Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 9ca24714deef05f6…

MALICIOUS

Office (OOXML)

41.5 KB Created: 2021-06-22 12:43:05 UTC Authoring application: Microsoft Excel 16.0300
MD5: 0cbc0430f09941b117079242c8c756ba SHA-1: e6fe5c1191f4a374438a6a059747645958520838 SHA-256: 9ca24714deef05f67bdaeaf231a46f3407780869c1c6876a42a127fec790cd30
160 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.001 PowerShell T1059.003 Windows Command Shell T1204.002 Malicious File

The OOXML document contains VBA macros that reference cmd.exe and PowerShell. The GetObject call and the presence of a VBA project strongly suggest that the macros are designed to execute arbitrary code. The primary function of the VBA code appears to be the execution of external commands, likely for downloading and running a secondary payload.

Heuristics 4

  • PowerShell reference in VBA critical OLE_VBA_PS
    PowerShell reference in VBA
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
  • cmd.exe reference in VBA high OLE_VBA_CMD
    cmd.exe reference in VBA
  • VBA project inside OOXML medium OOXML_VBA
    Document contains a VBA project — VBA macros present

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
33d0da87e0fcc700d84c59deb203c51dd86538b5ff042e3f4d2a8d6a9bf2f084		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 34430 bytes
vbaProject_00.bin
8a0f28eaf3fc29eaee14560ba64c157d78f7bd2ca5864ce5ec67045f65c72f72		 vba-project OOXML VBA project: xl/vbaProject.bin 11264 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.