Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 84979debf46b4d78…

MALICIOUS

Office (OOXML)

12.3 KB
MD5: 0fc90a67918411a041d39c0f30c99956 SHA-1: b84b9f8ee9d5c642f059014e99b3cc94f4182966 SHA-256: 84979debf46b4d789598666be8445b63187e62d77df08a48bf613fd948fef83a
180 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution

The sample contains VBA macros, specifically an Auto_Open macro that utilizes GetObject to execute code. The script constructs a URL by concatenating strings: "a http://" + "bitly.com/asdkjasdhsudiqowiudqw". This URL is then passed to the ExEc method of an object obtained via GetObject, indicating a likely download and execution of a second-stage payload. The renaming of the VBA project part and the use of Auto_Open are common evasion and execution techniques.

Heuristics 5

  • VBA project part renamed to evade filename detection high OOXML_VBA_PROJECT_RENAMED
    The VBA project is bound through the OOXML relationship/content type but its part is not named vbaProject.bin. Legitimate Office producers always emit vbaProject.bin; renaming it hides the macros from path-only scanners (observed in the SVCReady loader).
  • Auto_Open macro high OLE_VBA_AUTO
    Auto_Open macro
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • VBA project inside OOXML medium OOXML_VBA
    Document contains a VBA project — VBA macros present (project part renamed away from vbaProject.bin: ppt/Javar.b)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
1350c9bd2cf26ab077eed7942144475e7eb0da643708be5a2a67398e10a642d0		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 2085 bytes
vbaProject_00.bin
f2e89a95e779892d446557904d4fa0e93869662e26d6dcfd1c1baf9db333edc5		 vba-project OOXML VBA project: ppt/Javar.b 30720 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.