IcedID Office (OOXML) malware analysis — malicious · 9d66c49d31592905

MALICIOUS

Office (OOXML)

34.4 KB Created: 2021-10-21 10:36:00 UTC Authoring application: Microsoft Office Word 16.0000

MD5: 3e187481fff85f49047cf28e4009c708 SHA-1: 8e74fbbd8cea47919960dfb0fea0a67c8d021e6b SHA-256: 9d66c49d31592905cbc49d204d84127d4b2f5e4e355c3d8bfb189d2a5b4eff25

162 Risk Score

Malware Insights

IcedID · confidence 95%

MITRE ATT&CK

T1059.005 Visual Basic T1204.002 Malicious File

The sample is identified as malicious by ClamAV with the signature 'Doc.Downloader.IcedID'. The presence of an AutoOpen VBA macro, which is designed to execute automatically when the document is opened, strongly suggests malicious intent. The VBA code attempts to construct a command using a reversed document property and then executes it using 'Shell', likely to download and run a secondary payload. This behavior is characteristic of IcedID malware.

Heuristics 5

ClamAV: Doc.Downloader.IcedID-8ff0f02ff0876072-9950256-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Downloader.IcedID-8ff0f02ff0876072-9950256-0
AutoOpen macro high OLE_VBA_AUTOOPEN

AutoOpen macro
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
VBA project inside OOXML medium OOXML_VBA

Document contains a VBA project — VBA macros present
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas
- http://schemas.microsoft.com/office/drawing/2014/chartex
- http://schemas.microsoft.com/office/drawing/2015/9/8/chartex
- http://schemas.microsoft.com/office/drawing/2015/10/21/chartex
- http://schemas.microsoft.com/office/drawing/2016/5/9/chartex
- http://schemas.microsoft.com/office/drawing/2016/5/10/chartex
- http://schemas.microsoft.com/office/drawing/2016/5/11/chartex
- http://schemas.microsoft.com/office/drawing/2016/5/12/chartex
- http://schemas.microsoft.com/office/drawing/2016/5/13/chartex
- http://schemas.microsoft.com/office/drawing/2016/5/14/chartex
- http://schemas.openxmlformats.org/markup-compatibility/2006
- http://schemas.microsoft.com/office/drawing/2016/ink
- http://schemas.microsoft.com/office/drawing/2017/model3d
- http://schemas.openxmlformats.org/officeDocument/2006/relationships
- http://schemas.openxmlformats.org/officeDocument/2006/math
- http://schemas.microsoft.com/office/word/2010/wordprocessingDrawing
- http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawing
- http://schemas.openxmlformats.org/wordprocessingml/2006/main
- http://schemas.microsoft.com/office/word/2010/wordml
- http://schemas.microsoft.com/office/word/2012/wordml
- http://schemas.microsoft.com/office/word/2018/wordml/cex
- http://schemas.microsoft.com/office/word/2016/wordml/cid
- http://schemas.microsoft.com/office/word/2018/wordml
- http://schemas.microsoft.com/office/word/2015/wordml/symex
- http://schemas.microsoft.com/office/word/2010/wordprocessingGroup
- http://schemas.microsoft.com/office/word/2010/wordprocessingInk
- http://schemas.microsoft.com/office/word/2006/wordml
- http://schemas.microsoft.com/office/word/2010/wordprocessingShape

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `86943533ccdad2fa50d10bc5748d41c3d2545d9f63618b43132b36dff41afb55`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	895 bytes
`vbaProject_00.bin` `0fd83a831a3f9f0b18656b02ca05bd7db12c53d319f9ae08faf45537e08143b1`	vba-project	OOXML VBA project: word/vbaProject.bin	15360 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.