Malicious Office (OOXML) / .XLSM — malware analysis report

Static analysis result for SHA-256 b85c5aa2f69b3d2c…

MALICIOUS

Office (OOXML) / .XLSM

42.9 KB Created: 2020-10-05 11:43:10 UTC Authoring application: 16.0300
MD5: f9c96ddb80a75229aad64cc971afe7d4 SHA-1: d2b4cdba52a64242af9c7becde87ce2f66b4a596 SHA-256: b85c5aa2f69b3d2ce8f261b3c527bd08f215b0c54c0b5c13a5fa30ec2aabbefb
80 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.001 PowerShell T1204.002 Malicious File

The critical heuristic 'OLE_VBA_ACTIVEX_XLM_STAGER' indicates that VBA ActiveX events are used to launch decoded Excel4 macros. The VBA script contains a function 'Zer' that decodes hex strings, and the 'viewAndPrint_1' subroutine iterates through constants, decodes them using 'Zer', and then uses 'ExecuteExcel4Macro' to run commands derived from these decoded strings. The decoded document body contains a list of URLs, suggesting the macro's purpose is to download and execute a second-stage payload from one of these locations.

Heuristics 2

  • VBA ActiveX event launches decoded Excel4 macro critical OLE_VBA_ACTIVEX_XLM_STAGER
    The compiled VBA p-code (identifier table) references an auto-firing ActiveX/control event together with ExecuteExcel4Macro, while the decompressed source does not — the VBA-stomping shape of the ActiveX-event XLM stager. The control event bridges into XLM formula execution to call Win32 / drop payloads, hidden from source-level scanners.
  • VBA project inside OOXML medium OOXML_VBA
    Document contains vbaProject.bin — VBA macros present

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
b5fd8bb742d95e7513c1217605a880d80b598b0b96aff7cc8511425d91881d08		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 1868 bytes
vbaProject_00.bin
ba7de802953efa6c1eb038d48bf607c5f6a8fac2160befc8dc097865605674b2		 vba-project OOXML VBA project: xl/vbaProject.bin 17920 bytes
emf_00.emf
53a88b00b3c0368a97f07e5705cf02259ed019efd03221a3f484b750c1f9742f		 ooxml-emf OOXML EMF part: xl/media/image1.emf 1408 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.