Malicious Office (OOXML) / .XLSM — malware analysis report

Static analysis result for SHA-256 e8776c375708b724…

MALICIOUS

Office (OOXML) / .XLSM

38.8 KB Created: 2020-06-03 06:22:21 UTC Authoring application: 16.0300
MD5: b7dcfa9d63ac2d970754dcaf72e955e8 SHA-1: be4589b30e336fd4fa4452888ab4fc40cd485c6e SHA-256: e8776c375708b72412d3edca2814d03396f02fe2a5bd3983deadd5e53ce0b06a
80 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic for Applications T1059.001 PowerShell T1204.002 Malicious File

The critical heuristic 'OLE_VBA_ACTIVEX_XLM_STAGER' indicates that VBA code is used to launch decoded Excel 4.0 macros via ExecuteExcel4Macro. The VBA script contains functions for string manipulation and obfuscation, and the 'crlf' subroutine appears to be responsible for deobfuscating and executing the Excel 4.0 macros. The 'logo' subroutine directly calls ExecuteExcel4Macro, suggesting it's used for payload execution. The document body contains a large amount of seemingly random text, which might be part of an obfuscation or anti-analysis technique.

Heuristics 2

  • VBA ActiveX event launches decoded Excel4 macro critical OLE_VBA_ACTIVEX_XLM_STAGER
    VBA code attached to an auto-firing ActiveX/UserForm control event (e.g. _Layout/_Change/_Painted) decodes a string with Replace/Split/Join/StrReverse/Chr and passes the recovered formula text to ExecuteExcel4Macro. This bridges VBA event activation into XLM formula execution to call Win32 APIs / drop payloads while evading AutoOpen and Shell keyword detection — a high-confidence macro stager, not a specific Office parser CVE.
  • VBA project inside OOXML medium OOXML_VBA
    Document contains vbaProject.bin — VBA macros present

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
399190e1c3bd6544b405e0e990d47c66567fc202081910f76f15155f24fd53f0		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 1610 bytes
vbaProject_00.bin
0d097958a7182be01de8cdc8889f53b046c3599aeb4c439329c9555ce8bc7a99		 vba-project OOXML VBA project: xl/vbaProject.bin 17920 bytes
emf_00.emf
76f287b1e3251b7e0e5ba27bfb05b35831150cc665de00f9fd2d807e2d2a028d		 ooxml-emf OOXML EMF part: xl/media/image1.emf 1976 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.