Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 8ec2c9be110267eb…

MALICIOUS

Office (OOXML)

98.9 KB Created: 2011-08-19 01:06:52 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2021-05-23
MD5: e132523e237ca0dba27cb1335a45ac51 SHA-1: 10f89f017eb49ed9f2fb1a57aef0570c6a3b91a1 SHA-256: 8ec2c9be110267eb97c7bfdad78d51051b7d83e56fbc0f42efc1b281a7a0df43
188 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file is identified as malicious by ClamAV with the signature Xls.Virus.Valyria-10004391-0. Static analysis revealed the presence of a VBA project with an Auto_Open macro, indicating that malicious code is likely executed upon opening the document. The VBA code itself is heavily commented out and truncated, making it difficult to determine the exact payload, but the presence of an Auto_Open macro strongly suggests an attempt to download and execute a secondary stage.

Heuristics 4

  • ClamAV: Xls.Virus.Valyria-10004391-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Virus.Valyria-10004391-0
  • VBA project inside OOXML medium 1 related finding OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Auto_Open macro high OLE_VBA_AUTO
    Auto_Open macro
  • Hidden worksheet (hidden, veryHidden) low OOXML_HIDDEN_SHEET
    Excel workbook contains 3 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction

Extracted artifacts 8

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 21585 bytes
SHA-256: 80f64198d420d899934c503d1c9b06f7fe3f13770e74eee66bd8c5698d4851cb
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Control = "DeloitteDAEMSClientUIWorkingPapersCPP1, 2, 0, DeloitteDAEMSClientUIWorkingPapersCPPLib, DeloitteDAEMSClientUIWorkingPapersCPP"
Private Sub Worksheet_Change(ByVal Target As Range)   'IFRIC19P Extinguishing Financial
                                                      '  Liabilities with Equity Instruments
Dim thecurrentcell

thecurrentcell = ActiveCell.AddressLocal

' Check if Additional Guidance was requested (Show/Hide button)

If thecurrentcell = "$B$6" Then

    x = Sheets("Sliding Scale").Cells(27, 1)
    'Application.ScreenUpdating = False
'    ActiveSheet.Unprotect ("level1") 'JB: commented out 12/17/11
'    With Range("B7")
''       .Interior.ColorIndex = 40
''       .Borders(xlTop).LineStyle = xlNone
''       .ClearContents
''       .Locked = True
'    End With
'    With Range("Factor")  'JB: commented out 12/17/11
'        .Interior.ColorIndex = xlNone
'        .Locked = False
'    End With
'    With Range("E7")  'JB: commented out 12/17/11
'        .Interior.ColorIndex = xlNone
'        .Locked = False
'    End With
   ' With Range("E9")
   '     .Interior.ColorIndex = xlNone
   '     .Locked = False
   ' End With
   ' With Range("E13")
   '     .Interior.ColorIndex = xlNone
   '     .Locked = False
   ' End With
    'With Range("E14")
    '    .Interior.ColorIndex = xlNone
    '    .Locked = False
    'End With

Application.EnableEvents = False 'switch off events trapping

  If ActiveCell.Value = "Profit before tax" Then
     ActiveSheet.Cells(7, 1) = ""
            ActiveSheet.Cells(9, 4) = "The range that is often used for listed entities is 5% to 10%. Other percentages may be used based on the professional judgment of the engagement partner."
            With Range("B7")
                    .Interior.Color = RGB(182, 221, 232)
                    .Locked = True
            End With
            With Range("C7")
                    .Interior.Color = RGB(182, 221, 232)
                    .Locked = True
            End With
  ElseIf ActiveCell.Value = "Other" Then
  ActiveSheet.Cells(7, 1) = "Specify other benchmark:"
            ActiveSheet.Cells(9, 4) = "Enter factor based on professional judgment."
 '           Range("C7").Interior.ColorIndex = xlNone
            With Range("B7")
                    .Interior.ColorIndex = xlNone
                    .Locked = False
                    With .Borders(xlTop)
                        .Weight = xlThin
                        .ColorIndex = xlAutomatic
                    End With
            End With
            With Range("C7")
                    .Interior.Color = RGB(182, 221, 232)
                   ' .Interior.ColorIndex = xlNone
                    .Locked = False
                    With .Borders(xlTop)
                        .Weight = xlThin
                        .ColorIndex = xlAutomatic
                    End With
            End With
  Else
     ActiveSheet.Cells(7, 1) = ""
            ActiveSheet.Cells(9, 4) = "Enter factor based on professional judgment."
            With Range("B7")
                    .Interior.Color = RGB(182, 221, 232)
                    .Locked = True
            End With
            With Range("C7")
                    .Interior.Color = RGB(182, 221, 232)
                    .Locked = True
            End With
   
    
 End If

'ActiveSheet.Protect ("level1")   'JB: commented out 12/17/11

Application.EnableEvents =
... (truncated)
vbaProject_00.bin vba-project OOXML VBA project: xl/vbaProject.bin 78848 bytes
SHA-256: ff80a7663b49f40b89c9bee15fbfd8660ede404ad4f57adc50dd1568e3db2e02
Detection
ClamAV: Xls.Virus.Valyria-10004391-0
Obfuscation or payload: unlikely
emf_00.emf ooxml-emf OOXML EMF part: xl/media/image1.emf 2484 bytes
SHA-256: 46656c23a2e93b35871191e5e492bd7e99be8de6ed23eecd20b9db17fb29e23d
emf_01.emf ooxml-emf OOXML EMF part: xl/media/image2.emf 2484 bytes
SHA-256: d999d5f909f20281b0056439017d759686cb1eaacb194b57c1726789e179d0b6
emf_02.emf ooxml-emf OOXML EMF part: xl/media/image3.emf 2484 bytes
SHA-256: 905e8a08e6fc3214486febf6c36ce86ef3c476a628d3a565d473651b83c52f27
emf_03.emf ooxml-emf OOXML EMF part: xl/media/image5.emf 2484 bytes
SHA-256: 102d450f7740cfd61ab0e42a640fa416f813f021f845b6b40f72feef21c6afb8
emf_04.emf ooxml-emf OOXML EMF part: xl/media/image4.emf 2532 bytes
SHA-256: 7187d9c8cd09ce216ca3b3ac7b74a57f82aea79f3e5ebd03b3fe7fb8cac9af57
emf_05.emf ooxml-emf OOXML EMF part: xl/media/image6.emf 1948 bytes
SHA-256: 299d685fc828a8ebcda433d1308289469054bb533ccbd0da6983a6fb609f4c31

Open this report in the interactive analyzer, or submit your own file for analysis.