Malicious Office (OOXML) / .XLSM — malware analysis report

Static analysis result for SHA-256 d431b8c8cd87d7bd…

MALICIOUS

Office (OOXML) / .XLSM

47.9 KB Created: 2020-10-26 11:36:07 UTC Authoring application: 16.0300
MD5: c3e9e334ccffe94b48a7645455665d4d SHA-1: 1d03e3045b61d47407a29711254e1a5f7023484e SHA-256: d431b8c8cd87d7bd7d3f88aaf2dacadc1d8553c29b1b970657faba974eb9e148
80 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.005 Visual Basic T1204.002 Malicious File

The critical heuristic 'OLE_VBA_ACTIVEX_XLM_STAGER' indicates that a VBA ActiveX event (_Layout) is used to launch a decoded Excel 4.0 macro via ExecuteExcel4Macro. The VBA script 'macros.bas' contains the 'readyforview' subroutine which is called by the _Layout event. This subroutine iterates through visible cells and concatenates characters based on column index, then passes this string to the 'westside' function. The 'westside' function then uses ExecuteExcel4Macro with a replaced argument, suggesting it's designed to execute a command or download a payload. The sample is a macro-enabled XLSM file, further supporting a macro-based attack.

Heuristics 2

  • VBA ActiveX event launches decoded Excel4 macro critical OLE_VBA_ACTIVEX_XLM_STAGER
    The compiled VBA p-code (identifier table) references an auto-firing ActiveX/control event together with ExecuteExcel4Macro, while the decompressed source does not — the VBA-stomping shape of the ActiveX-event XLM stager. The control event bridges into XLM formula execution to call Win32 / drop payloads, hidden from source-level scanners.
  • VBA project inside OOXML medium OOXML_VBA
    Document contains vbaProject.bin — VBA macros present

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
b1a64a7de501c4f15116743caae997244c81282aaad50a91bee93f8dd5b716a2		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 1212 bytes
vbaProject_00.bin
4382b2a2f168cced0c307c2a3b30d6df023036228d2a1aee0325c866b8293877		 vba-project OOXML VBA project: xl/vbaProject.bin 11776 bytes
emf_00.emf
53a88b00b3c0368a97f07e5705cf02259ed019efd03221a3f484b750c1f9742f		 ooxml-emf OOXML EMF part: xl/media/image1.emf 1408 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.