Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 878b09367ea85c47…

MALICIOUS

Office (OOXML)

41.5 KB Created: 2021-06-22 12:43:05 UTC Authoring application: Microsoft Excel 16.0300
MD5: 62fabf631be68f826e8bc94aefa87935 SHA-1: 621dff2aa5d3036b08316d692609af71770a6699 SHA-256: 878b09367ea85c47a37850aa3518de2a496b7624d1643dc9d9d6d06b5ee08707
160 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.001 PowerShell T1059.003 Windows Command Shell T1204.002 Malicious File

The file is an Office document containing VBA macros. Heuristics indicate the VBA code references PowerShell and cmd.exe, and uses GetObject. The VBA code itself is heavily obfuscated, but its structure suggests it is designed to execute commands. This is consistent with a macro-based downloader that executes a second-stage payload.

Heuristics 4

  • PowerShell reference in VBA critical OLE_VBA_PS
    PowerShell reference in VBA
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
  • cmd.exe reference in VBA high OLE_VBA_CMD
    cmd.exe reference in VBA
  • VBA project inside OOXML medium OOXML_VBA
    Document contains a VBA project — VBA macros present

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
e0d366edb785440beeaab17b92087b6cd27e1fd4d12804a8fd1d6094a170ebba		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 34430 bytes
vbaProject_00.bin
226f40b71e5140c421d60c6e1a158a5459be036633aedc7380497d03469a170c		 vba-project OOXML VBA project: xl/vbaProject.bin 11264 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.