Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 a23fb32089c456c4…

MALICIOUS

Office (OOXML)

36.9 KB Created: 2014-08-18 12:00:00 UTC Authoring application: Microsoft Office Word 12.0000 First seen: 2021-09-16
MD5: a82eed800c96b0a1d03b421251d1c959 SHA-1: 540c6eb77aaef83139948b5db63df623ee025e52 SHA-256: a23fb32089c456c48a28ea310246d651a023f36f1547636818b517fab6dd2e37
262 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample is a malicious OOXML document containing a VBA macro. The Document_Open macro attempts to execute a second-stage payload by importing a script from the registry path 'T:\Oracle\autoexec.bas' and then running it. This indicates a downloader or dropper functionality.

Heuristics 7

  • VBA project inside OOXML medium 5 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/markup-compatibility/2006 In document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)

Related samples 1

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 4818 bytes
SHA-256: ae9e35df19cf3d0f2949c9c700f8d4a5bd684ba6fd62591bf1a9aa74a808e85b
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_Open()

Call RecupAdresseBase

'Le document est-il au bon emplacement (ex: T:\Oracle)
DebutAdresseDossierProjet = RecupParametre("DebutAdresseDossierProjet")
If Left(Documents(ActiveDocument.Name).Path, Len(DebutAdresseDossierProjet)) <> DebutAdresseDossierProjet Then
    Exit Sub
End If

AdresseFichierAutoexecBAS = RecupParametre("AdresseFichierAutoexecBAS")

'Si le module existe pas d'erreur on va a exit sub (Pas de chargement pas de mise a jour du contenu du document) ; si il n'existe pas erreur on va a suite puis on charge le module puis on met a jour le contenu du document
On Error GoTo Suite:
NomModule = ThisDocument.VBProject.VBComponents("autoexec").Name
Exit Sub
Suite:

ThisDocument.VBProject.VBComponents.Import (AdresseFichierAutoexecBAS)

'Macro qui execute automatiquement une macro chargée dans le module:
autoexec    'on est obligé de sortir de la procédure pour que le module chargé soit pris en compte.

End Sub

Sub autoexec()
    Autolancement
End Sub

Sub RecupAdresseBase()

'Lecture base de registre
NomAppli = "BaseSQL"  'Nom de l'application
NomSection = "Adresse"  'Nom de la section
NomClef1 = "strDBpath" 'Nom de la Clef
NomClef2 = "TableParametres" 'Nom de la Clef
strDBpath = GetSetting(appname:=NomAppli, Section:=NomSection, Key:=NomClef1)
NomTable = GetSetting(appname:=NomAppli, Section:=NomSection, Key:=NomClef2)

'Si base de registre pas vide test de connexion a SQL avec ces données
If strDBpath <> "" And NomTable <> "" Then
    Result = TestAccesSQL(strDBpath, NomTable)
    If Result = True Then
        Exit Sub 'Si Ok sortie de la fonction
    End If
End If
'Si pas OK continuation

'Lecture Active directory
Set objShell = CreateObject("WScript.shell")
Application.ScreenUpdating = False
Set objExec = objShell.Exec("nslookup -q=txt enpisparam")
Application.ScreenUpdating = True
Reponse = Split(objExec.StdOut.ReadAll, vbCrLf)
Set objExec = Nothing
Set objShell = Nothing

'Manipulation variable
VariableA = Right(Reponse(5), Len(Reponse(5)) - 2)
VariableB = Left(VariableA, Len(VariableA) - 1)
ElementConnexion = Split(VariableB, ".")
strDBpath = "Provider=sqloledb; Data Source=" & ElementConnexion(0) & "; Initial Catalog=" & ElementConnexion(1) & "; Integrated Security=SSPI "
NomTable = ElementConnexion(2)

'Ecriture base de registre
SaveSetting appname:=NomAppli, Section:=NomSection, Key:=NomClef1, setting:=strDBpath
SaveSetting appname:=NomAppli, Section:=NomSection, Key:=NomClef2, setting:=NomTable

'Lecture base de registre pour test apres écriture
strDBpath = GetSetting(appname:=NomAppli, Section:=NomSection, Key:=NomClef1)
NomTable = GetSetting(appname:=NomAppli, Section:=NomSection, Key:=NomClef2)

'Nouveau test de connexion a SQL
Result = TestAccesSQL(strDBpath, NomTable)
If Result = False Then
    MsgBox "Connexion a SQL server impossible, merci de fermer cette application.", vbCritical
End If

End Sub

Function TestAccesSQL(strDBpath, NomTable)

'Test connexion a SQL server

On Error GoTo Fin

Dim cnn As ADODB.Connection
Set cnn = New ADODB.Connection
  
cnn.Open strDBpath

Dim rst As ADODB.Recordset
Set rst = New ADODB.Recordset
StrTable = "SELECT Top 1 Valeur FROM " & NomTable
rst.Open StrTable, cnn, adOpenKeyset, adLockOptimistic
With rst
    If Not .EOF Then
        A = ![Valeur]
    End If
End With
rst.Close

Set rst = Nothing
cnn.Close
Set cnn = Nothing

TestAccesSQL = True
Exit Function
Fin:
TestAccesSQL = False

End Function

Function RecupParametre(NomParametre)
'LangueStandard = RecupParametre("LangueStandard")

RecupParametre = ""
If NomParametre = "" Then Exit Function

'Lecture base de registre
NomAppli = "BaseSQL"  'Nom de l'application
NomSection = "Adresse" 
... (truncated)
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 30720 bytes
SHA-256: 7eb739fc0365cc8f6f85036548b1dcbfa3659c299bdd46177d4d287699a97fa3

Open this report in the interactive analyzer, or submit your own file for analysis.