Office (OOXML) / .XLSM malware analysis — malicious · c4bdbd1712e21e7d

MALICIOUS

Office (OOXML) / .XLSM

38.8 KB Created: 2020-06-03 06:55:34 UTC Authoring application: 16.0300

MD5: 1d7d64d36d37449e514add9baa34139b SHA-1: 2c58859284fab216a27939bc9f3ca428d36364ba SHA-256: c4bdbd1712e21e7d5703e23691704042fd8c067b09a43cef643723c149946005

80 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1059.001 PowerShell T1204.002 Malicious File

The critical heuristic 'OLE_VBA_ACTIVEX_XLM_STAGER' indicates that the VBA code decodes and executes Excel4 macros. The VBA script contains functions for string manipulation and obfuscation, and the `exchange` subroutine directly calls `ExecuteExcel4Macro`. This suggests the primary intent is to run further commands, likely to download and execute a second-stage payload. The document body content is heavily obfuscated and does not provide clear user-facing text, making it difficult to determine a specific lure.

Heuristics 2

VBA ActiveX event launches decoded Excel4 macro critical OLE_VBA_ACTIVEX_XLM_STAGER

VBA code attached to an auto-firing ActiveX/UserForm control event (e.g. _Layout/_Change/_Painted) decodes a string with Replace/Split/Join/StrReverse/Chr and passes the recovered formula text to ExecuteExcel4Macro. This bridges VBA event activation into XLM formula execution to call Win32 APIs / drop payloads while evading AutoOpen and Shell keyword detection — a high-confidence macro stager, not a specific Office parser CVE.
VBA project inside OOXML medium OOXML_VBA

Document contains vbaProject.bin — VBA macros present

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `703b409f86b2cd33461753a55384df1331c5825b7c2328d9fff143a8b53ec860`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	1676 bytes
`vbaProject_00.bin` `ecbb071d5f43d2a19c9e8648065c3c9eae07a06b27fc30f0ccf8e44c404d42da`	vba-project	OOXML VBA project: xl/vbaProject.bin	17920 bytes
`emf_00.emf` `4609916d8bdbc79e29612828ccd046cae14d7ddc0bfea0db84520ad5f180a00d`	ooxml-emf	OOXML EMF part: xl/media/image1.emf	1408 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.