Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 3efc6d487a1914f8…

MALICIOUS

Office (OLE)

907.5 KB Created: 2004-05-21 07:18:45 Authoring application: Microsoft Excel First seen: 2019-12-09
MD5: d8bd971bf262dbb963d47552bf560c64 SHA-1: 0bc7ee77a74d0912f11ba6d9710feaad50866bab SHA-256: 3efc6d487a1914f827cf1c25af1c61cb2174b0b0e2fbd0ebce4397914f8cf68c
142 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1047 WMI

The file is an Excel document containing a Workbook_Open VBA macro, which is a common technique for executing malicious code upon opening. The macro utilizes CreateObject, indicating it likely attempts to download and execute a second-stage payload. While the specific payload is not directly visible, the presence of the macro and the nature of the heuristics suggest a downloader or droppper functionality. The document body contains Russian text related to regulatory reporting, which could be used as a lure.

Heuristics 5

  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Workbook_Open macro high OLE_VBA_WBOPEN
    Workbook_Open macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://tariff.eias.ru/JKHReg.wsdl In document text (OLE body)
    • https://tariff.eias.ru/JKHReg.wsdl�In document text (OLE body)
    • http://ws/eias/ru/�In document text (OLE body)
    • http://www.fstrf.ru/regions/region/showlistIn document text (OLE body)
    • http://ws/eias/ru/In document text (OLE body)
    • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)
    • http://alrosa.ru/about/production/social/rikk/2012/(In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 186432 bytes
SHA-256: ddbd563773caffd516186ac6ce4c46ea3d51477c2d0e689e1bf5ce5eacb44ba1
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ЭтаКнига"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Option Explicit

Private Const SAVE_STATUS_CRITICAL_IMPACT_WARNING As String = "Шаблон будет сохранен, но НЕ БУДЕТ принят к рассмотрению из-за невыполнения ОБЯЗАТЕЛЬНЫХ условий! См. лист 'Проверка'!"
Private Const SAVE_STATUS_SUCCESS As String = "Шаблон готов к сохранению без замечаний"
Private Const SAVE_STATUS_LOW_IMPACT_WARNING As String = "Шаблон будет принят к рассмотрению, но обратите внимание НЕВЫПОЛНЕНИЕ ПРЕДУПРЕДИТЕЛЬНЫХ условий на листе 'Проверка'"
Private Const SAVE_MESSAGE_TITLE As String = "Результат проверки"

Private Sub Workbook_BeforeSave(ByVal SaveAsUI As Boolean, Cancel As Boolean)

    Application.Calculate
    
    Set wb = Application.ThisWorkbook
    If Len(CStr(Me.Names("region_name").RefersToRange.Value)) > 0 Then
        
        modPROV.WarningsBeforeSaving Me
              
        If modPROV.gintCriticalImpactWarningsCounter > 0 Then
          Me.CustomDocumentProperties("Status") = 1 'ТРАНС
          MsgBox SAVE_STATUS_CRITICAL_IMPACT_WARNING, vbExclamation + vbOKOnly, SAVE_MESSAGE_TITLE
          Me.Worksheets("Проверка").Activate
        ElseIf modPROV.gintLowImpactWarningsCounter > 0 Then
          Me.CustomDocumentProperties("Status") = 1 'ТРАНС
          MsgBox SAVE_STATUS_LOW_IMPACT_WARNING, vbExclamation + vbOKOnly, SAVE_MESSAGE_TITLE
          Me.Worksheets("Проверка").Activate
        Else 'ТРАНС
          Me.CustomDocumentProperties("Status") = 2 'ТРАНС
          MsgBox SAVE_STATUS_SUCCESS, vbInformation, SAVE_MESSAGE_TITLE
        End If
        
    End If
    
    On Error GoTo errHandler
    
    Dim status As Integer
    status = wb.CustomDocumentProperties("Status")
    If status > 2 Then
      MsgBox "Документ подписан ЭЦП и не может быть изменен", vbExclamation + vbOKOnly, ThisWorkbook.name
      Cancel = True
      Exit Sub
    End If

    

    Exit Sub
errHandler:
    MsgBox Err.Description, vbOKOnly + vbExclamation, ThisWorkbook.name
    
End Sub

Private Sub Workbook_Open()
  
  Application.Calculation = xlCalculationAutomatic ' чтобы пересчет формул осуществлялся автоматически
  Application.ReferenceStyle = xlA1 ' стиль ссылок - A1
  ThisWorkbook.CustomDocumentProperties("Status") = 1 'ТРАНС
  
  Dim wsSheet As Worksheet
  
  If Len(CStr(Me.Names("region_name").RefersToRange.cells(1, 1).Value)) = 0 Then
    For Each wsSheet In Me.Worksheets
      If wsSheet.Visible = True Then
        If wsSheet.Tab.ColorIndex = colorPaleBlue Then
          wsSheet.Visible = xlSheetVeryHidden
        End If
      End If
    Next wsSheet
  End If

End Sub

Attribute VB_Name = "modChange"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Option Base 1
Option Explicit

' Инструкция
Public Sub WsInstrChange(Target As Range)
  If Target.Interior.ColorIndex = colorYellow Then
    Application.ThisWorkbook.Sheets(gstrHelpSheetName).cmdApplyContactChanges.Enabled = True
    Application.ThisWorkbook.Sheets(gstrHelpSheetName).cmdApplyContactChanges.Visible = True
  End If
End Sub

' Титульный
Public Sub WsTitChange(Target As Range)
  On Error GoTo ErrWsTitChange
  
  Dim wbBook As Workbook
  
  Dim wsTechSheet As Worksheet
  Dim wsSheet As Worksheet
  Dim wsTempSheet As Worksheet
    
  Dim intCounter As Integer
  Dim intVisibleSheetArray As Integer     ' отображать /-1/ или нет /2/ листы /заданные списком/
  Dim intNumStartRowForCheck As Integer
  Dim intNumEndRowForCheck As Integer
  
  Dim strMOName As String
  Dim strMRName As String
  Dim strOKTMOValue As String
  Dim strNameSheetArra
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.