Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 b32d1c56704b32c2…

MALICIOUS

Office (OOXML)

66.8 KB Created: 2012-10-19 22:33:57 UTC Authoring application: Microsoft Excel 12.0000
MD5: 1c9a6037204ad21977d3ea346e2f1cb4 SHA-1: dd17373f266c7ba2f8b10993027040863cd130bb SHA-256: b32d1c56704b32c2a14635c301b0b5a404820d310b7bf2bb4de507b28b77ccf5
208 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1059 Command and Scripting Interpreter

The file contains a Workbook_Open VBA macro that is triggered automatically when the document is opened. This macro uses CreateObject to interact with the file system and schedule services, and attempts to write a file to the user profile directory. The script also appears to be attempting to download and execute a second-stage payload, indicated by the use of CreateObject("Schedule.Service") and the subsequent task creation, though the full URL is truncated. The presence of a Workbook_Open macro and CreateObject calls are strong indicators of malicious intent.

Heuristics 6

  • LOLBin reference in VBA critical OLE_VBA_LOLBIN
    LOLBin reference in VBA
  • Workbook_Open macro high OLE_VBA_WBOPEN
    Workbook_Open macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • VBA project inside OOXML medium OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
3626db1b4fda8b9b1c7ed24008362774924284cb9dde944473709a9f57cfdcba		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 3581 bytes
vbaProject_00.bin
a1e02027a6e6076cf20a875c5a0e34b94af3b43151805e9e294af130b28db782		 vba-project OOXML VBA project: xl/vbaProject.bin 16896 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.