Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 d2fbeea56bcf570d…

MALICIOUS

Office (OOXML)

41.6 KB Created: 2021-06-22 12:43:05 UTC Authoring application: Microsoft Excel 16.0300
MD5: 34a6007cf53db4f05383de519fa549a5 SHA-1: b0e3ce13953771183e429633104c819fdc017640 SHA-256: d2fbeea56bcf570d0f2b138a50fd8e78f53fca12fe2172cd2bcf88d965001690
160 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.001 PowerShell

This Excel document contains VBA macros that reference PowerShell and cmd.exe, indicating an attempt to execute arbitrary commands. The GetObject call further suggests dynamic execution of code. The primary function of the VBA code appears to be decoding and executing a payload, likely a downloader for a second-stage artifact.

Heuristics 4

  • PowerShell reference in VBA critical OLE_VBA_PS
    PowerShell reference in VBA
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
  • cmd.exe reference in VBA high OLE_VBA_CMD
    cmd.exe reference in VBA
  • VBA project inside OOXML medium OOXML_VBA
    Document contains a VBA project — VBA macros present

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
787c249325e6e9b2adfddda69ae9c52cafde13df208f2fdec8d4a3d9bb1c4778		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 35036 bytes
vbaProject_00.bin
98b167131ab77ab2465ff3f425efdcaf4257d70cd77e8d28dafb724d807ba37a		 vba-project OOXML VBA project: xl/vbaProject.bin 11264 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.