Malicious Office (OOXML) / .XLSM — malware analysis report

Static analysis result for SHA-256 9bea5cd43e299b1d…

MALICIOUS

Office (OOXML) / .XLSM

44.1 KB Created: 2020-10-07 12:55:01 UTC Authoring application: Microsoft Excel 16.0300
MD5: 995ea99e623d48d8c0ef5e7406897d44 SHA-1: ae2e5d529db8ae536d33a8f4f6c8ec89a4733a9a SHA-256: 9bea5cd43e299b1dcf722ab63d3162d0efaa6acd561260c9f5323dbc9ce71383
80 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.001 PowerShell T1204.002 Malicious File

The critical heuristic 'OLE_VBA_ACTIVEX_XLM_STAGER' indicates that VBA ActiveX events are used to launch decoded Excel4 macros. The extracted document body contains a long list of URLs, likely serving as download locations for malicious payloads. The VBA script 'macros.bas' contains functions for decoding strings and executing them via 'ExecuteExcel4Macro', confirming the payload delivery mechanism. The script's intent is to download and execute a second-stage payload from one of the embedded URLs.

Heuristics 2

  • VBA ActiveX event launches decoded Excel4 macro critical OLE_VBA_ACTIVEX_XLM_STAGER
    The compiled VBA p-code (identifier table) references an auto-firing ActiveX/control event together with ExecuteExcel4Macro, while the decompressed source does not — the VBA-stomping shape of the ActiveX-event XLM stager. The control event bridges into XLM formula execution to call Win32 / drop payloads, hidden from source-level scanners.
  • VBA project inside OOXML medium OOXML_VBA
    Document contains vbaProject.bin — VBA macros present

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
89aff21a791ab943f2e8fe7909c495dbb0a996de64defc98158f975912dc3928		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 5266 bytes
vbaProject_00.bin
da07bf6f0c0f8825e96362ef4bb28ba9e5305f4e5dc20d20c681880aa6adad4d		 vba-project OOXML VBA project: xl/vbaProject.bin 28672 bytes
emf_00.emf
3d5aa7bbe1d62b02ae4c4629b85b8a5ddf6ff78d32f989cad037257bcb197476		 ooxml-emf OOXML EMF part: xl/media/image1.emf 2352 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.