Office (OOXML) malware analysis — malicious · e3cfc02d38ccd289

MALICIOUS

Office (OOXML)

41.6 KB Created: 2021-06-22 12:43:05 UTC Authoring application: Microsoft Excel 16.0300

MD5: b03b0a5114e3298bce0a35721f4580cc SHA-1: f411749e6968cfd29fffc405417ecbebaf2cce4c SHA-256: e3cfc02d38ccd289bd1cfc4fd8ff03c116e0891f532b131144d39b7f26bcb8f5

160 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1059.001 PowerShell

The file is an Office document containing VBA macros. Heuristics indicate the presence of VBA macros, references to PowerShell, and calls to cmd.exe and GetObject. The VBA code appears to be obfuscated, but its intent is to execute PowerShell commands, suggesting it acts as a downloader for further malicious activity.

Heuristics 4

PowerShell reference in VBA critical OLE_VBA_PS

PowerShell reference in VBA
GetObject call high OLE_VBA_GETOBJ

GetObject call
cmd.exe reference in VBA high OLE_VBA_CMD

cmd.exe reference in VBA
VBA project inside OOXML medium OOXML_VBA

Document contains a VBA project — VBA macros present

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `3c0ba3adcf49a9a0097ab96fbd243b808e3bb99c5ffbb4bf090d723a6df82c82`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	35036 bytes
`vbaProject_00.bin` `5fd7566cc7397e53785ad0d8bb335bcb4b3e44dca47bacfb7c465feb6abe133d`	vba-project	OOXML VBA project: xl/vbaProject.bin	11264 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.