Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 7ab17308021d418f…

MALICIOUS

Office (OOXML)

41.6 KB Created: 2021-06-22 12:43:05 UTC Authoring application: Microsoft Excel 16.0300
MD5: 939702300a5ffc90f4a58d742904f6f3 SHA-1: fe93984885287e8aafc15341516b925fc49e86c9 SHA-256: 7ab17308021d418f3c77987890e9c8ea45867889f45bb27381686b0838bf6520
160 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.001 PowerShell T1204.002 Malicious File

The Excel document contains VBA macros that reference PowerShell and cmd.exe, indicating an attempt to execute arbitrary commands. The GetObject call further suggests the potential for loading and executing external code. While the specific payload is not directly visible, the presence of these indicators strongly suggests a downloader or dropper functionality.

Heuristics 4

  • PowerShell reference in VBA critical OLE_VBA_PS
    PowerShell reference in VBA
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
  • cmd.exe reference in VBA high OLE_VBA_CMD
    cmd.exe reference in VBA
  • VBA project inside OOXML medium OOXML_VBA
    Document contains a VBA project — VBA macros present

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
b39a78d5798ccae2e0f9b73db8e3a775ade0103f24ce0d1c7fc3709933f861f0		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 35036 bytes
vbaProject_00.bin
0f435cb6cb993c2178c5ff37e287c83a27803e0cca901605129ef9e2d1bf66a7		 vba-project OOXML VBA project: xl/vbaProject.bin 11264 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.