Malicious Office (OOXML) / .OLE — malware analysis report

Static analysis result for SHA-256 88b2bb4d5426b3d6…

MALICIOUS

Office (OOXML) / .OLE

57.3 KB Created: 2020-12-14 14:50:54 UTC Authoring application: 16.0300
MD5: 736c49626b1f0738edbcc392eb4f837d SHA-1: fa8740fd635de45b3c14040dd929bfe0fd0a27e6 SHA-256: 88b2bb4d5426b3d60dc02ab3c1732108a426d366fa3f4e5d51b2445fd1afa19d
210 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.001 PowerShell T1204.002 Malicious File T1059.005 Visual Basic

This OOXML document contains Excel 4.0 macro sheets with an Auto_Open defined name, indicating it's designed to execute macros upon opening. The presence of the 'RETURN()' function in the macro sheet is a critical indicator of potentially dangerous API calls used to download and execute payloads. The VBA script, though partially truncated, contains functions that appear to be involved in string manipulation and execution, further supporting the payload delivery mechanism. The document body's numerical content is likely obfuscated data or instructions for the macro.

Heuristics 6

  • Excel 4.0 macro sheet (2 sheet(s)) critical OOXML_XLM_MACROSHEET
    Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks.
  • Excel 4.0 Auto_Open defined name critical OOXML_XLM_AUTOOPEN_DEFINEDNAME
    Workbook defines _xlnm.Auto_Open or _xlnm.Auto_Close while containing an XLM macro sheet. This is the OOXML/XLSB auto-execution shape for Excel 4.0 macros.
  • Dangerous XLM formula APIs: RETURN critical OOXML_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet uses formula APIs that call directly into Win32 (=CALL/=EXEC/=REGISTER/=FORMULA). These are the primitives used to download payloads, write files, and start processes from an XLM macro without invoking VBA.
  • VBA project inside OOXML medium OOXML_VBA
    Document contains vbaProject.bin — VBA macros present
  • Hidden worksheet (hidden) low OOXML_HIDDEN_SHEET
    Excel workbook contains 2 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/spreadsheetml/2006/main
    • http://schemas.microsoft.com/office/excel/2006/main
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships
    • http://schemas.openxmlformats.org/markup-compatibility/2006
    • http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
366f3948ab7ad68957f21aa2ffe098d51515dc1bd981a5f43799dd7aaed82c33		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 1854 bytes
vbaProject_00.bin
511a2ccd8eadf0bf910d83dff18db2e5ca284724632cd9bbe8aeb368985bb097		 vba-project OOXML VBA project: xl/vbaProject.bin 18944 bytes
xlm_sheet_00.xml
789305718a70863a73138310df1769b5844bf86b68121eb1347a2663d6504e94		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet1.xml 1154 bytes
xlm_sheet_01.xml
73585fcc5f80ef02533a95fd35a9fac4f36cdcc04b1ad567fd1ebca00933fa98		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet2.xml 988 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.