Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 ca56f42a659c6115…

MALICIOUS

Office (OOXML)

69.6 KB Created: 2021-07-28 13:23:45 UTC Authoring application: Microsoft Excel 16.0300
MD5: 8332fe08c06d900e489fa25f51c12ab2 SHA-1: 74dd1e2647d643650d7e83f9990fd8dce2aacb42 SHA-256: ca56f42a659c6115b58407abfe8e3c31a29799661e0cc811e89641ed1fbc35c6
250 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1059 Command and Scripting Interpreter T1071.001 Web Protocols T1105 Ingress Tool Transfer

The sample contains VBA macros that utilize WScript.Shell and CreateObject to execute commands and download files. Specifically, the macro uses URLDownloadToFile to fetch a payload from the provided GitHub URL. This indicates an attempt to download and execute a second-stage payload, likely for malicious purposes.

Heuristics 7

  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
  • URLDownloadToFile in VBA critical OLE_VBA_DOWNLOAD
    URLDownloadToFile in VBA
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA project inside OOXML medium OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://github.com/florentbr/SeleniumBasic/releases/download/v2.0.9.0/SeleniumBasic-2.0.9.0.*
    • https://developer.microsoft.com/en-us/microsoft-edge/tools/webdriver/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
99bba8ec38dc153cd810ec876f740dcab3987313d722f0f2ff2a6b152735447c		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 14041 bytes
vbaProject_00.bin
e459b6e9bc4258be8f1781be8797b9476a968f0b63b6137db337e12582751710		 vba-project OOXML VBA project: xl/vbaProject.bin 67072 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.