Office (OOXML) malware analysis — malicious · df6eb78a634b0476

MALICIOUS

Office (OOXML)

12.8 KB Created: 2021-06-08 07:44:17 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2021-06-20

MD5: eda59f9bd9f0958360889240cca04c29 SHA-1: d799b000721c2ffbd178fac7fbdc4faf21c7aa8b SHA-256: df6eb78a634b0476fd31e39c568a01ab9762a069e84c05cc7c1d3666adc417a4

208 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1059.001 PowerShell T1218.011 System Binary Proxy Execution: Rundll32 T1566.001 Spearphishing Attachment

The sample is an Excel document containing a VBA macro that executes automatically upon opening. The macro uses GetObject to instantiate a COM object and then calls its ShellExecute method to run the PowerShell command 'ipconfig /all'. This suggests an intent to gather system information, likely as a precursor to further malicious activity or for reconnaissance.

Heuristics 6

VBA project inside OOXML medium 5 related findings OOXML_VBA

Document contains a VBA project — VBA macros present

PowerShell reference in VBA critical OLE_VBA_PS

PowerShell reference in VBA

Matched line in script

    Set obj = GetObject("new:C08AFD90-F2A1-11D1-8455-00A0C91F3880")
    obj.Document.Application.ShellExecute "powershell", "ipconfig /all", "", Null, 1
End Sub

GetObject call high OLE_VBA_GETOBJ

GetObject call

Matched line in script

Sub AutoOpen()
    Set obj = GetObject("new:C08AFD90-F2A1-11D1-8455-00A0C91F3880")
    obj.Document.Application.ShellExecute "powershell", "ipconfig /all", "", Null, 1

VBA instantiates a COM class by raw CLSID high OLE_VBA_GETOBJECT_CLSID_EVASION

VBA uses GetObject("new:{CLSID}") to instantiate a COM class by raw CLSID rather than a CreateObject ProgID — an uncommon bypass of name-based macro detection.
Matched line in script
```
Sub AutoOpen()
    Set obj = GetObject("new:C08AFD90-F2A1-11D1-8455-00A0C91F3880")
    obj.Document.Application.ShellExecute "powershell", "ipconfig /all", "", Null, 1
```
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.

AutoOpen macro low OLE_VBA_AUTOOPEN

AutoOpen macro

Matched line in script

Attribute VB_Customizable = True
Sub AutoOpen()
    Set obj = GetObject("new:C08AFD90-F2A1-11D1-8455-00A0C91F3880")

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	788 bytes
SHA-256: `0c57a416776e336cecf8ddfc23e64252dff31e334af63d6b3664b44cc40e7a7f`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisWorkbook" Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Sub AutoOpen() Set obj = GetObject("new:C08AFD90-F2A1-11D1-8455-00A0C91F3880") obj.Document.Application.ShellExecute "powershell", "ipconfig /all", "", Null, 1 End Sub Attribute VB_Name = "Sheet1" Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True
`vbaProject_00.bin`	vba-project	OOXML VBA project: xl/vbaProject.bin	13824 bytes
SHA-256: `7cf8adc2422780b2fb6b00f7bb7d20f59e191ef1bf25f4a8b0d43bf30378aa2e`

Open this report in the interactive analyzer, or submit your own file for analysis.