOPEN
    Workbook_Open macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • VBA project inside OOXML medium OOXML_VBA
    Document contains a VBA project — VBA macros present

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
d621b103aa9efef647cffc1821c2f339e41da4964a6158c3d8e3a19c498a8274		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 19857 bytes
vbaProject_00.bin
019adfb46bdaad3c90c15efd092ec784ed9e2e868c07e68f44d5c727afd4db21		 vba-project OOXML VBA project: xl/vbaProject.bin 29696 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.