Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 b574a819bd736f9c…

MALICIOUS

Office (OOXML)

41.6 KB Created: 2021-06-22 12:43:05 UTC Authoring application: Microsoft Excel 16.0300
MD5: eb58dbb7ac40631ac62eebc2f810ec9a SHA-1: 115c8943deb4a226f9815cf5bfa143def0e1dd18 SHA-256: b574a819bd736f9cea95bd591daca402ddcd0d74139c6be42d0c2482ed17230a
160 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.001 PowerShell T1204.002 Malicious File

The OOXML document contains VBA macros that reference cmd.exe and PowerShell. The GetObject call and the presence of VBA macros suggest an attempt to execute arbitrary code. The VBA code includes a Base64 decoding function, indicating that it likely decodes and executes a payload, possibly downloaded from a remote source.

Heuristics 4

  • PowerShell reference in VBA critical OLE_VBA_PS
    PowerShell reference in VBA
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
  • cmd.exe reference in VBA high OLE_VBA_CMD
    cmd.exe reference in VBA
  • VBA project inside OOXML medium OOXML_VBA
    Document contains a VBA project — VBA macros present

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
252ad0b14c7117cb371b295009388c5141a64abae7f0aa8b287e33e3340cc7ee		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 35036 bytes
vbaProject_00.bin
52ef82630f2491d0d37c67295f5c2bfe72cf528fba007cdc470bfb60836dc61e		 vba-project OOXML VBA project: xl/vbaProject.bin 11264 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.