Malicious Office (OOXML) / .OLE — malware analysis report

Static analysis result for SHA-256 814aedf8fadc6714…

MALICIOUS

Office (OOXML) / .OLE

39.5 KB Created: 2020-10-14 10:42:05 UTC Authoring application: Microsoft Excel 16.0300
MD5: 828171da9def2a19fb953c3248316bfb SHA-1: fdcb41557c24c554597c4599d7057dfa6ac64833 SHA-256: 814aedf8fadc6714e6ae011964b4a481357a316a0e2de60a61dbfb9d7c53e286
80 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.005 Visual Basic T1204.002 Malicious File

The critical heuristic OLE_VBA_ACTIVEX_XLM_STAGER indicates that VBA code is used to launch decoded Excel4 macros. The VBA script confirms this by using ExecuteExcel4Macro and reconstructing a long string of URLs from concatenated parts. This script's primary function is to download and execute a second-stage payload from these URLs, which are heavily obfuscated. The presence of VBA macros and the execution of Excel4 macros strongly suggest a malicious document designed for payload delivery.

Heuristics 2

  • VBA ActiveX event launches decoded Excel4 macro critical OLE_VBA_ACTIVEX_XLM_STAGER
    The compiled VBA p-code (identifier table) references an auto-firing ActiveX/control event together with ExecuteExcel4Macro, while the decompressed source does not — the VBA-stomping shape of the ActiveX-event XLM stager. The control event bridges into XLM formula execution to call Win32 / drop payloads, hidden from source-level scanners.
  • VBA project inside OOXML medium OOXML_VBA
    Document contains vbaProject.bin — VBA macros present

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
12e86fddf2a1edca3ad5f266b52f61d8a6c56429cfec9635afa2d960c9bc51e1		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 1993 bytes
vbaProject_00.bin
1089a027ddf564a393931dd1a99db16464ff6d9dc9bfac9c35e9dacc9dc977b0		 vba-project OOXML VBA project: xl/vbaProject.bin 19968 bytes
emf_00.emf
7c32f7250ee26daa27b06827254086eb00d6782410f5e837cf52840e64f8476f		 ooxml-emf OOXML EMF part: xl/media/image1.emf 1272 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.