Malicious Office (OOXML) / .DOC — malware analysis report

Static analysis result for SHA-256 7ed7f3591ed5a7db…

MALICIOUS

Office (OOXML) / .DOC

2.21 MB Created: 2022-08-11 13:53:00 UTC Authoring application: Microsoft Office Word 14.0000 First seen: 2022-08-11
MD5: 5e9c39bed106be63c45581464ab03a26 SHA-1: 3fa2186ad239b0ee822759d372dfd04da78c1507 SHA-256: 7ed7f3591ed5a7db3e12df16c9625bdc0367ebd5d6aab6d83a98bd5e40bf288f
362 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1059.001 PowerShell T1105 Ingress Tool Transfer T1027 Obfuscated Files or Information T1140 Deobfuscate/Decode Files or Information

The sample is an OOXML document containing a VBA project with a Document_Open macro. This macro utilizes a VBA property-stored shellcode loader, reading configuration from document properties and using CallByName and GetObject to execute shellcode in memory. The document body explicitly instructs the user to 'Enable editing' and 'Enable content', a common lure for macro-based malware.

Heuristics 10

  • VBA property-stored shellcode loader critical OLE_VBA_PROPERTY_SHELLCODE_LOADER
    VBA auto-exec macro takes the address (VarPtr) of a byte buffer decoded from a document property, marks memory executable (VirtualProtect/VirtualAlloc), and transfers control through a callback API (e.g. SetTimer/EnumWindows). The payload is hidden in the document properties rather than the macro source — the SVCReady loader pattern, a native shellcode runner rather than a parser CVE.
  • ClamAV: Doc.Downloader.8a5a5aca5aca5a7a-OOXML-9981537-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.8a5a5aca5aca5a7a-OOXML-9981537-0
  • VBA project part renamed to evade filename detection high OOXML_VBA_PROJECT_RENAMED
    The VBA project is bound through the OOXML relationship/content type but its part is not named vbaProject.bin. Legitimate Office producers always emit vbaProject.bin; renaming it hides the macros from path-only scanners (observed in the SVCReady loader).
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
  • CallByName call high OLE_VBA_CALLBYNAME
    CallByName call
  • VBA reads reversed config from document properties high OLE_VBA_REVERSED_DOCPROP_CONFIG
    VBA applies StrReverse to values read from the document's custom/built-in properties. Storing reversed configuration (URLs, CLSIDs, env-var names, payload names) in document properties keeps indicators out of the macro source — an obfuscation technique used by the SVCReady loader.
  • VBA project inside OOXML medium OOXML_VBA
    Document contains a VBA project — VBA macros present (project part renamed away from vbaProject.bin: word/tEFWCrqbgD.bin)
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas
    • http://schemas.openxmlformats.org/markup-compatibility/2006
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships
    • http://schemas.openxmlformats.org/officeDocument/2006/math
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawing
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawing
    • http://schemas.openxmlformats.org/wordprocessingml/2006/main
    • http://schemas.microsoft.com/office/word/2010/wordml
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroup
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInk
    • http://schemas.microsoft.com/office/word/2006/wordml
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShape

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
81d0d279d960d30249ac0db31aaeca7b1b2e20a6f2cd297cc1755051ffbd97e5		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 22531 bytes
vbaProject_00.bin
c8f1f6f26b9725dc38208cb1b3d59dfa28c626a6a69da1f1b04232c979f47fa8		 vba-project OOXML VBA project: word/tEFWCrqbgD.bin 14848 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.