Malicious Office (OOXML) / .DOC — malware analysis report

Static analysis result for SHA-256 687ef4d92cb4d16e…

MALICIOUS

Office (OOXML) / .DOC

18.1 KB Created: 2022-05-10 12:20:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2022-05-10
MD5: eb365ac8f9b6198e0d63d001e538a1cd SHA-1: 0682a189112d1a2106a13dc645e58225262997c6 SHA-256: 687ef4d92cb4d16e2abae42dc2c42cbeca899ad6ac80be1523608844f96b6236
122 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.001 PowerShell T1204.002 Malicious File

The sample is an OOXML document containing a VBA project with an AutoOpen macro. This macro references and executes PowerShell, indicating it's likely used to download and execute a second-stage payload. The presence of the AutoOpen macro and the PowerShell execution strongly suggest malicious intent.

Heuristics 4

  • PowerShell reference in VBA critical OLE_VBA_PS
    PowerShell reference in VBA
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • VBA project inside OOXML medium OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://46.4.198.55/10P/book.ps1
    • http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas
    • http://schemas.microsoft.com/office/drawing/2014/chartex
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartex
    • http://schemas.microsoft.com/office/drawing/2015/10/21/chartex
    • http://schemas.microsoft.com/office/drawing/2016/5/9/chartex
    • http://schemas.microsoft.com/office/drawing/2016/5/10/chartex
    • http://schemas.microsoft.com/office/drawing/2016/5/11/chartex
    • http://schemas.microsoft.com/office/drawing/2016/5/12/chartex
    • http://schemas.microsoft.com/office/drawing/2016/5/13/chartex
    • http://schemas.microsoft.com/office/drawing/2016/5/14/chartex
    • http://schemas.openxmlformats.org/markup-compatibility/2006
    • http://schemas.microsoft.com/office/drawing/2016/ink
    • http://schemas.microsoft.com/office/drawing/2017/model3d
    • http://schemas.microsoft.com/office/2019/extlst
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships
    • http://schemas.openxmlformats.org/officeDocument/2006/math
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawing
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawing
    • http://schemas.openxmlformats.org/wordprocessingml/2006/main
    • http://schemas.microsoft.com/office/word/2010/wordml
    • http://schemas.microsoft.com/office/word/2012/wordml
    • http://schemas.microsoft.com/office/word/2018/wordml/cex
    • http://schemas.microsoft.com/office/word/2016/wordml/cid
    • http://schemas.microsoft.com/office/word/2018/wordml
    • http://schemas.microsoft.com/office/word/2020/wordml/sdtdatahash
    • http://schemas.microsoft.com/office/word/2015/wordml/symex
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroup
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInk
    • http://schemas.microsoft.com/office/word/2006/wordml
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShape

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
eb9cc6bc09bd6d95dca47c9a8df43ceac3dc5995eec2209cee8ddb83ac01f96c		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 2454 bytes
vbaProject_00.bin
6b23921b36626147b7ac41617e82a7a94c63dc4ed73c1a7b9f953908f4ec46a9		 vba-project OOXML VBA project: word/vbaProject.bin 13312 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.