MalwareBazaar Database

Office OLE Information

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

OLE id

OLE dump

MalwareBazaar was able to identify 10 sections in this file using oledump:

OLE vba

MalwareBazaar was able to extract and deobfuscate VBA script(s) the following information from OLE objects embedded in this file using olevba:

Intelligence

File Origin

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Exploit.Siggen2.65103.5603.10574.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

DNS request

Creating a file

Creating a process with a hidden window

Running batch commands

Launching a process

Sending an HTTP GET request

Launching a file downloaded from the Internet

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Creating a process from a recently created file

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

Legacy Excel File with Macro

Link:

https://app.docguard.net/374b9d2287355b2bce9eafdbb30745c48ebd5debcb37ec4e87c91957c2195e68/results/dashboard

Payload URLs

URL

File name

http://sparepartiran.com/js/s0/SD-1061.jpg

ThisWorkbook

Document image

Image:

Download PNG

InQuest SUSPICIOUS

Result

Verdict:

SUSPICIOUS

Details

Macro with Startup Hook

Detected macro logic that will automatically execute on document open. Most malware contains some execution hook.

Macro Contains Suspicious String

Detected a macro with a suspicious string. Suspicious strings include privileged function calls, obfuscations, odd registry keys, etc...

Macro with DLL Reference

Detected macro logic that will load additional functionality from Dynamically Linked Libraries (DLLs). While not explicitly malicious, this is a common tactic for accessing APIs that are not otherwised exposed via Visual Basic for Applications (VBA).

Joe Sandbox AgentTesla

Result

Threat name:

AgentTesla

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/532398

Signature

.NET source code contains very large array initializations

Allocates memory in foreign processes

Creates an autostart registry key pointing to binary in C:\Windows

Document contains an embedded VBA macro which may execute processes

Document contains an embedded VBA macro with suspicious strings

Document exploit detected (creates forbidden files)

Document exploit detected (drops PE files)

Document exploit detected (process start blacklist hit)

Document exploit detected (UrlDownloadToFile)

Downloads files with wrong headers with respect to MIME Content-Type

Drops PE files to the user root directory

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Office process drops PE file

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Executables Started in Suspicious Folder

Sigma detected: Execution in Non-Executable Folder

Sigma detected: MS Office Product Spawning Exe in User Dir

Sigma detected: Office product drops executable at suspicious location

Sigma detected: Suspicious Program Location Process Starts

Writes to foreign memory regions

Yara detected AgentTesla

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/374b9d2287355b2bce9eafdbb30745c48ebd5debcb37ec4e87c91957c2195e68/

ReversingLabs TitaniumCloud Script.Trojan.Heuristic

Threat name:

Script.Trojan.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2020-11-12 01:50:11 UTC

AV detection:

18 of 29 (62.07%)

Threat level:

  2/5

Spamhaus Hash Blocklist Malicious file

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=g5fz2iuhgvnsxtu6v7n3gb2fyshl2xplzm36ytuhzemvpqqzlzua._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

persistence

Link:

https://tria.ge/reports/201112-h7ahw5njk6/

Behaviour

Enumerates system info in registry

Modifies Internet Explorer settings

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Checks processor information in registry

Suspicious use of FindShellTrayWindow

Office loads VBA resources, possible macro or embedded object present

Suspicious use of SetThreadContext

Adds Run key to start application

Loads dropped DLL

Drops file in Drivers directory

Executes dropped EXE

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments