Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 38e85e7e62bb3375…

MALICIOUS

Office (OOXML)

26.5 KB Created: 2021-08-18 02:04:39 UTC Authoring application: Microsoft Excel 16.0300
MD5: 7177f9824d931a388696b3ee0f43710f SHA-1: 049403cfab4c94793e5c04998ab1d7cb6f8df9fd SHA-256: 38e85e7e62bb3375f1d6578e41eee4c922b04865d2db4a82dd4b83c01847ce58
610 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1105 Ingress Tool Transfer T1204.002 Malicious File T1566.001 Spearphishing Attachment

The sample contains VBA macros that execute automatically upon opening. These macros utilize WScript.Shell and WMI to download a second-stage payload from the embedded URL 'http://ec2-18-184-17-12.eu-central-1.compute.amazonaws.com/standardchartered/passleak/180821/'. The downloaded content is then saved to temporary files named 'Details.dat' and 'LeakDetails.dat', suggesting a data exfiltration or further infection attempt. The document body content, listing email addresses and indicating 'Password Leaked', supports the phishing or credential harvesting motive.

Heuristics 14

  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
  • Obfuscated VBA Shell command with URL critical OLE_VBA_OBFUSCATED_SHELL_URL
    VBA macro invokes Shell with command text assembled through decoder or string-manipulation functions and includes a URL. This is a high-confidence downloader/dropper pattern, stronger than Shell or URL evidence on their own.
  • VBA WMI Win32_Process launcher critical OLE_VBA_WMI_PROCESS_CREATE
    VBA macro builds or references a WMI moniker for Win32_Process and invokes .Create to start a command. This is a high-confidence macro execution chain that often hides the WMI class name through string concatenation or helper functions.
  • VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC
    VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
  • ClamAV: Doc.Downloader.Valyria-10026858-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Valyria-10026858-0
  • ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV
    ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
  • Auto_Open macro high OLE_VBA_AUTO
    Auto_Open macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • VBA project inside OOXML medium OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ec2-18-184-17-12.eu-central-1.compute.amazonaws.com/standardchartered/passleak/180821/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
d03e718150776b5b2a03b242f563654731a2951777b38a0049b6ee0badeed7a8		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 4717 bytes
vbaProject_00.bin
c4675f61e27f527be1254231ba8effab2ce7da4e08801b48f339152378430d44		 vba-project OOXML VBA project: xl/vbaProject.bin 18432 bytes
Detection
ClamAV: Doc.Downloader.Valyria-10026858-0
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.