Office (OOXML) / .DOC malware analysis — malicious · 08b4d55e1eb7681f

MALICIOUS

Office (OOXML) / .DOC

72.1 KB Created: 2020-09-10 09:44:00 UTC Authoring application: Microsoft Office Word 16.0000

MD5: c6d08368e2e295d963a68d8845461621 SHA-1: cbba5675c42764d3d33aca6f57e6336f76116e6a SHA-256: 08b4d55e1eb7681faeb49ebe73da5262f5d3cb54f281eba1a405e0d1128a19e2

222 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1204.002 Malicious File

The sample is an OOXML document containing a VBA macro. The AutoOpen macro triggers the execution of the main subroutine, which in turn calls the Shell() function. This indicates the document is designed to execute arbitrary commands, likely to download and run a secondary payload. ClamAV also identified this as a downloader.

Heuristics 6

Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA
ClamAV: Doc.Downloader.835b97208387fc57-OOXML-9981517-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Downloader.835b97208387fc57-OOXML-9981517-0
AutoOpen macro high OLE_VBA_AUTOOPEN

AutoOpen macro
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
VBA project inside OOXML medium OOXML_VBA

Document contains a VBA project — VBA macros present
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas
- http://schemas.microsoft.com/office/drawing/2014/chartex
- http://schemas.microsoft.com/office/drawing/2015/9/8/chartex
- http://schemas.microsoft.com/office/drawing/2015/10/21/chartex
- http://schemas.microsoft.com/office/drawing/2016/5/9/chartex
- http://schemas.microsoft.com/office/drawing/2016/5/10/chartex
- http://schemas.microsoft.com/office/drawing/2016/5/11/chartex
- http://schemas.microsoft.com/office/drawing/2016/5/12/chartex
- http://schemas.microsoft.com/office/drawing/2016/5/13/chartex
- http://schemas.microsoft.com/office/drawing/2016/5/14/chartex
- http://schemas.openxmlformats.org/markup-compatibility/2006
- http://schemas.microsoft.com/office/drawing/2016/ink
- http://schemas.microsoft.com/office/drawing/2017/model3d
- http://schemas.openxmlformats.org/officeDocument/2006/relationships
- http://schemas.openxmlformats.org/officeDocument/2006/math
- http://schemas.microsoft.com/office/word/2010/wordprocessingDrawing
- http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawing
- http://schemas.openxmlformats.org/wordprocessingml/2006/main
- http://schemas.microsoft.com/office/word/2010/wordml
- http://schemas.microsoft.com/office/word/2012/wordml
- http://schemas.microsoft.com/office/word/2016/wordml/cid
- http://schemas.microsoft.com/office/word/2015/wordml/symex
- http://schemas.microsoft.com/office/word/2010/wordprocessingGroup
- http://schemas.microsoft.com/office/word/2010/wordprocessingInk
- http://schemas.microsoft.com/office/word/2006/wordml
- http://schemas.microsoft.com/office/word/2010/wordprocessingShape
- http://ns.adobe.com/xap/1.0/
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/sType/ResourceEvent#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/photoshop/1.0/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `11eafa394b3dc3a730dd0fe37433894c62c556e78b4d3ee165739928e7d30967`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	7500 bytes
`vbaProject_00.bin` `326e58f929ab384ae6a6cbe1f2dd7b5a13a92bab62a18ae3dc093d0c915e72e2`	vba-project	OOXML VBA project: word/vbaProject.bin	30720 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.