Office (OOXML) / .DOC malware analysis — malicious · 5f057426c2556956

MALICIOUS

Office (OOXML) / .DOC

211.7 KB Created: 2021-02-07 17:10:00 UTC Authoring application: Microsoft Office Word 16.0000

MD5: ccc252df3db14bf7c1a1a1a8ff610b84 SHA-1: 861b425171be9e0780168f74e116cce0a91f13f0 SHA-256: 5f057426c2556956425ce0d19002e72801c0b2faa72b775490d6565146120b4a

262 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1105 Ingress Tool Transfer T1204.002 Malicious File

The sample contains VBA macros that are automatically executed via the AutoOpen subroutine. These macros utilize CreateObject and Shell() calls to download a file from 'https://statting.bar/header.jpg' and save it as 'C:\users\Public\deli.png', which is then likely executed. This indicates a downloader or droppper functionality.

Heuristics 7

Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA
VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC

VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
AutoOpen macro high OLE_VBA_AUTOOPEN

AutoOpen macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
VBA project inside OOXML medium OOXML_VBA

Document contains a VBA project — VBA macros present
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas
- http://schemas.microsoft.com/office/drawing/2014/chartex
- http://schemas.microsoft.com/office/drawing/2015/9/8/chartex
- http://schemas.microsoft.com/office/drawing/2015/10/21/chartex
- http://schemas.microsoft.com/office/drawing/2016/5/9/chartex
- http://schemas.microsoft.com/office/drawing/2016/5/10/chartex
- http://schemas.microsoft.com/office/drawing/2016/5/11/chartex
- http://schemas.microsoft.com/office/drawing/2016/5/12/chartex
- http://schemas.microsoft.com/office/drawing/2016/5/13/chartex
- http://schemas.microsoft.com/office/drawing/2016/5/14/chartex
- http://schemas.openxmlformats.org/markup-compatibility/2006
- http://schemas.microsoft.com/office/drawing/2016/ink
- http://schemas.microsoft.com/office/drawing/2017/model3d
- http://schemas.openxmlformats.org/officeDocument/2006/relationships
- http://schemas.openxmlformats.org/officeDocument/2006/math
- http://schemas.microsoft.com/office/word/2010/wordprocessingDrawing
- http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawing
- http://schemas.openxmlformats.org/wordprocessingml/2006/main
- http://schemas.microsoft.com/office/word/2010/wordml
- http://schemas.microsoft.com/office/word/2012/wordml
- http://schemas.microsoft.com/office/word/2016/wordml/cid
- http://schemas.microsoft.com/office/word/2015/wordml/symex
- http://schemas.microsoft.com/office/word/2010/wordprocessingGroup
- http://schemas.microsoft.com/office/word/2010/wordprocessingInk
- http://schemas.microsoft.com/office/word/2006/wordml
- http://schemas.microsoft.com/office/word/2010/wordprocessingShape

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `077ee87a887ea44a446dd4d1c422ac9e6d1c0d7c9fcd4125f334f074ed9a4d98`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	2538 bytes
`vbaProject_00.bin` `926deaa461b164bf5a68cb0c84d6c4020a6c85d062a411edc7c104ccede5f3d4`	vba-project	OOXML VBA project: word/vbaProject.bin	92672 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.