Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 9020efba60e50caa…

MALICIOUS

Office (OOXML)

217.9 KB Created: 2021-06-16 16:52:30 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2021-06-28
MD5: 0d262cde0dbf3c580b94a67edb580721 SHA-1: 3b85610a391050254a60f6ad9d3a78df00e310b1 SHA-256: 9020efba60e50caafe151e264bf90e22dda2121b0e13c62237f54b4a8456485d
120 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution

The file is an OOXML document containing both VBA macros and Excel 4.0 macros. The critical heuristic firing indicates the presence of Excel 4.0 macros, which are known for their ability to execute arbitrary commands. The extracted XLM macro sheet contains references to 'cmd', suggesting an attempt to launch the command interpreter, likely for downloading and executing a secondary payload. The VBA macro appears to be a deobfuscation routine, further supporting the idea that the primary malicious functionality resides in the XLM macros.

Heuristics 3

  • Excel 4.0 macro sheet (1 sheet(s)) critical OOXML_XLM_MACROSHEET
    Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks. The macro sheet is stored as XLSB/BIFF12 binary content, which many XML-only OOXML scanners miss.
  • VBA project inside OOXML medium 1 related finding OOXML_VBA
    Document contains a VBA project — VBA macros present
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 662 bytes
SHA-256: adcc0235262807e9ff16ed56bd3d702468fe9f525a71f16f5e002a99168bd8be
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Module1"
Public Function G7tBpd1ix5(coNTlS As String) As String
    Set qQ8Zthw = CreateObject("VBScript.RegExp")
    N1f64lVDY = Array(coNTlS)
    With qQ8Zthw
    .Pattern = "X|H|U|v|q|4|K|j|Q|Y|Z|B|F|N|O|M|V|P|T|D|L|G|I|w"
    .Global = True
    End With
    G7tBpd1ix5 = qQ8Zthw.Replace(N1f64lVDY(0), "")
End Function
vbaProject_00.bin vba-project OOXML VBA project: xl/vbaProject.bin 12288 bytes
SHA-256: 186d4e1032eeb0ea061f8823b3a3be41c25ef5dadab659bc39acb9d936674acc
xlm_sheet_00.bin xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet1.bin 2212 bytes
SHA-256: ccefc556e1c9a8b9cd092d7d3ec86e8b4d3fc69bb7e92d949cb13eaac4760c98
Preview script
First 1,000 lines of the extracted script
�  �  �   @      ��������    �                  �  %      ��                  & �  �             @   d           � $                                    �  �  %      ��    & �  ����  ,     �  <                   �  �  %      ��    &           ,                	*                      #
   $     �B �                   %      ��    &           ,                	*                      #
   $     �B �                   %      ��    &           ,                	*                      #
   $     �B �                   %      ��    &           ,                	*                      #
   $     �B �                   %      ��    &           ,                	*                      #
   $     �B �                   %      ��    &           ,                	*                      #
   $     �B �                   %      ��    &           ,                	*                      #
   $     �B �                   %      ��    &           ,                	*                      #
   $     �B �                   %      ��    &           ,                	I                  /   D     �D     �D     �   B A D A B U      	 B �               %      ��    &   	       ,                	C                  )   #       $     �   c m d $     �      B �               %      ��    &   
       ,                	A                  '       AJ  @     0 0 : 0 0 : 0 4  @   B ��              %      ��    &           ,                	A                  '   #       $     �$     �$     �      B �               %      ��    &           ,                	?                  %       AJ  @     0 0 : 0 0 : 9  @   B ��              %      ��    &   
       ,                	C                  )   #       $     �   c m d $     �      B �               %      ��    &           ,                	                       B 6               �  � � ��                                                                  @   $v �A/�ġJ���a�t
r~�]�Ϯf"` 1�2���Lp�=� ��� ��d ��V�#���n���t    w"�� �" l��>8�P�    S H A - 5 1 2 � B                                                                  �   ,� 0ffffff�?ffffff�?      �?      �?333333�?333333�?� .    d   X   X                         r I d 2 %      ��                  & �

Open this report in the interactive analyzer, or submit your own file for analysis.