Malicious Office (OOXML) / .DOC — malware analysis report

Static analysis result for SHA-256 c6cbc213f529652f…

MALICIOUS

Office (OOXML) / .DOC

2.19 MB Created: 2022-08-11 14:49:00 UTC Authoring application: Microsoft Office Word 14.0000 First seen: 2022-08-11
MD5: 37851e2a0454dd3c2d680f910b8f2473 SHA-1: 65fef3047aa4f8a3c42574ea77e8c3353a878614 SHA-256: c6cbc213f529652f90e41e84f13eb55cb276691df931bb0a668b5b376ee907a9
362 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.001 PowerShell T1204.002 Malicious File T1140 Deobfuscate or Obfuscate

The sample is an OOXML document containing a VBA project with a Document_Open macro. This macro utilizes GetObject and CallByName functions, along with reading reversed configuration from document properties, to load and execute shellcode. The document body explicitly instructs the user to 'Enable editing' and 'Enable content', a common lure for macro-based malware. The presence of a VBA macro that loads shellcode strongly indicates a downloader or initial access payload.

Heuristics 10

  • VBA property-stored shellcode loader critical OLE_VBA_PROPERTY_SHELLCODE_LOADER
    VBA auto-exec macro takes the address (VarPtr) of a byte buffer decoded from a document property, marks memory executable (VirtualProtect/VirtualAlloc), and transfers control through a callback API (e.g. SetTimer/EnumWindows). The payload is hidden in the document properties rather than the macro source — the SVCReady loader pattern, a native shellcode runner rather than a parser CVE.
  • ClamAV: Doc.Downloader.af2f0393915c6ce8-OOXML-9981526-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.af2f0393915c6ce8-OOXML-9981526-0
  • VBA project part renamed to evade filename detection high OOXML_VBA_PROJECT_RENAMED
    The VBA project is bound through the OOXML relationship/content type but its part is not named vbaProject.bin. Legitimate Office producers always emit vbaProject.bin; renaming it hides the macros from path-only scanners (observed in the SVCReady loader).
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
  • CallByName call high OLE_VBA_CALLBYNAME
    CallByName call
  • VBA reads reversed config from document properties high OLE_VBA_REVERSED_DOCPROP_CONFIG
    VBA applies StrReverse to values read from the document's custom/built-in properties. Storing reversed configuration (URLs, CLSIDs, env-var names, payload names) in document properties keeps indicators out of the macro source — an obfuscation technique used by the SVCReady loader.
  • VBA project inside OOXML medium OOXML_VBA
    Document contains a VBA project — VBA macros present (project part renamed away from vbaProject.bin: word/eEyCMkgeBK.bin)
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas
    • http://schemas.openxmlformats.org/markup-compatibility/2006
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships
    • http://schemas.openxmlformats.org/officeDocument/2006/math
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawing
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawing
    • http://schemas.openxmlformats.org/wordprocessingml/2006/main
    • http://schemas.microsoft.com/office/word/2010/wordml
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroup
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInk
    • http://schemas.microsoft.com/office/word/2006/wordml
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShape

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
484db26b8fcc2a35dfa0ce89fa175cd1ef6b2940ccc84078d9423fc1ed6887dd		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 20502 bytes
vbaProject_00.bin
e12f6a68e15ec149f13d6919700d6398ce12af3e9b7009d07e9ae798480d4283		 vba-project OOXML VBA project: word/eEyCMkgeBK.bin 14848 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.