Office (OOXML) malware analysis — malicious · bf7027b4785ab36b

MALICIOUS

Office (OOXML)

42.2 KB Created: 2021-06-22 12:43:05 UTC Authoring application: Microsoft Excel 16.0300

MD5: 23b1672ca1e8e9e0bdfba8d7174b4c10 SHA-1: 9dfcda2ea01ca961700c1e5368b05392230cc26a SHA-256: bf7027b4785ab36b420be3ed30a11f9a3ec49aab04de6674c8cd8b7f5f47a976

260 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1059.001 PowerShell T1204.002 Malicious File T1059.003 Windows Command Shell

The file contains a Workbook_Open VBA macro that references PowerShell and cmd.exe. The macro utilizes WMI's Win32_Process to create a new process, indicating an attempt to execute a secondary payload. The VBA code also includes Base64 decoding functionality, likely used to obfuscate the PowerShell commands.

Heuristics 6

PowerShell reference in VBA critical OLE_VBA_PS

PowerShell reference in VBA
VBA WMI Win32_Process launcher critical OLE_VBA_WMI_PROCESS_CREATE

VBA macro builds or references a WMI moniker for Win32_Process and invokes .Create to start a command. This is a high-confidence macro execution chain that often hides the WMI class name through string concatenation or helper functions.
Workbook_Open macro high OLE_VBA_WBOPEN

Workbook_Open macro
GetObject call high OLE_VBA_GETOBJ

GetObject call
cmd.exe reference in VBA high OLE_VBA_CMD

cmd.exe reference in VBA
VBA project inside OOXML medium OOXML_VBA

Document contains a VBA project — VBA macros present

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `170a3fb7555f446a5f42b18a066456f5ade6776b730f81f826946ee95acefd0d`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	36453 bytes
`vbaProject_00.bin` `9d7a2497b60fde06928f1bfebfeaa6a4baf3e51d20ba5a20721b3fefdea674e1`	vba-project	OOXML VBA project: xl/vbaProject.bin	11776 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.