Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 d032d57e8f366c59…

MALICIOUS

Office (OOXML)

67.3 KB Created: 2012-10-19 22:33:57 UTC Authoring application: Microsoft Excel 12.0000
MD5: 16b275e48c1d27c448b4ed772206315c SHA-1: 317988ea2f7fa8fa288850adce94bf2543bbd8d0 SHA-256: d032d57e8f366c59979f536722b5cfbded08b94fc032da27220df46dfcd43208
208 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample is an Office document containing a Workbook_Open VBA macro, which is a common technique for initial execution. The macro uses CreateObject to interact with the file system and potentially download a second-stage payload, indicated by the creation of a file named 'qDialogSeriesAxes.xsl' in the ALLUSERSPROFILE directory. The VBA code is heavily obfuscated, making it difficult to determine the exact payload or its destination, but the overall intent appears to be downloading and executing further malicious content.

Heuristics 6

  • LOLBin reference in VBA critical OLE_VBA_LOLBIN
    LOLBin reference in VBA
  • Workbook_Open macro high OLE_VBA_WBOPEN
    Workbook_Open macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • VBA project inside OOXML medium OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
a6a58c0253506b87105be30dd3a24653ee425be44300b5870e30929f5e646214		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 3627 bytes
vbaProject_00.bin
81fdcbed4e4ccafec28d16090d46159fb001e7f2512c34426f70ece74f3004a7		 vba-project OOXML VBA project: xl/vbaProject.bin 16896 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.