Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 694a0501f01eba6b…

MALICIOUS

Office (OOXML)

211.0 KB Created: 2021-06-21 18:15:04 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2021-07-02
MD5: 6901ee3cdccb4f65c18375d2a31d8a25 SHA-1: 7f4a075879070c09f2a23663f91c001663eda6da SHA-256: 694a0501f01eba6b106984a2dc2e4dd8eb99cfce626d664a650f698f33b1ece6
120 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution

The sample is an OOXML file containing a VBA project and an Excel 4.0 macro sheet. The critical heuristic firing indicates the presence of Excel 4.0 macros, which are often used to download and execute secondary payloads. The VBA code includes a `CreateObject` call, suggesting dynamic execution capabilities. The presence of the `xlm_sheet_00.bin` artifact is a key indicator of this attack vector.

Heuristics 3

  • Excel 4.0 macro sheet (1 sheet(s)) critical OOXML_XLM_MACROSHEET
    Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks. The macro sheet is stored as XLSB/BIFF12 binary content, which many XML-only OOXML scanners miss.
  • VBA project inside OOXML medium 1 related finding OOXML_VBA
    Document contains a VBA project — VBA macros present
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 669 bytes
SHA-256: 5a35b7af1740692597ff7577a866e752e43b76bdddb91767b95bf584021d1bff
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Module1"
Public Function YYImycMg(zNO0luNWe As String, hGFysGF As String) As String
    Set Vd1AUR2eW = CreateObject(hGFysGF)
    B2XkKkUph = Array(zNO0luNWe)
    With Vd1AUR2eW
    .Pattern = "j|q|U|v|M|O|X|z|D|H|Z|V|P|Q|Y|I|N|w|K|L"
    .Global = True
    End With
    YYImycMg = Vd1AUR2eW.Replace(B2XkKkUph(0), "")
End Function
vbaProject_00.bin vba-project OOXML VBA project: xl/vbaProject.bin 12288 bytes
SHA-256: 8d3e5efd0b358b232cb20e998aab82541dfddd256a691bc01cc92039a6600e94
xlm_sheet_00.bin xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet1.bin 2544 bytes
SHA-256: 33d2cd3c68e06adde39d2663ae4cb830bbc5f4aebebdba03ae577a0b6f86c69a
Preview script
First 1,000 lines of the extracted script
�  �  �   @      ��������    �                  �  %      ��                  & �  �             @   d           � $                                    �  �  %      ��    & �  ����  ,     �  <                   <     �?  $	        �  �  %      ��    &           ,                	Q                  7   #    $     �D     �D     � D     � D     � D     � B �                   %      ��    &           ,                	Q                  7   #    $     �D     �D     � D     � D     � D     � B �                                 %      ��    &           ,                	Q                  7   #    $     �D     �D     � D     � D     � D     � B �                   %      ��    &           ,                	Q                  7   #    $     �D     �D     � D     � D     � D     � B �                                 %      ��    &           ,                	Q                  7   #    $     �D     �D     � D     � D     � D     � B �                                 %      ��    &           ,                	Q                  7   #    $     �D     �D     � D     � D     � D     � B �                             	   %      ��    &           ,                	Q                  7   #    $     �D     �D     � D     � D     � D     � B �               
   %      ��    &           ,                	Q                  7   #    $     �D     �D     � D     � D     � D     � B �                                 %      ��    &           ,                	I                  /   D     �D     �D     �   B E A R O N      	 B �     %      ��    &   	       ,                	C                  )   #       $     �   c m d $     �      B �     %      ��    &   
       ,                	A                  '       AJ  @     0 0 : 0 0 : 0 4  @   B ��    %      ��    &           ,                	A                  '   #       $     �$     �$     �      B �     %      ��    &           ,                	?                  %       AJ  @     0 0 : 0 0 : 9  @   B ��    %      ��    &   
       ,                	C                  )   #       $     �   c m d $     �      B �     %      ��    &           ,                	                       B 6     �  � � ��                                                                  @   >���Y�� k	*A"�FV و�V ��N��ۛ��r��E~���v����s�.�\1�
�@ X�|�e�A     ;iF �ЦI  `�y%>    S H A - 5 1 2 � B                                                                  �  P�� 0ffffff�?ffffff�?      �?      �?333333�?333333�?� .    d   X   X                         r I d 2 %      ��                  & �

Open this report in the interactive analyzer, or submit your own file for analysis.