MALICIOUS
196
Risk Score
Heuristics 6
-
VBA project inside OOXML medium 5 related findings OOXML_VBADocument contains a VBA project — VBA macros present
-
Potential Shell call in VBA critical OLE_VBA_SHELLPotential Shell call in VBAMatched line in script
l = Shell(f, 0) -
Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADERAuto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.Matched line in script
' MkDir через Application.Run -
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXECTriggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
-
Workbook_Open macro low OLE_VBA_WBOPENWorkbook_Open macroMatched line in script
Private Sub Workbook_Open() -
Auto_Open macro low OLE_VBA_AUTOAuto_Open macroMatched line in script
Sub Auto_Open()
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source from OOXML) | 4268 bytes |
SHA-256: 746347a45974f95cba22fd20dc54ebae3f6e14d77648b39efe719cf9848757ef |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "ЭтаКнига"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Private Sub Workbook_Open()
A "Workbook_Open"
End Sub
Private Sub Workbook_Activate()
A "Workbook_Activate"
End Sub
Private Sub Workbook_BeforeClose(Cancel As Boolean)
A "Workbook_BeforeClose"
End Sub
Attribute VB_Name = "Лист1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Name = "Module1"
Sub A(t As String)
On Error GoTo X
Dim b, c, d, e, f, g, h, i, j, k, l, m
' Обфусцированный путь C:\temp
b = Chr(67) & Chr(58) & Chr(92) & Chr(116) & Chr(101) & Chr(109) & Chr(112)
' MkDir через Application.Run
On Error Resume Next
Application.Run Chr(77) & Chr(107) & Chr(68) & Chr(105) & Chr(114), b
On Error GoTo X
' Обфусцированный timestamp
c = Format(Now, "yyyymmdd_hhmmss")
' Обфусцированные имена файлов
d = Chr(114) & Chr(117) & Chr(110) & Chr(95) & Chr(115) & Chr(121) & Chr(115) & Chr(105) & Chr(110) & Chr(102) & Chr(111) & Chr(95)
e = Chr(46) & Chr(98) & Chr(97) & Chr(116)
f = b & Chr(92) & d & c & e
g = Chr(115) & Chr(121) & Chr(115) & Chr(116) & Chr(101) & Chr(109) & Chr(105) & Chr(110) & Chr(102) & Chr(111) & Chr(95) & Chr(111) & Chr(117) & Chr(116) & Chr(112) & Chr(117) & Chr(116) & Chr(95)
h = b & Chr(92) & g & c & Chr(46) & Chr(116) & Chr(120) & Chr(116)
i = Chr(101) & Chr(120) & Chr(101) & Chr(99) & Chr(95) & Chr(108) & Chr(111) & Chr(103) & Chr(95)
j = b & Chr(92) & i & c & Chr(46) & Chr(116) & Chr(120) & Chr(116)
' Создаём .bat файл (обфусцированное содержимое)
k = FreeFile
Open f For Output As #k
Print #k, Chr(64) & Chr(101) & Chr(99) & Chr(104) & Chr(111) & Chr(32) & Chr(111) & Chr(102) & Chr(102)
Print #k, Chr(115) & Chr(121) & Chr(115) & Chr(116) & Chr(101) & Chr(109) & Chr(105) & Chr(110) & Chr(102) & Chr(111) & Chr(32) & Chr(62) & Chr(32) & h
Close #k
' Запускаем .bat через Shell (обфусцированно)
l = Shell(f, 0)
' Проверяем результат
If l <> 0 Then
m = Chr(85) & Chr(83) & Chr(105) & Chr(109) & Chr(112) & Chr(108) & Chr(101) & Chr(32) & Chr(45) & Chr(32) & Chr(80) & Chr(73) & Chr(68) & Chr(58) & Chr(32) & l
Else
m = Chr(70) & Chr(65) & Chr(73) & Chr(76) & Chr(32) & Chr(45) & Chr(32) & Chr(83) & Chr(104) & Chr(101) & Chr(108) & Chr(108) & Chr(32) & Chr(101) & Chr(114) & Chr(114) & Chr(111) & Chr(114)
End If
' Пишем лог
Open j For Output As #k + 1
Print #k + 1, Chr(61) & Chr(61) & Chr(61) & Chr(32) & Chr(66) & Chr(65) & Chr(84) & Chr(32) & Chr(76) & Chr(79) & Chr(71) & Chr(32) & Chr(61) & Chr(61) & Chr(61)
Print #k + 1, Chr(84) & Chr(114) & Chr(105) & Chr(103) & Chr(103) & Chr(101) & Chr(114) & Chr(58) & Chr(32) & t
Print #k + 1, Chr(84) & Chr(105) & Chr(109) & Chr(101) & Chr(58) & Chr(32) & Now
Print #k + 1, Chr(66) & Chr(97) & Chr(116) & Chr(32) & Chr(112) & Chr(97) & Chr(116) & Chr(104) & Chr(58) & Chr(32) & f
Print #k + 1, Chr(82) & Chr(101) & Chr(115) & Chr(117) & Chr(108) & Chr(116) & Chr(58) & Chr(32) & m
Print #k + 1, Chr(79) & Chr(117) & Chr(116) & Chr(112) & Chr(117) & Chr(116) & Chr(32) & Chr(102) & Chr(105) & Chr(108) & Chr(101) & Chr(58) & Chr(32) & h
Close #k + 1
Exit Sub
X:
' Логируем ошибку
On Error Resume Next
Open j For Output As #99
Print #99, Chr(69) & Chr(82) & Chr(82) & Chr(79) & Chr(82) & Chr(58) & Chr(32) & Err.Number & Chr(32) & Err.Description
Close #99
End Sub
Sub Auto_Open()
A "Auto_Open"
End Sub
|
|||
vbaProject_00.bin |
vba-project | OOXML VBA project: xl/vbaProject.bin | 18432 bytes |
SHA-256: b503fb103b5e9dd13bd92479f02426caf8035827d966e03e117ab4eedce2b483 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.