Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 c3d364aae14741ea…

MALICIOUS

Office (OOXML)

255.0 KB Created: 2019-01-28 15:00:04 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2021-10-14
MD5: 629c04acc096aff63fc2d4568a3222f7 SHA-1: 0c2d954a7c0af97af7e1e1248c9e79fee43794ca SHA-256: c3d364aae14741ea2a97bae94c245dc1fe5b52c4eaa9b64828933072d707c55f
108 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is an OOXML file containing a VBA project with an Auto_Open macro, indicating malicious intent. The presence of hidden sheets and an external relationship to a local XLS file suggests an attempt to conceal or stage malicious activity. The VBA macro is likely responsible for executing the malicious payload, potentially downloading additional content from the referenced external relationship.

Heuristics 4

  • External relationship high OOXML_EXTERNAL_REL
    External target in xl/externalLinks/_rels/externalLink3.xml.rels: file:///\\전용철\포천송우수량\hb\삼산1지구(실시)\주공수량\일위대가9803.xls
  • VBA project inside OOXML medium 1 related finding OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Auto_Open macro high OLE_VBA_AUTO
    Auto_Open macro
  • Hidden worksheet (hidden, veryHidden) low OOXML_HIDDEN_SHEET
    Excel workbook contains 2 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 11061 bytes
SHA-256: 169d6a6297bca3b23a93491df29c77f75f6ca2f323c658d3814b51130b5c4794
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Module1"

Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Trang_t¨ªnh2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Trang_t¨ªnh4"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet47"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Trang_t¨ªnh18"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet35"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Module2"
Sub KTHH_HG()
Attribute KTHH_HG.VB_ProcData.VB_Invoke_Func = " \n14"
    Range("S38:V52").Select
    Selection.Copy
    Range("M38").Select
    Selection.PasteSpecial Paste:=xlPasteValues, Operation:=xlNone, SkipBlanks _
        :=False, Transpose:=False
    Application.CutCopyMode = False
    Range("Q38").Select
    ActiveSheet.Range("$B$38:$D$54").AutoFilter Field:=1, Criteria1:="<>"
End Sub
Sub CD_DAY_HG()
Attribute CD_DAY_HG.VB_ProcData.VB_Invoke_Func = " \n14"
    Range("S41:U55").Select
    Selection.Copy
    Range("K41:M41").Select
    Selection.PasteSpecial Paste:=xlPasteValues, Operation:=xlNone, SkipBlanks _
        :=False, Transpose:=False
       Application.CutCopyMode = False
    Range("R42").Select
     ActiveSheet.Range("$Q$41:$Q$56").AutoFilter Field:=1, Criteria1:="ok"
End Sub
Sub KTHH_HM_C()
Attribute KTHH_HM_C.VB_ProcData.VB_Invoke_Func = " \n14"
    Range("R42").Select
    ActiveWindow.SmallScroll Down:=27
    Range("R42:U70").Select
    Selection.Copy
    ActiveWindow.SmallScroll Down:=-21
    Range("M42").Select
    Selection.PasteSpecial Paste:=xlPasteValues, Operation:=xlNone, SkipBlanks _
        :=False, Transpose:=False
    Application.CutCopyMode = False
    Range("Q43").Select
End Sub
Sub KTHH_HM_C_HIDE()
Attribute KTHH_HM_C_HIDE.VB_ProcData.VB_Invoke_Func = " \n14"
    Range("Q42").Select
    ActiveSheet.Range("$Q$41:$Q$70").AutoFilter Field:=1, Criteria1:="ok"
End Sub
Sub CD_BTL_C()
    Range("S41:u55").Select
    Selection.Copy
    Range("M41").Select
    Selection.PasteSpecial Paste:=xlPasteValues, Operation:=xlNone, SkipBlanks _
        :=False, Transpose:=False
    Application.CutCopyMode = False
    Range("Q41").Select
    ActiveSheet.Range("$q$41:$q$55").AutoFilter Field:=1, Criteria1:="ok"
End Sub


Attribute VB_Name = "Module4"
Sub LIST()
Attribute LIST.VB_ProcData.VB_Invoke_Func = 
... (truncated)
vbaProject_00.bin vba-project OOXML VBA project: xl/vbaProject.bin 52224 bytes
SHA-256: 767e5b38261f5c67699653cc02204dfffa6f4415029346e193e814f2b99df9d0

Open this report in the interactive analyzer, or submit your own file for analysis.