Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 8e6e7e1c6cd12f75…

MALICIOUS

Office (OOXML)

41.6 KB Created: 2021-06-22 12:43:05 UTC Authoring application: Microsoft Excel 16.0300
MD5: a99de50df7469862583c1b994cbb35ee SHA-1: 1534e31eb7a9dda75d4574764f88961fa03974e1 SHA-256: 8e6e7e1c6cd12f7557e1c6c4447a4006c3f2e22e8e439178fb36425cce3bb46f
160 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.001 PowerShell T1059.003 Windows Command Shell T1204.002 Malicious File

The file is an OOXML document containing VBA macros. Heuristics indicate the VBA code references PowerShell and cmd.exe, and uses GetObject. The VBA macro itself appears to be obfuscated and includes a Base64 decoding function, suggesting it's designed to hide malicious code. The primary function of the script is likely to download and execute a secondary payload, leveraging the PowerShell and cmd.exe references.

Heuristics 4

  • PowerShell reference in VBA critical OLE_VBA_PS
    PowerShell reference in VBA
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
  • cmd.exe reference in VBA high OLE_VBA_CMD
    cmd.exe reference in VBA
  • VBA project inside OOXML medium OOXML_VBA
    Document contains a VBA project — VBA macros present

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
062f7e5e8f24aeb67ce3eb620998d92cb2502b8fca0d2fbb2723e3a7abb50954		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 35036 bytes
vbaProject_00.bin
5232e1134627127ec04859dbd738bfce56856bdc63406e98473946aa0d89aae1		 vba-project OOXML VBA project: xl/vbaProject.bin 11264 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.