Office (OOXML) malware analysis — malicious · 6a1bca75db899aef

MALICIOUS

Office (OOXML)

77.4 KB Created: 2021-07-13 12:00:46 UTC Authoring application: Microsoft Excel 16.0300

MD5: b794bc13557a89d0557bb4df61f54031 SHA-1: f5eda8703804448f177cf02cedeb92e48b515c0f SHA-256: 6a1bca75db899aef36bff2aca929a8e54ad99ad020ea4b284802299b167001c4

162 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1059.001 PowerShell T1059.003 Windows Command Shell T1566.001 Spearphishing Attachment

The OOXML document contains a Workbook_Open macro that references both PowerShell and cmd.exe. The embedded VBA script is a known 'RunPE' implementation, which is designed to execute arbitrary code. This suggests the macro is intended to download and execute a second-stage payload, likely leveraging the provided GitHub links for further instructions or tools.

Heuristics 5

PowerShell reference in VBA critical OLE_VBA_PS

PowerShell reference in VBA
Workbook_Open macro high OLE_VBA_WBOPEN

Workbook_Open macro
cmd.exe reference in VBA high OLE_VBA_CMD

cmd.exe reference in VBA
VBA project inside OOXML medium OOXML_VBA

Document contains a VBA project — VBA macros present
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://github.com/itm4n/VBA-RunPE
- https://github.com/hasherezade/
- https://www.nirsoft.net/kernel_struct/vista/IMAGE_DOS_HEADER.html
- https://msdn.microsoft.com/fr-fr/library/windows/desktop/ms680305(v=vs.85).aspx
- https://msdn.microsoft.com/fr-fr/library/windows/desktop/ms680313(v=vs.85).aspx
- https://msdn.microsoft.com/en-us/library/windows/desktop/ms680339(v=vs.85).aspx
- https://msdn.microsoft.com/fr-fr/library/windows/desktop/ms680336(v=vs.85).aspx
- https://www.nirsoft.net/kernel_struct/vista/IMAGE_SECTION_HEADER.html
- https://msdn.microsoft.com/fr-fr/library/windows/desktop/ms684873(v=vs.85).aspx
- https://msdn.microsoft.com/en-us/library/windows/desktop/ms686331(v=vs.85).aspx
- https://www.nirsoft.net/kernel_struct/vista/FLOATING_SAVE_AREA.html
- https://msdn.microsoft.com/en-us/library/windows/desktop/ms679284(v=vs.85).aspx
- https://www.nirsoft.net/kernel_struct/vista/IMAGE_DOS_HEADER.html�

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `e496e6c986c647c1b0a499a2902f3d6776f78273e3a911b7252c04672aff3174`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	53681 bytes
`vbaProject_00.bin` `32c31800cefd191f763d985d59c9d997d759d6683db819a4510318930f411438`	vba-project	OOXML VBA project: xl/vbaProject.bin	128512 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.