Office (OOXML) malware analysis — malicious · 3f66ae350a150d25

MALICIOUS

Office (OOXML)

14.3 KB Created: 2020-12-31 18:58:34 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2021-01-15

MD5: dafb2917e7e0a69bb5831ace2c5ee008 SHA-1: 8e68dc47428be2bca370021440dd3441f2e7ae63 SHA-256: 3f66ae350a150d25f44c4b4ef683f43d2a2e1ec452c708a3ee158cad85d67ff5

156 Risk Score

Heuristics 5

VBA project inside OOXML medium 4 related findings OOXML_VBA

Document contains a VBA project — VBA macros present
Potential Shell call in VBA critical OLE_VBA_SHELL

Potential Shell call in VBA
Matched line in script
```
malshell = Shell(malstring, vbHide)
```

PowerShell reference in VBA critical OLE_VBA_PS

PowerShell reference in VBA

Matched line in script

malstring = "IEX AutoOpen Auto_Open powershell.exe DownloadFile DownloadStirng Invoke-ReflectivePEInjection ReadAllBytes"

AutoOpen macro low OLE_VBA_AUTOOPEN

AutoOpen macro

Matched line in script

malstring = "IEX AutoOpen Auto_Open powershell.exe DownloadFile DownloadStirng Invoke-ReflectivePEInjection ReadAllBytes"

Auto_Open macro low OLE_VBA_AUTO

Auto_Open macro

Matched line in script

malstring = "IEX AutoOpen Auto_Open powershell.exe DownloadFile DownloadStirng Invoke-ReflectivePEInjection ReadAllBytes"

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	958 bytes
SHA-256: `ab349d8434d4f5a74cea4fae55b58934b92abc08633e182a04d292e93ff89d88`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "Module1" Sub Rectangle1_Click() Dim malstring As String Dim malshell As Double malstring = "IEX AutoOpen Auto_Open powershell.exe DownloadFile DownloadStirng Invoke-ReflectivePEInjection ReadAllBytes" malshell = Shell(malstring, vbHide) ' consider this a malicious program, those strings will trigger many avs.. End Sub Attribute VB_Name = "ThisWorkbook" Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Attribute VB_Name = "Sheet1" Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True
`vbaProject_00.bin`	vba-project	OOXML VBA project: xl/vbaProject.bin	14848 bytes
SHA-256: `3cb665d817d444a9eda771e8c622152822eb8b760c29a6a800da46db110f9e22`

Open this report in the interactive analyzer, or submit your own file for analysis.