Malicious Office (OOXML) / .XLSM — malware analysis report

Static analysis result for SHA-256 7db855d25c3468c8…

MALICIOUS

Office (OOXML) / .XLSM

26.9 KB Created: 2020-11-02 13:04:55 UTC Authoring application: Microsoft Excel 16.0300
MD5: 498adcc5b1c0e59baa8779fb8a1b72df SHA-1: e5c0063a99e22394ce84104ea5d775e48dbd70a4 SHA-256: 7db855d25c3468c8b0cc6ed349e16f8611a875aa0c8b95b98c4c1845fc503c7b
80 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic for Applications T1059.005 Visual Basic for Applications

The critical heuristic 'OLE_VBA_ACTIVEX_XLM_STAGER' indicates that an ActiveX event triggers the execution of a decoded Excel4 macro. The VBA script contains obfuscated code and uses `ExecuteExcel4Macro` to run these macros, which is a common technique for downloading and executing further malicious content. The document body appears to be heavily obfuscated or encoded data, further supporting the malicious intent.

Heuristics 2

  • VBA ActiveX event launches decoded Excel4 macro critical OLE_VBA_ACTIVEX_XLM_STAGER
    The compiled VBA p-code (identifier table) references an auto-firing ActiveX/control event together with ExecuteExcel4Macro, while the decompressed source does not — the VBA-stomping shape of the ActiveX-event XLM stager. The control event bridges into XLM formula execution to call Win32 / drop payloads, hidden from source-level scanners.
  • VBA project inside OOXML medium OOXML_VBA
    Document contains vbaProject.bin — VBA macros present

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
dbefb76d6dc68dcae6dda31b8decb8f5fac099e2fd42385c924b2efebfa5ffa4		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 2018 bytes
vbaProject_00.bin
90528cef27b75e19226f3a595b64d8a1eab7a5b525161f68a1380c290dc114b8		 vba-project OOXML VBA project: xl/vbaProject.bin 18944 bytes
emf_00.emf
960d8f6a0ef7f38f5c569c3d2e00961ea7a8f5d4cc5cc67713db323575eb176b		 ooxml-emf OOXML EMF part: xl/media/image1.emf 9596 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.