Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 e0483f588ec6103e…

MALICIOUS

Office (OOXML)

842.7 KB Created: 2001-01-19 12:29:45 UTC Authoring application: Microsoft Excel 15.0300 First seen: 2021-10-23
MD5: 73b0bc8c346d36c05c9a79d5be46b38d SHA-1: 2a2ed8a4d127164968ff0623656d670e22fec854 SHA-256: e0483f588ec6103ed14e1b0976d042b52cdb9f1ab977ed88ae9139d42c650dbf
190 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1204.002 Malicious File

The sample is an Excel document containing VBA macros. The Auto_Open macro is present and configured to execute code, indicated by the OLE_VBA_AUTO and OLE_VBA_PCODE_AUTOEXEC_EXEC heuristics. The presence of CreateObject calls suggests the macro is designed to interact with the system, likely to download and execute a second-stage payload. The document body content appears to be financial or business-related text, possibly used as a lure.

Heuristics 7

  • VBA project inside OOXML medium 4 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present (project part renamed away from vbaProject.bin: xl/vbaProjectSignature.bin)
  • VBA project part renamed to evade filename detection high OOXML_VBA_PROJECT_RENAMED
    The VBA project is bound through the OOXML relationship/content type but its part is not named vbaProject.bin. Legitimate Office producers always emit vbaProject.bin; renaming it hides the macros from path-only scanners (observed in the SVCReady loader).
  • Auto_Open macro high OLE_VBA_AUTO
    Auto_Open macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Hidden worksheet (veryHidden, hidden) low OOXML_HIDDEN_SHEET
    Excel workbook contains 6 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction
  • VBA project is signed but not by a recognised publisher info VBA_SIGNED_UNTRUSTED
    The VBA project carries a digital signature, but the signer does not chain to a recognised code-signing publisher/CA (self-signed, unknown issuer, or unparseable). A signature alone is not evidence of benignity — malware is routinely self-signed or signed with stolen certificates.

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 300479 bytes
SHA-256: 4e664516f2c4440de4f4cdd815781d260cd42bcb5fe439439408ffc7f3032ed7
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "DieseArbeitsmappe"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Option Explicit

'
Private Sub Workbook_BeforeClose(Cancel As Boolean)
    ' Über Cancel wird gesteuert, ob die Aktion hier beendet ist oder nicht:
    '   Cancel = true: In dieser Funktion ist bereits alles erledigt worden
    '   Cancel = false: Mit den Standardaktionen weitermachen...
    Dim lRetVal As Long
    Dim bRetVal As Boolean
    Dim oServ As Object
    Dim vDate As Variant
    Dim bHasMinVersion As Boolean
    Dim bOffice2016Workaround As Boolean
    
    ' Datei bei Bedarf speichern
    If Not ThisWorkbook.Saved Then
        ' Betroffenheit vom Office 2016-Bug prüfen
        bOffice2016Workaround = (Val(Application.Version) = 16 And Application.Workbooks.Count = 1)
        ' Prüfen, ob unser OLE-Server vorhanden ist
        bHasMinVersion = False  ' MinVersion nicht prüfen
        Set oServ = MainServer("KWEDokument", False, bHasMinVersion)
        If oServ Is Nothing Then
            ' Der OLE-Server ist nicht vorhanden --> Meldung an den User
            lRetVal = MsgBox(TOOLID + "067" + vbCrLf + vbCrLf + _
                "Die Datei '" + ThisWorkbook.Name + "' wurde noch nicht gespeichert." + vbCrLf + _
                "Sie sollten die Datei speichern, bevor Sie die Arbeitsmappe schließen," + vbCrLf + _
                "damit Ihre Änderungen nicht verloren gehen." + vbCrLf + vbCrLf + _
                "Soll die Datei jetzt gespeichert werden?", _
                IIf(bOffice2016Workaround, vbYesNo, vbYesNoCancel), TOOLHDR)
            Select Case lRetVal
                Case vbYes
                    bRetVal = Not DoSaveThisFile(False)
                    Cancel = IIf(bOffice2016Workaround, False, bRetVal)
                Case vbNo
                    Cancel = False
                    ThisWorkbook.Saved = True
                Case vbCancel
                    Cancel = IIf(bOffice2016Workaround, False, True)
            End Select
            GoTo END_BeforeClose
        End If

        lRetVal = MsgBox(TOOLID + "007" + vbCrLf + vbCrLf + _
            "Die Datei '" + ThisWorkbook.Name + "' wurde noch nicht gespeichert." + vbCrLf + vbCrLf + _
            "Soll die Datei jetzt gespeichert werden?", _
            IIf(bOffice2016Workaround, vbYesNo, vbYesNoCancel), TOOLHDR)
        Call DoLog("BeforeClose(); Datei speichern = " + IIf(lRetVal = vbYes, "Yes", IIf(lRetVal = vbNo, "No", "Cancel")))
        Select Case lRetVal
            Case vbYes
                Set oServ.XlApplication = Application
                Set oServ.xlWorkbook = ThisWorkbook
                lRetVal = oServ.Speichern(False)
                Call DoLog("BeforeClose(); Speichern; RetVal=" + CStr(lRetVal))
                Select Case lRetVal
                    Case oServ.FILESAVE_CANCEL, oServ.FILESAVE_ERROR
                        Cancel = IIf(bOffice2016Workaround, False, True)
                    Case oServ.FILESAVE_OK
                        Cancel = False
                End Select
            Case vbNo
                ThisWorkbook.Saved = True
            Case vbCancel
                Cancel = IIf(bOffice2016Workaround, False, True)
        End Select
    End If

END_BeforeClose:
    ' Hilfe-Server Verbindung schließen
    Set oServ = Nothing
    Set cHelp = Nothing
    Set cLog = Nothing
End Sub

Private Sub Workbook_BeforeSave(ByVal SaveAsUI As Boolean, Cancel As Boolean)
    ' Über Cancel wird gesteuert, ob die Aktion hier beendet ist oder nicht:
    '   Cancel = true: In dieser Funktion ist bereits alles erledigt worden
    '   Cancel = false: Mit den Standardaktionen weitermachen...
    Dim lRetVal As Long
    Dim oServ As Object
    Dim vDate As Variant
    Dim bHasMinVersion As Boolean
    
    If SaveAsUI Then
        Call DoLog("BeforeSave
... (truncated)
vbaProject_00.bin vba-project OOXML VBA project: xl/vbaProject.bin 953856 bytes
SHA-256: 43ca004a5ae2caf3aeb5f6607461182ad7e3a63ad1106e1bfaa3928049934e2c
vbaProject_01.bin vba-project OOXML VBA project: xl/vbaProjectSignature.bin 3504 bytes
SHA-256: ec12e233e5223b3d1e44d9d4e14f560b76d296d1c31bfd76d42f6b2d3a1f32b5

Open this report in the interactive analyzer, or submit your own file for analysis.