Office (OOXML) / .XLSM malware analysis — malicious · da90fdb2d1958f05

MALICIOUS

Office (OOXML) / .XLSM

51.5 KB Created: 2020-07-01 07:16:16 UTC Authoring application: Microsoft Excel 16.0300

MD5: b7b38d42f2ab28ef82c0a6115ee72268 SHA-1: 25903daab61e06ee554a8c916662347df2deb6f9 SHA-256: da90fdb2d1958f05b0172809df9b4b5a898f1635308f259190e93d1306baff38

80 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1059.001 PowerShell T1204.002 Malicious File

The critical heuristic 'OLE_VBA_ACTIVEX_XLM_STAGER' indicates that an ActiveX event triggers the execution of a decoded Excel 4.0 macro. The VBA script 'macros.bas' contains a subroutine 'stampas' that iterates through constants in the active sheet, decodes them, and executes them using 'ExecuteExcel4Macro'. This mechanism is commonly used to download and execute further stages of malware. The document body consists of seemingly random alphanumeric strings and numbers, which likely serve as obfuscated data for the macro. No specific IOCs like URLs or hashes were directly extracted from the script, hence the family is unknown.

Heuristics 2

VBA ActiveX event launches decoded Excel4 macro critical OLE_VBA_ACTIVEX_XLM_STAGER

VBA code attached to an auto-firing ActiveX/UserForm control event (e.g. _Layout/_Change/_Painted) decodes a string with Replace/Split/Join/StrReverse/Chr and passes the recovered formula text to ExecuteExcel4Macro. This bridges VBA event activation into XLM formula execution to call Win32 APIs / drop payloads while evading AutoOpen and Shell keyword detection — a high-confidence macro stager, not a specific Office parser CVE.
VBA project inside OOXML medium OOXML_VBA

Document contains vbaProject.bin — VBA macros present

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `c9f5f2abb1ec83a7b2fd2fa0daa5b1544a35d2d1e2154dc63914a62a7b09ea3c`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	1077 bytes
`vbaProject_00.bin` `3bf76bc3469e268cc801827cda32578d7fd26dbc699bc815fe0e063634977ace`	vba-project	OOXML VBA project: xl/vbaProject.bin	10752 bytes
`emf_00.emf` `76f287b1e3251b7e0e5ba27bfb05b35831150cc665de00f9fd2d807e2d2a028d`	ooxml-emf	OOXML EMF part: xl/media/image1.emf	1976 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.