Malicious Office (OOXML) / .OLE — malware analysis report

Static analysis result for SHA-256 70f61a0649bdf592…

MALICIOUS

Office (OOXML) / .OLE

89.9 KB Created: 2020-06-15 04:36:45 UTC Authoring application: Microsoft Excel 16.0300
MD5: bbea3fa7c4e8668124d7d8f8e0800bb8 SHA-1: 00c19da7b7805de215c6193b611c3906ea77e20a SHA-256: 70f61a0649bdf59239f4e789021e707fd14e40e290e8735ff48fdff5ac000d92
384 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.001 PowerShell T1105 Ingress Tool Transfer T1204.002 Malicious File

The sample contains a VBA macro with an Auto_Open subroutine that utilizes WScript.Shell to execute a Base64-decoded PowerShell command. This command downloads a file named 'uhuhuy.exe' from 'http://bcmbconsulting.com/wp-content/plugins/uhuhuy.exe' to the temporary directory as 'rt.exe' and then executes it. This indicates a downloader or droppper functionality.

Heuristics 10

  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
  • VBA Base64-decoded Shell command stager critical OLE_VBA_BASE64_SHELL_COMMAND_STAGER
    VBA auto-exec macro decodes Base64 string literals into command or script-launch text and executes the result with Shell. This catches cmd/cscript/PowerShell/VBS launchers hidden from plain keyword matching.
  • Dangerous API name reassembled from split string literals critical OLE_VBA_SPLIT_KEYWORD_OBFUSCATION
    VBA concatenates short string literals that reassemble a dangerous API/ProgID/LOLBin name (e.g. Scripting.FileSystemObject, WScript.Shell, powershell, URLDownloadToFile) which appears in no single literal. Splitting an API name across string concatenation is done only to evade keyword scanning.
  • Auto_Open macro high OLE_VBA_AUTO
    Auto_Open macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • VBA project inside OOXML medium OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://bcmbconsulting.com/wp-content/plugins/uhuhuy.exe

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
f73b6100fc4c85ec00f50d0aebc89e9ee145db763367bf0a334f93d8744ff0e8		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 4340 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 long base64-like blob(s).
vbaProject_00.bin
c0eff3529960804657dd45fdc44c89d13d2975b5341f08725b435bdb0e06d795		 vba-project OOXML VBA project: xl/vbaProject.bin 21504 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 long base64-like blob(s).

Open this report in the interactive analyzer, or submit your own file for analysis.