Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 ac7d8dcf5ec3825a…

MALICIOUS

Office (OOXML)

69.6 KB Created: 2021-07-28 13:23:45 UTC Authoring application: Microsoft Excel 16.0300
MD5: 3678ef932b124680d831c2e957255c6d SHA-1: ad16dd3da5680a48a9d5cdb6e478deb5ea002290 SHA-256: ac7d8dcf5ec3825a54d0fa33633fa7d52f8163376ef2c1218ab850f9bec06f2c
250 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1105 Ingress Tool Transfer T1204.002 Malicious File

The sample is an Excel document containing VBA macros. Critical heuristics indicate the use of Shell(), WScript.Shell, and URLDownloadToFile, suggesting the macro attempts to download and execute a second-stage payload. The URL used for the download is present in the extracted evidence. The document body content is minimal and does not provide further context on the lure.

Heuristics 7

  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
  • URLDownloadToFile in VBA critical OLE_VBA_DOWNLOAD
    URLDownloadToFile in VBA
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA project inside OOXML medium OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://github.com/florentbr/SeleniumBasic/releases/download/v2.0.9.0/SeleniumBasic-2.0.9.0.*
    • https://developer.microsoft.com/en-us/microsoft-edge/tools/webdriver/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
4049ac68269a94607aa593d77d177c50767c4bc231a773394f4667d729febbed		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 14055 bytes
vbaProject_00.bin
83a3411a270c6884416783bbc991381e23d53a971af4f37f63aa2d0f4b3a805d		 vba-project OOXML VBA project: xl/vbaProject.bin 67072 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.