Malicious Office (OOXML) / .XLSM — malware analysis report

Static analysis result for SHA-256 a8781061c7281f24…

MALICIOUS

Office (OOXML) / .XLSM

102.9 KB Created: 2021-08-19 14:03:52 UTC Authoring application: Microsoft Excel 15.0300
MD5: dbb5fbb924a4f868c2f8b722e0b4240e SHA-1: b026c5f6073f2a3c9dfaa222541fa97e80f5d49c SHA-256: a8781061c7281f24a99e6f47aa84f0b91ac92ed89b4cd8af3db1044f0a01f09f
80 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1059.005 Visual Basic

The VBA macros contain obfuscated PowerShell commands. The script decodes a Base64 string which, when decoded, reveals a URL to download an executable file and then executes it. The reconstructed URL is "http://18.192.215.191/teama/z/GPF_10036512_007.exe". The PowerShell command also specifies the path to the PowerShell executable as 'C:\Windows\System\WindowsPowerShell\v1.0\powershell.exe'.

Heuristics 2

  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • VBA project inside OOXML medium OOXML_VBA
    Document contains vbaProject.bin — VBA macros present

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
c5889b577bd85106c4b97c403e6452112daf12c61be460d23521113e6222b3f8		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 2481 bytes
vbaProject_00.bin
4bd9a57886f3d71db14793be8d48b881a046fa418cd44d9f81e24946d6890633		 vba-project OOXML VBA project: xl/vbaProject.bin 6144 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.