Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 c5de24d15068694d…

MALICIOUS

Office (OOXML)

41.6 KB Created: 2021-06-22 12:43:05 UTC Authoring application: Microsoft Excel 16.0300
MD5: 8ffb89cf8dbb281d436501e07d2cd5ae SHA-1: 258b796c26ef91a74ad4a3f201ac4604ad85245f SHA-256: c5de24d15068694da6045f8a49e8b594f16f709106069b5a5b1aa7d97fc8e382
160 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.001 PowerShell T1204.002 Malicious File

The file is an OOXML document containing VBA macros. Heuristics indicate the VBA code references cmd.exe and PowerShell, suggesting it's designed to execute commands on the host system. The presence of a Base64 decoding function within the VBA code implies that it likely decodes and executes a malicious payload, possibly downloaded from an external source.

Heuristics 4

  • PowerShell reference in VBA critical OLE_VBA_PS
    PowerShell reference in VBA
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
  • cmd.exe reference in VBA high OLE_VBA_CMD
    cmd.exe reference in VBA
  • VBA project inside OOXML medium OOXML_VBA
    Document contains a VBA project — VBA macros present

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
b118a6a1dff67cd3807599e5febe3c95de29eda1c42f42b76f50f1bdad3796c5		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 35036 bytes
vbaProject_00.bin
c30610727f3fe785535860fa3d1e50e2eb2fe8497a7d607bd2301df4597b81f0		 vba-project OOXML VBA project: xl/vbaProject.bin 11264 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.