Malicious Macros in Office Documents

Claim_732989680_03292021.xlsm

Author: Moise Medici
Updated: 25 Oct 2025 · Completed
Difficulty: Easy
Platform: Windows
Languages: VBA Excel 4.0 Macro
MITRE: T1059 (Command and Scripting Interpreter) T1059.005 (Command and Scripting Interpreter: Visual Basic) T1106 (Native API) T1204.002 (User Execution: Malicious File) T1027.010 (Obfuscated Files or Information: Command Obfuscation) T1218.011 (System Binary Proxy Execution: Rundll32) T1564 (Hide Artifacts) T1071.001 (Application Layer Protocol: Web Protocols) T1105 (Ingress Tool Transfer)

Executive Summary

This sample is a malicious document that hides its execution in a series of hidden Excel sheets. Its purpose is to download and execute 3 DLLs coming from 3 different IP addresses.

The purpose of the DLLs cannot be confirmed, as there is no connectivity to those IP addresses.