Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 aa1d34c5db49e799…

MALICIOUS

Office (OOXML)

66.6 KB Created: 2012-10-19 22:33:57 UTC Authoring application: Microsoft Excel 12.0000
MD5: 8c4a90031fb744821fb74f028bd767cf SHA-1: 22f1479768969365903ca532dc2933e5ac97b6e3 SHA-256: aa1d34c5db49e799f8261fd7fc0eb72040dfbb52e8a0ffcf68172ffa17001c4d
208 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder

The sample contains a Workbook_Open VBA macro that is triggered automatically when the Excel file is opened. This macro uses CreateObject to interact with the Windows Task Scheduler, likely to establish persistence. It also attempts to write a file named 'qLabelOnly.xsl' to the ALLUSERSPROFILE directory, potentially as part of a payload delivery or configuration. The use of 'powershell.exe' suggests a second-stage download or execution.

Heuristics 6

  • LOLBin reference in VBA critical OLE_VBA_LOLBIN
    LOLBin reference in VBA
  • Workbook_Open macro high OLE_VBA_WBOPEN
    Workbook_Open macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • VBA project inside OOXML medium OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
0160074631c54636b6724510271f9066ef5a934e191dd58ab2bcdfc9a098e57a		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 3654 bytes
vbaProject_00.bin
5237a82f78be7087292a396794d41308620d0a90761a76902f10bd304e1bb46a		 vba-project OOXML VBA project: xl/vbaProject.bin 16896 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.