Malicious Office (OLE) / .XLS — malware analysis report

Static analysis result for SHA-256 b0bc54c847d176de…

MALICIOUS

Office (OLE) / .XLS

105.0 KB Created: 2022-09-21 18:37:34 Authoring application: Microsoft Excel First seen: 2022-09-22
MD5: a7af335a57f5ebce9880de291cc6fbf2 SHA-1: 5aec9aaca0aa44a7986f58e4c3b0b2f8ebe7a1a5 SHA-256: b0bc54c847d176de306e4c7b5b33422525788fa8dfeae43a1a45b1c58c063f8f
340 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.001 PowerShell T1218.011 Signed Binary Proxy Execution: Rundll32 T1105 Ingress Tool Transfer

The VBA macro contains an Auto_Open subroutine that is designed to execute malicious code. It attempts to download a payload from the URL 'http://justictl.com/resource/exe.ssres' using a reconstructed 'WScript.Shell' object and likely leverages 'certutil' for execution. The obfuscation and use of LOLBins indicate a downloader or droppper functionality.

Heuristics 8

  • LOLBin reference in VBA critical OLE_VBA_LOLBIN
    LOLBin reference in VBA
  • Dangerous API name reassembled from split string literals critical OLE_VBA_SPLIT_KEYWORD_OBFUSCATION
    VBA concatenates short string literals that reassemble a dangerous API/ProgID/LOLBin name (e.g. Scripting.FileSystemObject, WScript.Shell, powershell, URLDownloadToFile) which appears in no single literal. Splitting an API name across string concatenation is done only to evade keyword scanning.
  • Reference to certutil (download/decode) high SC_STR_CERTUTIL
    Reference to certutil (download/decode)
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Auto_Open macro high OLE_VBA_AUTO
    Auto_Open macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
670672fcd053d1bbe60aea9c68c16875b04f909ad9cb474fcade5d0d3b609896		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 7373 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.