Office (OOXML) / .XLSX malware analysis — malicious · 7d9a935c89e868e9

MALICIOUS

Office (OOXML) / .XLSX

44.9 KB Created: 2020-02-01 18:28:07 UTC Authoring application: Microsoft Excel 12.0000

MD5: 45c30c5b9dafa358013da65f7832255a SHA-1: 7b036034d4a12321b598d999d2d31e60d3ecf49f SHA-256: 7d9a935c89e868e9e8c03c0059fdb25e3f2a6f7f3cb8c68bb22c18ba27bf21c1

506 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1204.002 Malicious File

The sample is an Excel document containing a VBA macro with an Auto_Open subroutine. This macro utilizes WScript.Shell to execute a command that downloads a second-stage executable from the URL http://185.244.39.251/xDPDG2YT4cH4hA6.exe. The macro also employs obfuscation techniques, including string splitting and base64 encoding, to conceal its malicious intent.

Heuristics 14

Equation Editor OLE object high CVE related OLE_EQUATION_EDITOR

Embedded OLE object xl/embeddings/oleObject3.bin contains the Equation Editor CLSID, the legacy component exploited by CVE-2017-11882, CVE-2018-0802, and CVE-2018-0798.
Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA
WScript.Shell usage critical OLE_VBA_WSCRIPT

WScript.Shell usage
VBA Base64-decoded Shell command stager critical OLE_VBA_BASE64_SHELL_COMMAND_STAGER

VBA auto-exec macro decodes Base64 string literals into command or script-launch text and executes the result with Shell. This catches cmd/cscript/PowerShell/VBS launchers hidden from plain keyword matching.
Dangerous API name reassembled from split string literals critical OLE_VBA_SPLIT_KEYWORD_OBFUSCATION

VBA concatenates short string literals that reassemble a dangerous API/ProgID/LOLBin name (e.g. Scripting.FileSystemObject, WScript.Shell, powershell, URLDownloadToFile) which appears in no single literal. Splitting an API name across string concatenation is done only to evade keyword scanning.
Embedded Office object carries macros critical OFFICE_EMBEDDED_MACRO_OBJECT

This document embeds a second Office file that itself contains a VBA macro project or an Excel 4.0 (XLM) macro sheet. Hiding a macro-bearing workbook or document inside another document — frequently under an obfuscated, non-standard part name — is a macro-smuggling technique that defeats scanners which only inspect the outer document's macro storage. No benign authoring workflow stages a hidden macro project this way.
Auto_Open macro high OLE_VBA_AUTO

Auto_Open macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
VBA project inside OOXML medium OOXML_VBA

Document contains a VBA project — VBA macros present
Embedded OLE object medium OOXML_OLE_OBJECT

Document contains an embedded OLE object
Payload URL recovered from embedded OLE object (1 URL) info OOXML_EMBEDDED_OBJECT_URL

An embedded OLE object (xl/word/ppt embeddings) carries a next-stage download URL in its Ole10Native/Package stream — stored literally (incl. UTF-16) or base64-encoded — which the package-level URL sweep does not see. Surfaced as an IOC; self-validating (only real payload hosts).
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://185.244.39.251/xDPDG2YT4cH4hA6.exe

Extracted artifacts 9

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `ea99f366ae54cf75321b0934f019ab53495d58c8f1034b38d86d84377fc8e95f`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	20783 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 long base64-like blob(s).
`ooxml_oleobject_00.bin` `d929f2e2068be842b0e472c19a97767602b62ad6a3068165784369516df7fbc9`	ooxml-ole-object	OOXML embedded OLE part: xl/embeddings/oleObject1.bin	3584 bytes
`ooxml_oleobject_00_ole10native_00.bin` `d81ab8f37617b70cef788a949471ba956979b76c88c3817ceee0f1d8ebf87516`	ole-package	OOXML xl/embeddings/oleObject1.bin Ole10Native stream: Ole10Native	978 bytes
`ooxml_oleobject_01.bin` `c3c9f81a73d977e07d7ac7a860ff7b2bb8905c77693b718c35f671fb909c8f5d`	ooxml-ole-object	OOXML embedded OLE part: xl/embeddings/oleObject3.bin	5936 bytes
`ooxml_oleobject_02.bin` `2a4f3f4013053fa023076f020ef8d65ab4540e8b951d5f6ff331e45b60d51a7c`	ooxml-ole-object	OOXML embedded OLE part: xl/embeddings/oleObject2.bin	12288 bytes
`ooxml_oleobject_02_ole10native_00.bin` `7bedc708138f624a2771339ed3f4193b4fbbd76a7cb09ab85355ec11e3948b6f`	ole-package	OOXML xl/embeddings/oleObject2.bin Ole10Native stream: Ole10Native	9239 bytes
`ooxml_oleobject_03.bin` `1b0184726b987a03f6bd2aee679603d3cca0d21dcf2eafe8d10070df3c47a213`	ooxml-ole-object	OOXML embedded OLE part: xl/vbaProject.bin	39936 bytes
`emf_00.emf` `979dde2aed02f077c16ae53546c6df9eed40e8386d6db6fc36aee9f966d2cb82`	ooxml-emf	OOXML EMF part: xl/media/image1.emf	4968 bytes
`emf_01.emf` `4d4d1e7b04c99dcb8e885915068ad6f74cc2333e91580cdae5ccaa00c427247f`	ooxml-emf	OOXML EMF part: xl/media/image2.emf	1536 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.