Malicious Office (OOXML) / .XLSM — malware analysis report

Static analysis result for SHA-256 d178dfd2b31c0830…

MALICIOUS

Office (OOXML) / .XLSM

43.0 KB Created: 2020-10-07 09:51:58 UTC Authoring application: 16.0300
MD5: 3d38d0686a7b59a1067c7ec19b08796f SHA-1: 827474d9deb9d9cbf91c6fafaa13aa3e74acb424 SHA-256: d178dfd2b31c0830df1748d3adc09a23378c3a8212f65239b350fc7e06031494
80 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.001 PowerShell T1204.002 Malicious File

The critical heuristic OLE_VBA_ACTIVEX_XLM_STAGER indicates that VBA code is used to launch decoded Excel4 macros. The VBA script contains a function `dlf` which calls `ExecuteExcel4Macro`, and the `steelview` subroutine iterates through a list of URLs, reconstructing them from concatenated strings. These URLs are likely used to download and execute a second-stage payload. The reconstructed URLs include: http://renahavis.com.ua/y6qu3.gif, http://oghniyat.com/uoax0mo1.rar, http://www.szhxr.com/ujifkc.pdf, and many others. The script's intent is to download and execute a second-stage payload from these URLs.

Heuristics 2

  • VBA ActiveX event launches decoded Excel4 macro critical OLE_VBA_ACTIVEX_XLM_STAGER
    The compiled VBA p-code (identifier table) references an auto-firing ActiveX/control event together with ExecuteExcel4Macro, while the decompressed source does not — the VBA-stomping shape of the ActiveX-event XLM stager. The control event bridges into XLM formula execution to call Win32 / drop payloads, hidden from source-level scanners.
  • VBA project inside OOXML medium OOXML_VBA
    Document contains vbaProject.bin — VBA macros present

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
1ef61e7047afcbc89e890e7e87d1665fd89076cd125054bb389fb167cef7ca07		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 2170 bytes
vbaProject_00.bin
8ee64023484cd467285751449522b670f3873cae016629ee7bae906e96f910b5		 vba-project OOXML VBA project: xl/vbaProject.bin 19968 bytes
emf_00.emf
718aab5bc274820ed43c95327b0931528513301993e1ce84cd79836f71f52025		 ooxml-emf OOXML EMF part: xl/media/image1.emf 1408 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.