Office (OOXML) / .XLSM malware analysis — malicious · f127b8885114903e

MALICIOUS

Office (OOXML) / .XLSM

389.8 KB Created: 2020-01-28 19:47:00 UTC Authoring application: Microsoft Excel 15.0300

MD5: 1674ecbe5b9116407b57813e04d6dd49 SHA-1: d7ac3421e29ea666c4aae2c09fa2f4707a4269aa SHA-256: f127b8885114903eac8725e5477e22ec9b73f3190aad5acf248af5871f02bd81

110 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File T1566.001 Spearphishing Attachment T1059.005 Visual Basic

The sample is an XLSM file containing VBA macros. The `SE_ENABLE_LURE` heuristic indicates the document instructs the user to enable macros. The VBA script contains obfuscated strings that, when decoded, reveal a PowerShell command. This command is designed to download a second-stage executable from `http://3.120.146.69/bgq/DFL,6010170713.exe` and save it as `C:\APPDATA\$ProcName\shell.exe`, then execute it. The `OLE_VBA_SHELL` heuristic confirms the use of the `Shell()` function to execute external commands.

Heuristics 5

Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA
VBA project inside OOXML medium OOXML_VBA

Document contains vbaProject.bin — VBA macros present
Macro/content-enable lure medium SE_ENABLE_LURE

Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
External hyperlinks (6) low OOXML_EXTERNAL_HYPERLINKS

Document contains 6 external hyperlinks — clickable URLs are stored as external relationships. First target: https://go.microsoft.com/fwlink/?linkid=844736
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://go.microsoft.com/fwlink/?linkid=844736
- http://go.microsoft.com/fwlink/?LinkId=844969
- https://go.microsoft.com/fwlink/?linkid=844749
- https://go.microsoft.com/fwlink/?linkid=844741
- https://go.microsoft.com/fwlink/?linkid=844732
- https://go.microsoft.com/fwlink/?linkid=844725
- https://go.microsoft.com/fwlink/?linkid=844742
- https://go.microsoft.com/fwlink/?linkid=844734
- https://go.microsoft.com/fwlink/?linkid=844751
- https://go.microsoft.com/fwlink/?linkid=844745
- https://go.microsoft.com/fwlink/?linkid=844743
- https://go.microsoft.com/fwlink/?linkid=844728
- https://go.microsoft.com/fwlink/?linkid=844746
- https://go.microsoft.com/fwlink/?linkid=844747
- https://go.microsoft.com/fwlink/?linkid=844726
- https://go.microsoft.com/fwlink/?linkid=844738
- https://go.microsoft.com/fwlink/?linkid=844735
- https://go.microsoft.com/fwlink/?linkid=844750
- http://go.microsoft.com/fwlink/?LinkId=846285

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `a895212ba961d3677481b7bb933f435abe8e29999b7e845b0f67f6820d03e45c`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	5694 bytes
`vbaProject_00.bin` `aaef2d97275cebb005e5bbc74ce2e6aba2609942edbec69685af5f5b192dd143`	vba-project	OOXML VBA project: xl/vbaProject.bin	10752 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.