Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 f6e93f6dad62890a…

MALICIOUS

Office (OOXML)

67.7 KB Created: 2012-10-19 22:33:57 UTC Authoring application: Microsoft Excel 12.0000
MD5: 1b19e8cb9dee00b4a4009c44e1f6c900 SHA-1: 7a9ae79e1c3cc336a7729a0bf4c6dd3ed9596f97 SHA-256: f6e93f6dad62890adcec90483305d1009aa9de661c2135e5efb45a3972d40d85
208 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder T1105 Ingress Tool Transfer

The sample is a malicious Excel document containing a Workbook_Open VBA macro. This macro utilizes CreateObject to interact with the file system and potentially schedule tasks. The VBA code attempts to write a file to the user profile directory and appears to be setting up persistence. The obfuscated nature of the script and the use of CreateObject suggest it's designed to download and execute a secondary payload, likely leveraging PowerShell.

Heuristics 6

  • LOLBin reference in VBA critical OLE_VBA_LOLBIN
    LOLBin reference in VBA
  • Workbook_Open macro high OLE_VBA_WBOPEN
    Workbook_Open macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • VBA project inside OOXML medium OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
a9341321ac931579406eb286491face4a66602eaa4f355e91042fa7b8476108f		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 3737 bytes
vbaProject_00.bin
52e845636b8ff53ed06ca5494e6075d668426965f12dec082822677d8111133f		 vba-project OOXML VBA project: xl/vbaProject.bin 16896 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.