Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 76de46d9e17f86c8…

MALICIOUS

Office (OLE)

1.04 MB Created: 2004-05-21 07:18:45 Authoring application: Microsoft Excel First seen: 2019-10-29
MD5: 6dfa5857d4da9b50fc2b7eefea235062 SHA-1: 5ec2bfac29008529f7c86d02ea5045f84197272d SHA-256: 76de46d9e17f86c8ebb5a283f351c3ae7540a4454f3ca12895c0c0bc616e73b0
144 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file is an Excel document with a Workbook_Open macro that uses CreateObject and XMLHTTP, indicating it attempts to download and execute a secondary payload. The macro is obfuscated, and the document body contains Russian text related to regional data submission, suggesting a targeted lure. The presence of CreateObject and XMLHTTP strongly suggests the VBA code is attempting to download and execute a second-stage payload from one of the embedded URLs.

Heuristics 6

  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Workbook_Open macro high OLE_VBA_WBOPEN
    Workbook_Open macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://eias.ru/?page=show_distrs In document text (OLE body)
    • http://eias.ru/YIn document text (OLE body)
    • https://tariff.eias.ru/procwsxls/In document text (OLE body)
    • http://www.fstrf.ru/regions/region/showlistIn document text (OLE body)
    • http://www.alrosa.ru/about/production/social/rikk/2012/�In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 589553 bytes
SHA-256: 2192cbcf8f7240c419d7613f8ded00f9435936677d64bd11d91cdab8bbc537e0
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ЭтаКнига"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Option Explicit

Private Const SAVE_STATUS_CRITICAL_IMPACT_WARNING As String = "Шаблон будет сохранен, но НЕ БУДЕТ принят к рассмотрению из-за невыполнения ОБЯЗАТЕЛЬНЫХ условий! См. лист 'Проверка'!"
Private Const SAVE_STATUS_SUCCESS As String = "Шаблон готов к сохранению без замечаний"
Private Const SAVE_STATUS_LOW_IMPACT_WARNING As String = "Шаблон будет принят к рассмотрению, но обратите внимание НЕВЫПОЛНЕНИЕ ПРЕДУПРЕДИТЕЛЬНЫХ условий на листе 'Проверка'"
Private Const SAVE_MESSAGE_TITLE As String = "Результат проверки"

Private Sub Workbook_BeforeSave(ByVal SaveAsUI As Boolean, Cancel As Boolean)

    Application.Calculate
    
    Dim wsActiveSheet As Worksheet
    
    Set wb = Application.ThisWorkbook
    Set wsActiveSheet = wb.ActiveSheet
    
    If Len(CStr(Me.Names("region_name").RefersToRange.Value)) > 0 Then
        modPROV.WarningsBeforeSaving Me
              
        If modPROV.gintCriticalImpactWarningsCounter > 0 Then
          Me.CustomDocumentProperties("Status") = 1 'ТРАНС
          MsgBox SAVE_STATUS_CRITICAL_IMPACT_WARNING, vbCritical + vbOKOnly, SAVE_MESSAGE_TITLE
          Me.Worksheets("Проверка").Activate
        ElseIf modPROV.gintLowImpactWarningsCounter > 0 Then
          Me.CustomDocumentProperties("Status") = 1 'ТРАНС
          MsgBox SAVE_STATUS_LOW_IMPACT_WARNING, vbExclamation + vbOKOnly, SAVE_MESSAGE_TITLE
          Me.Worksheets("Проверка").Activate
        Else 'ТРАНС
          Me.CustomDocumentProperties("Status") = 2 'ТРАНС
          MsgBox SAVE_STATUS_SUCCESS, vbInformation, SAVE_MESSAGE_TITLE
          wsActiveSheet.Activate
        End If
        
    End If
    
    On Error GoTo ErrHandler
    
    Dim status As Integer
    status = wb.CustomDocumentProperties("Status")
    If status > 2 Then
      MsgBox "Документ подписан ЭЦП и не может быть изменен", vbExclamation + vbOKOnly, ThisWorkbook.name
      Cancel = True
      Exit Sub
    End If

    

    Exit Sub
ErrHandler:
    MsgBox Err.Description, vbOKOnly + vbExclamation, ThisWorkbook.name
    
End Sub

Private Sub Workbook_Open()
  
  Application.Calculation = xlCalculationAutomatic ' чтобы пересчет формул осуществлялся автоматически
  Application.ReferenceStyle = xlA1 ' стиль ссылок - A1
  ThisWorkbook.CustomDocumentProperties("Status") = 1 'ТРАНС
  
  Dim wsSheet As Worksheet
  
  If Len(CStr(Me.Names("region_name").RefersToRange.cells(1, 1).Value)) = 0 Then
    For Each wsSheet In Me.Worksheets
      If wsSheet.Visible = True Then
        If wsSheet.Tab.ColorIndex = colorPaleBlue Then
          wsSheet.Visible = xlSheetVeryHidden
        End If
      End If
    Next wsSheet
  End If

End Sub

Attribute VB_Name = "modChange"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Option Base 1
Option Explicit

' Инструкция
Public Sub WsInstrChange(Target As Range)
  If Target.Interior.ColorIndex = colorYellow Then
    Application.ThisWorkbook.Sheets(gstrInstructionSheetName).cmdApplyContactChanges.Enabled = True
    Application.ThisWorkbook.Sheets(gstrInstructionSheetName).cmdApplyContactChanges.Visible = True
  End If
End Sub

' Титульный
Public Sub WsTitChange(Target As Range)
  On Error GoTo ErrWsTitChange
  
  Dim wbBook As Workbook
  
  Dim wsTechSheet As Worksheet
  Dim wsSheet As Worksheet
  Dim wsTempSheet As Worksheet
  Dim wsHypSheet As Worksheet
  Dim wsCommentsSheet As Worksheet
    
  Dim intCounter As Integer
  Dim intVisibleSheetArray As Integer     ' отображать /-1/ или нет /2/ листы /заданные списком/
 
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.