Malicious Office (OOXML) / .DOC — malware analysis report

Heuristics 18

• Shell() call in VBA critical OLE_VBA_SHELL
  Shell() call in VBA
• WScript.Shell usage critical OLE_VBA_WSCRIPT
  WScript.Shell usage
• VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC
  VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
• Dangerous API name reassembled from split string literals critical OLE_VBA_SPLIT_KEYWORD_OBFUSCATION
  VBA concatenates short string literals that reassemble a dangerous API/ProgID/LOLBin name (e.g. Scripting.FileSystemObject, WScript.Shell, powershell, URLDownloadToFile) which appears in no single literal. Splitting an API name across string concatenation is done only to evade keyword scanning.
• ClamAV: Doc.Downloader.Generic-6698421-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Doc.Downloader.Generic-6698421-0
• ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV
  ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
• AutoOpen macro high OLE_VBA_AUTOOPEN
  AutoOpen macro
• Workbook_Open macro high OLE_VBA_WBOPEN
  Workbook_Open macro
• Auto_Open macro high OLE_VBA_AUTO
  Auto_Open macro
• CreateObject call high OLE_VBA_CREATEOBJ
  CreateObject call
• GetObject call high OLE_VBA_GETOBJ
  GetObject call
• VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
  Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
• VBA project inside OOXML medium OOXML_VBA
  Document contains a VBA project — VBA macros present
• Macro/content-enable lure medium SE_ENABLE_LURE
  Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
• Environ() call (env variable access) low OLE_VBA_ENVIRON
  Environ() call (env variable access)
• External hyperlinks (1) low OOXML_EXTERNAL_HYPERLINKS
  Document contains 1 external hyperlink — clickable URLs are stored as external relationships. First target: http://office365.com/
• Fake invoice / payment lure low SE_INVOICE_LURE
  Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas

  • http://schemas.openxmlformats.org/markup-compatibility/2006
  • http://schemas.openxmlformats.org/officeDocument/2006/relationships
  • http://schemas.openxmlformats.org/officeDocument/2006/math
  • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawing
  • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawing
  • http://schemas.openxmlformats.org/wordprocessingml/2006/main
  • http://schemas.microsoft.com/office/word/2010/wordml
  • http://schemas.microsoft.com/office/word/2012/wordml
  • http://schemas.microsoft.com/office/word/2010/wordprocessingGroup
  • http://schemas.microsoft.com/office/word/2010/wordprocessingInk
  • http://schemas.microsoft.com/office/word/2006/wordml
  • http://schemas.microsoft.com/office/word/2010/wordprocessingShape
  • http://office365.com/

Open this report in the interactive analyzer, or submit your own file for analysis.