Malicious Office (OOXML) / .XLSM — malware analysis report

Static analysis result for SHA-256 7d422c51b1190863…

MALICIOUS

Office (OOXML) / .XLSM

28.7 KB Created: 2020-11-02 14:11:32 UTC Authoring application: Microsoft Excel 16.0300
MD5: 395de1556afb031345f37f7cd4443766 SHA-1: 13d4d9941124254a2bd8dfb512b00bf97b03a0dc SHA-256: 7d422c51b1190863d910cc11de77aa744743c5c44238e20c7bdbb56254cb31dc
80 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution

The critical heuristic 'VBA ActiveX event launches decoded Excel4 macro' indicates that the document contains VBA code designed to execute Excel 4.0 macros. The VBA script 'nimos' uses 'ExecuteExcel4Macro' to run obfuscated commands, which is a common technique for downloading and executing further stages of malware. The presence of VBA macros and the use of Excel 4.0 macros strongly suggest a macro-based malware delivery.

Heuristics 2

  • VBA ActiveX event launches decoded Excel4 macro critical OLE_VBA_ACTIVEX_XLM_STAGER
    The compiled VBA p-code (identifier table) references an auto-firing ActiveX/control event together with ExecuteExcel4Macro, while the decompressed source does not — the VBA-stomping shape of the ActiveX-event XLM stager. The control event bridges into XLM formula execution to call Win32 / drop payloads, hidden from source-level scanners.
  • VBA project inside OOXML medium OOXML_VBA
    Document contains a VBA project — VBA macros present

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
46a401d6f0003218d53f67dfd4c8cab9c4af377bf478f2306183c7aa79db4b4e		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 2053 bytes
vbaProject_00.bin
b723f4802ce5d51785cbef4e0db4cdd246b3d2411a9449d2a4b23699c7d867e8		 vba-project OOXML VBA project: xl/vbaProject.bin 18944 bytes
emf_00.emf
53a88b00b3c0368a97f07e5705cf02259ed019efd03221a3f484b750c1f9742f		 ooxml-emf OOXML EMF part: xl/media/image1.emf 1408 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.