Malicious Office (OOXML) / .DOC — malware analysis report

Static analysis result for SHA-256 65efa1b16d7331e6…

MALICIOUS

Office (OOXML) / .DOC

88.4 KB Created: 2021-01-22 09:40:00 UTC Authoring application: Microsoft Office Word 16.0000
MD5: 56f405d5389268d2017175868f347f6d SHA-1: ab079f9c6d56ac6244fd9edf6cf5f728a2d3e177 SHA-256: 65efa1b16d7331e60747007d025b96c6e5fcd0cd9f381f9ef748ab41be8eec5a
322 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample contains VBA macros with an AutoOpen subroutine that utilizes WScript.Shell and the Shell() function, indicating it is designed to execute arbitrary commands. The presence of these critical heuristics strongly suggests the document's purpose is to download and execute a secondary payload, characteristic of a dropper malware.

Heuristics 8

  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
  • ClamAV: Doc.Dropper.Generic-9823794-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Generic-9823794-0
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • VBA project inside OOXML medium OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://38ctrade7.com/assets/c64b78c73c7c94599c62e7/b139c2/8be/raynock14?vidzm=7acd5c5&kyjbh=f34d9afdf6&df=cee17d871e93c7e&utwoo=b28827902bb6&ceds=75c6a213fccb47e&vkq_x=1ab663a16d&makxt=48f60b6f
    • http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas
    • http://schemas.microsoft.com/office/drawing/2014/chartex
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartex
    • http://schemas.microsoft.com/office/drawing/2015/10/21/chartex
    • http://schemas.microsoft.com/office/drawing/2016/5/9/chartex
    • http://schemas.microsoft.com/office/drawing/2016/5/10/chartex
    • http://schemas.microsoft.com/office/drawing/2016/5/11/chartex
    • http://schemas.microsoft.com/office/drawing/2016/5/12/chartex
    • http://schemas.microsoft.com/office/drawing/2016/5/13/chartex
    • http://schemas.microsoft.com/office/drawing/2016/5/14/chartex
    • http://schemas.openxmlformats.org/markup-compatibility/2006
    • http://schemas.microsoft.com/office/drawing/2016/ink
    • http://schemas.microsoft.com/office/drawing/2017/model3d
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships
    • http://schemas.openxmlformats.org/officeDocument/2006/math
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawing
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawing
    • http://schemas.openxmlformats.org/wordprocessingml/2006/main
    • http://schemas.microsoft.com/office/word/2010/wordml
    • http://schemas.microsoft.com/office/word/2012/wordml
    • http://schemas.microsoft.com/office/word/2016/wordml/cid
    • http://schemas.microsoft.com/office/word/2015/wordml/symex
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroup
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInk
    • http://schemas.microsoft.com/office/word/2006/wordml
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShape
    • http://ns.adobe.com/xap/1.0/
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/photoshop/1.0/
    • http://www.w3.org/1999/XSL/Transform
    • https://microsoft.com/xxx

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
e4dc60cb9983e517e9e6d326ebd148a173bc4ffb767cd611dfbf6fd93b323bf5		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 5485 bytes
vbaProject_00.bin
58c1dc81fa059895a37637692cd8596cbdef4271e1ee7755080de56caff8356a		 vba-project OOXML VBA project: word/vbaProject.bin 30720 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.