Malicious Office (OOXML) / .DOC — malware analysis report

Static analysis result for SHA-256 6c2a461a9082f0b2…

MALICIOUS

Office (OOXML) / .DOC

126.2 KB Created: 2020-09-11 10:24:00 UTC Authoring application: Microsoft Office Word 16.0000
MD5: 98dc4c1c4bd13b7af7a42616adc95512 SHA-1: f7d7c5fd1baa8eebcd2fac2af94709e6546da7e8 SHA-256: 6c2a461a9082f0b2ceef42588c4568620f0ab3ae934c6d20ae8b5f8908bc64ec
382 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1218.011 System Binary Proxy Execution: Rundll32

The sample is a malicious Office document containing VBA macros. The AutoOpen macro triggers the execution of code that utilizes WScript.Shell and the Shell() function. This indicates the macro is designed to download and execute a secondary payload, consistent with a dropper malware.

Heuristics 9

  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
  • ClamAV: Doc.Dropper.Mrdy-9758475-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Mrdy-9758475-0
  • ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV
    ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • VBA project inside OOXML medium OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas
    • http://schemas.microsoft.com/office/drawing/2014/chartex
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartex
    • http://schemas.microsoft.com/office/drawing/2015/10/21/chartex
    • http://schemas.microsoft.com/office/drawing/2016/5/9/chartex
    • http://schemas.microsoft.com/office/drawing/2016/5/10/chartex
    • http://schemas.microsoft.com/office/drawing/2016/5/11/chartex
    • http://schemas.microsoft.com/office/drawing/2016/5/12/chartex
    • http://schemas.microsoft.com/office/drawing/2016/5/13/chartex
    • http://schemas.microsoft.com/office/drawing/2016/5/14/chartex
    • http://schemas.openxmlformats.org/markup-compatibility/2006
    • http://schemas.microsoft.com/office/drawing/2016/ink
    • http://schemas.microsoft.com/office/drawing/2017/model3d
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships
    • http://schemas.openxmlformats.org/officeDocument/2006/math
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawing
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawing
    • http://schemas.openxmlformats.org/wordprocessingml/2006/main
    • http://schemas.microsoft.com/office/word/2010/wordml
    • http://schemas.microsoft.com/office/word/2012/wordml
    • http://schemas.microsoft.com/office/word/2016/wordml/cid
    • http://schemas.microsoft.com/office/word/2015/wordml/symex
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroup
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInk
    • http://schemas.microsoft.com/office/word/2006/wordml
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShape

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
f519c5abc49e19ba4695be152583e713ae40a3d7009493fc3c16daf6bc8524c7		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 12125 bytes
vbaProject_00.bin
ca320bc797c4c76043be0e686624f08fb150063833597257f75cb70043c354bd		 vba-project OOXML VBA project: word/vbaProject.bin 44544 bytes
Detection
ClamAV: Doc.Dropper.Mrdy-9758475-0
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.