Malicious Office (OOXML) / .XLSM — malware analysis report

Static analysis result for SHA-256 a4246fd6e1dcf001…

MALICIOUS

Office (OOXML) / .XLSM

31.7 KB Created: 2020-10-06 08:00:16 UTC Authoring application: 16.0300
MD5: afe503e43cb3c6f7818d2947a4fc9532 SHA-1: f670d0cf4befac3de7df8c3295cbcbd3e84e75c1 SHA-256: a4246fd6e1dcf001b5cc093447accb8d6ed1f411d3616607ddf91d87bf43f664
80 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.001 PowerShell T1204.002 Malicious File

The critical heuristic OLE_VBA_ACTIVEX_XLM_STAGER indicates that a VBA ActiveX event is used to launch a decoded Excel4 macro. The extracted VBA script confirms this by using the ExecuteExcel4Macro function to run commands. The script appears to decode a string and then execute it, likely to download and run a second-stage payload. The document body is heavily obfuscated and does not provide clear user-facing text, but the script's behavior is indicative of a malicious downloader.

Heuristics 2

  • VBA ActiveX event launches decoded Excel4 macro critical OLE_VBA_ACTIVEX_XLM_STAGER
    The compiled VBA p-code (identifier table) references an auto-firing ActiveX/control event together with ExecuteExcel4Macro, while the decompressed source does not — the VBA-stomping shape of the ActiveX-event XLM stager. The control event bridges into XLM formula execution to call Win32 / drop payloads, hidden from source-level scanners.
  • VBA project inside OOXML medium OOXML_VBA
    Document contains vbaProject.bin — VBA macros present

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
0ab6c9b641d579dee4a5d0b5210c2a6f66e1b295e83e6c7b9c294e3f4c29d035		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 1237 bytes
vbaProject_00.bin
27eddc18b0127668804801cc860c3c5c189d7b5544074e3d0bd3812af7c7bcbc		 vba-project OOXML VBA project: xl/vbaProject.bin 11776 bytes
emf_00.emf
4609916d8bdbc79e29612828ccd046cae14d7ddc0bfea0db84520ad5f180a00d		 ooxml-emf OOXML EMF part: xl/media/image1.emf 1408 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.