Malicious Office (OOXML) / .DOC — malware analysis report

Static analysis result for SHA-256 48d000ff9202665a…

MALICIOUS

Office (OOXML) / .DOC

2.24 MB Created: 2022-08-11 16:47:00 UTC Authoring application: Microsoft Office Word 14.0000 First seen: 2022-08-12
MD5: 4c66399b646680189f8c63eb7b68ace6 SHA-1: 07925be44e99413905226022053545217c9b8d5e SHA-256: 48d000ff9202665a6ceb03d8ef0fe9e1ddc82c9fff1e346c6f7db418588c6d0b
302 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.001 PowerShell T1204.002 Malicious File T1140 Deobfuscate or Obfuscate T1027 Obfuscated Files or Information

The sample is an OOXML document containing a VBA project with a Document_Open macro. This macro is designed to execute shellcode loaded from document properties, specifically reading reversed configuration from properties named 'NEdclKnuo' and 'vbCTqLk0NTIeW'. The document body explicitly instructs the user to enable macros, indicating a social engineering lure to bypass security measures.

Heuristics 9

  • VBA property-stored shellcode loader critical OLE_VBA_PROPERTY_SHELLCODE_LOADER
    VBA auto-exec macro takes the address (VarPtr) of a byte buffer decoded from a document property, marks memory executable (VirtualProtect/VirtualAlloc), and transfers control through a callback API (e.g. SetTimer/EnumWindows). The payload is hidden in the document properties rather than the macro source — the SVCReady loader pattern, a native shellcode runner rather than a parser CVE.
  • VBA project part renamed to evade filename detection high OOXML_VBA_PROJECT_RENAMED
    The VBA project is bound through the OOXML relationship/content type but its part is not named vbaProject.bin. Legitimate Office producers always emit vbaProject.bin; renaming it hides the macros from path-only scanners (observed in the SVCReady loader).
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
  • CallByName call high OLE_VBA_CALLBYNAME
    CallByName call
  • VBA reads reversed config from document properties high OLE_VBA_REVERSED_DOCPROP_CONFIG
    VBA applies StrReverse to values read from the document's custom/built-in properties. Storing reversed configuration (URLs, CLSIDs, env-var names, payload names) in document properties keeps indicators out of the macro source — an obfuscation technique used by the SVCReady loader.
  • VBA project inside OOXML medium OOXML_VBA
    Document contains a VBA project — VBA macros present (project part renamed away from vbaProject.bin: word/JldokThJwz.bin)
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas
    • http://schemas.openxmlformats.org/markup-compatibility/2006
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships
    • http://schemas.openxmlformats.org/officeDocument/2006/math
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawing
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawing
    • http://schemas.openxmlformats.org/wordprocessingml/2006/main
    • http://schemas.microsoft.com/office/word/2010/wordml
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroup
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInk
    • http://schemas.microsoft.com/office/word/2006/wordml
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShape

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
e8f95ebbb757df05edc7c3654656b9b53fa13b5be768ddcb0024f77d5acd00a7		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 21664 bytes
vbaProject_00.bin
18c36c8d1a70fb233fcaa4489ac6626117fc74689fb8c3f53ed30e0559f1767c		 vba-project OOXML VBA project: word/JldokThJwz.bin 15360 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.