Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 7a517c8722a81f7e…

MALICIOUS

Office (OOXML)

20.6 KB Created: 2021-07-11 09:14:00 UTC Authoring application: Microsoft Office Word 16.0000
MD5: 49a230d0f9e680e37c6e23eb4a60d1d3 SHA-1: 077ddc6c17aa8a2951db28d2a2de659efd351398 SHA-256: 7a517c8722a81f7e56e208ff8ecff0a47942866d016b52025866a1c8c7910c9d
182 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file is a malicious OOXML document containing VBA macros, as indicated by multiple high and critical heuristic firings including ClamAV detections. The presence of an AutoOpen macro and the structure of the VBA code suggest it is designed to execute automatically upon opening. The script's use of Windows API functions like CreateProcess and Heap manipulation points towards its intent to download and execute a second-stage payload, making it a typical macro-based downloader.

Heuristics 5

  • ClamAV: Doc.Malware.Valyria-10015188-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Valyria-10015188-0
  • ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV
    ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • VBA project inside OOXML medium OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas
    • http://schemas.microsoft.com/office/drawing/2014/chartex
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartex
    • http://schemas.microsoft.com/office/drawing/2015/10/21/chartex
    • http://schemas.microsoft.com/office/drawing/2016/5/9/chartex
    • http://schemas.microsoft.com/office/drawing/2016/5/10/chartex
    • http://schemas.microsoft.com/office/drawing/2016/5/11/chartex
    • http://schemas.microsoft.com/office/drawing/2016/5/12/chartex
    • http://schemas.microsoft.com/office/drawing/2016/5/13/chartex
    • http://schemas.microsoft.com/office/drawing/2016/5/14/chartex
    • http://schemas.openxmlformats.org/markup-compatibility/2006
    • http://schemas.microsoft.com/office/drawing/2016/ink
    • http://schemas.microsoft.com/office/drawing/2017/model3d
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships
    • http://schemas.openxmlformats.org/officeDocument/2006/math
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawing
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawing
    • http://schemas.openxmlformats.org/wordprocessingml/2006/main
    • http://schemas.microsoft.com/office/word/2010/wordml
    • http://schemas.microsoft.com/office/word/2012/wordml
    • http://schemas.microsoft.com/office/word/2018/wordml/cex
    • http://schemas.microsoft.com/office/word/2016/wordml/cid
    • http://schemas.microsoft.com/office/word/2018/wordml
    • http://schemas.microsoft.com/office/word/2015/wordml/symex
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroup
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInk
    • http://schemas.microsoft.com/office/word/2006/wordml
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShape

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
8ee8128a3a60d2e3f32cea830233aaf3e5f201d54b517c3205b1bb6611991c9b		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 4466 bytes
vbaProject_00.bin
f46a51b84e99b44a1295a9d96d8959bedbea85e35f01b427bfba9072255d286d		 vba-project OOXML VBA project: word/vbaProject.bin 21504 bytes
Detection
ClamAV: Doc.Malware.Valyria-10015188-0
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.