Malicious Office (OOXML) / .DOC — malware analysis report

Static analysis result for SHA-256 c790e3e220afd233…

MALICIOUS

Office (OOXML) / .DOC

255.4 KB Created: 2022-09-14 14:25:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2022-09-26
MD5: 2405aebd21e51ecf9828e58663ee226d SHA-1: 020ead3bdb205559c429c18b5c5069ce8290077d SHA-256: c790e3e220afd233162afc836e261c797af48a4bab8618cd5e99f6cffc59889e
162 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File Execution: Malicious File T1059.005 Command and Scripting Interpreter: Visual Basic

The sample is an OOXML document that leverages CVE-2017-0199 to load an external OLE object. This object contains a VBA macro project that attempts to download a payload from http://www.driverg00le.blogspot.com/atom.xml. The embedded OLE object also references a URL for a secondary payload, https://www.mediafire.com/file/b47o6ywc112qioo/tax_file_loading.doc/file.

Heuristics 5

  • OOXML OLE2Link remote loader — CVE-2017-0199 related high CVE related CVE_2017_0199_RELATED
    Document contains an o:OLEObject Type=Link whose external oleObject relationship points to a remote URL. This is the OOXML OLE2Link activation shape associated with CVE-2017-0199 delivery, but the local file does not expose URL Moniker bytes or a weaponized extension/content type, so the exact CVE cannot be proven statically.
  • Embedded Office object carries macros critical OFFICE_EMBEDDED_MACRO_OBJECT
    This document embeds a second Office file that itself contains a VBA macro project or an Excel 4.0 (XLM) macro sheet. Hiding a macro-bearing workbook or document inside another document — frequently under an obfuscated, non-standard part name — is a macro-smuggling technique that defeats scanners which only inspect the outer document's macro storage. No benign authoring workflow stages a hidden macro project this way.
  • External OLE object relationship high OOXML_EXTERNAL_OLE_OBJECT
    Document contains an oleObject relationship whose target is an external HTTP(S) URL. Office resolves this through OLE/object update paths rather than as a normal user-clicked hyperlink.
  • Embedded OLE object medium OOXML_OLE_OBJECT
    Document contains an embedded OLE object
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://www.mediafire.com/file/b47o6ywc112qioo/tax_file_loading.doc/file
    • http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas
    • http://schemas.microsoft.com/office/drawing/2014/chartex
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartex
    • http://schemas.microsoft.com/office/drawing/2015/10/21/chartex
    • http://schemas.microsoft.com/office/drawing/2016/5/9/chartex
    • http://schemas.microsoft.com/office/drawing/2016/5/10/chartex
    • http://schemas.microsoft.com/office/drawing/2016/5/11/chartex
    • http://schemas.microsoft.com/office/drawing/2016/5/12/chartex
    • http://schemas.microsoft.com/office/drawing/2016/5/13/chartex
    • http://schemas.microsoft.com/office/drawing/2016/5/14/chartex
    • http://schemas.openxmlformats.org/markup-compatibility/2006
    • http://schemas.microsoft.com/office/drawing/2016/ink
    • http://schemas.microsoft.com/office/drawing/2017/model3d
    • http://schemas.microsoft.com/office/2019/extlst
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships
    • http://schemas.openxmlformats.org/officeDocument/2006/math
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawing
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawing
    • http://schemas.openxmlformats.org/wordprocessingml/2006/main
    • http://schemas.microsoft.com/office/word/2010/wordml
    • http://schemas.microsoft.com/office/word/2012/wordml
    • http://schemas.microsoft.com/office/word/2018/wordml/cex
    • http://schemas.microsoft.com/office/word/2016/wordml/cid
    • http://schemas.microsoft.com/office/word/2018/wordml
    • http://schemas.microsoft.com/office/word/2020/wordml/sdtdatahash
    • http://schemas.microsoft.com/office/word/2015/wordml/symex
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroup
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInk
    • http://schemas.microsoft.com/office/word/2006/wordml
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShape
    • http://www.driverg00le.blogspot.com/atom.xml

Extracted artifacts 7

Files carved from inside the sample during analysis.

FilenameKindSourceSize
ooxml_oleobject_00.bin
5506c427b3f3b56fe9908227579a3cec2b6581ffe39aaa03903d3c1d70e09913		 ooxml-ole-object OOXML embedded OLE part: word/embeddings/nigggger6.ms-excel 65024 bytes
ooxml_oleobject_01.bin
67904bb8b019589106ec201cdf557cd97f27050508bf4e02ab14bd6aa5ad896f		 ooxml-ole-object OOXML embedded OLE part: word/embeddings/nigggger1.ms-excel 65024 bytes
ooxml_oleobject_02.bin
0481d25cfcf64fb009d7db17f7748b1b22b71003838216cdc9fd27adeda17988		 ooxml-ole-object OOXML embedded OLE part: word/embeddings/nigggger5.ms-excel 65024 bytes
ooxml_oleobject_03.bin
88c2963338ac6092e40ea91b28d4a581c9aae12387348ba3530184971d7a9e28		 ooxml-ole-object OOXML embedded OLE part: word/embeddings/nigggger.ms-excel 65024 bytes
ooxml_oleobject_04.bin
c5deee3d24e2727176b167898bbd0b245f983df6e3e0537f898f90973531d8f1		 ooxml-ole-object OOXML embedded OLE part: word/embeddings/nigggger4.ms-excel 65024 bytes
ooxml_oleobject_05.bin
03d7402d1707deb3b754ee094e9f79f2230a6022b70e10ce51056f765734c9f4		 ooxml-ole-object OOXML embedded OLE part: word/embeddings/nigggger3.ms-excel 65024 bytes
ooxml_oleobject_06.bin
2147ca8a41ca60587024d5ae8c8b0a6599476c2854d2621d3722b4e1424cbc8c		 ooxml-ole-object OOXML embedded OLE part: word/embeddings/nigggger2.ms-excel 65024 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.