Malicious Office (OOXML) / .XLSM — malware analysis report

Static analysis result for SHA-256 b39b9eff6753a382…

MALICIOUS

Office (OOXML) / .XLSM

31.5 KB Created: 2020-10-06 10:55:20 UTC Authoring application: Microsoft Excel 16.0300
MD5: 7a5b3d785e849e2d6ede5dea232ffcbb SHA-1: cc44e55304a1365ef7af4798c793b071da3e55c7 SHA-256: b39b9eff6753a3826a1684438d18ea6001524a3ab82ab37318903534c5fefa03
80 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.001 PowerShell T1204.002 Malicious File

The critical heuristic 'OLE_VBA_ACTIVEX_XLM_STAGER' indicates that an ActiveX event triggers the execution of decoded Excel 4.0 macros. The VBA script 'macros.bas' confirms this by containing a subroutine 'Boils' which iterates through constants in the used range, decodes them, and then executes them using 'ExecuteExcel4Macro'. This process is designed to download and run a second-stage payload, although the specific URL or payload is not directly extractable from the provided evidence. The obfuscation and execution method suggest a downloader or initial access stage.

Heuristics 2

  • VBA ActiveX event launches decoded Excel4 macro critical OLE_VBA_ACTIVEX_XLM_STAGER
    The compiled VBA p-code (identifier table) references an auto-firing ActiveX/control event together with ExecuteExcel4Macro, while the decompressed source does not — the VBA-stomping shape of the ActiveX-event XLM stager. The control event bridges into XLM formula execution to call Win32 / drop payloads, hidden from source-level scanners.
  • VBA project inside OOXML medium OOXML_VBA
    Document contains vbaProject.bin — VBA macros present

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
63b45be5130f6a7d22ea4f335842429e511a98d47085936a2710c5546086dc3b		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 1131 bytes
vbaProject_00.bin
157d0043cbac60ab0e4b95f6b3f5f793aba9c51d9593f3abdeb7b46bf943f308		 vba-project OOXML VBA project: xl/vbaProject.bin 10752 bytes
emf_00.emf
4609916d8bdbc79e29612828ccd046cae14d7ddc0bfea0db84520ad5f180a00d		 ooxml-emf OOXML EMF part: xl/media/image1.emf 1408 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.