Malicious Office (OOXML) / .XLSX — malware analysis report

Static analysis result for SHA-256 c7163730589c30ce…

MALICIOUS

Office (OOXML) / .XLSX

210.0 KB Created: 2021-07-28 13:09:24 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2022-04-12
MD5: c5034f3fcb4946b2caa5276c8e1e1a77 SHA-1: 3eef60d78db776670c21eb99d80153387a41fb4c SHA-256: c7163730589c30ce59773345558a7747a019e5228ce1760b46f89fc73f52db11
158 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1546.003 Event Triggered Execution: Windows Management Instrumentation T1059.001 PowerShell

This XLSX file contains VBA macros, including a Workbook_Open macro, which is a common technique for executing malicious code upon opening the document. The script attempts to retrieve configuration data from a temporary file and then displays an authentication form. The presence of multiple suspicious URLs related to 'myunisoft.fr' suggests an attempt to communicate with a command and control server or exfiltrate credentials. The macro's intent appears to be to trick the user into providing credentials or to download and execute a second-stage payload.

Heuristics 7

  • Workbook_Open macro high OLE_VBA_WBOPEN
    Workbook_Open macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • VBA project inside OOXML medium OOXML_VBA
    Document contains vbaProject.bin — VBA macros present
  • External hyperlinks (1) low OOXML_EXTERNAL_HYPERLINKS
    Document contains 1 external hyperlink — clickable URLs are stored as external relationships. First target: https://formation.experts-comptables.org/assets/courseware/v1/c5e96980521631e0106e2f917ed5f62f/asset-v1:Experts-Comptables+LAB+1+type@asset+block@Norme_Professi
  • Hidden worksheet (hidden) low OOXML_HIDDEN_SHEET
    Excel workbook contains 1 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://formation.experts-comptables.org/assets/courseware/v1/c5e96980521631e0106e2f917ed5f62f/asset-v1:Experts-Comptables+LAB+1+type@asset+block@Norme_Professi
    • https://formation.experts-comptables.org/assets/courseware/v1/c5e96980521631e0106e2f917ed5f62f/asset-v1:Experts-Comptables+LAB+1+type@asset+block@Norme_Professionnelle_LAB_-_NPLAB.pdf
    • https://ws-dev.myunisoft.fr
    • https://yoda.myunisoft.fr:1337/api/authenticate
    • https://ws-preprod.myunisoft.fr
    • https://yoda.myunisoft.fr:1338/api/authenticate
    • https://prod-ws.myunisoft.fr
    • https://app.myunisoft.fr/api/authenticate
    • https://github.com/VBA-tools/VBA-JSON
    • http://www.vbaccelerator.com/home/VB/Code/Techniques/RunTime_Debug_Tracing/VB6_Tracer_Utility_zip_cStringBuilder_cls.asp
    • https://github.com/VBA-tools/VBA-JSON/pull/82
    • https://github.com/VBA-tools/VBA-UtcConverter
    • https://www.codestack.net/visual-basic/algorithms/fso/io/read-binary-file/
    • https://www.codestack.net/license/
    • http://www.opensource.org/licenses/mit-license.php
    • http://code.google.com/p/vba-json/
    • http://msdn.microsoft.com/en-us/library/windows/desktop/ms724421.aspx
    • http://msdn.microsoft.com/en-us/library/windows/desktop/ms724949.aspx
    • http://msdn.microsoft.com/en-us/library/windows/desktop/ms725485.aspx
    • http://support.microsoft.com/kb/269370
    • http://www.ietf.org/rfc/rfc4627.txt
    • https://support.microsoft.com/en-us/kb/272138
    • http://www.opensource.org/licenses/mit-license.php)�

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
586979f5503c440baecd6d20629d1d15bb13b7514764f4d771cbd3eb688f2398		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 160086 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 27 Chr/ChrW string-construction calls. Carved macro source contains an auto-exec entry point and execution/download terms.
vbaProject_00.bin
b85819b4f1db57eff906d5d95de456655e07f7e47e49f802d728f44b9c009c2c		 vba-project OOXML VBA project: xl/vbaProject.bin 484864 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.