Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 d0b78b97cdbc85a6…

MALICIOUS

Office (OOXML)

2.87 MB Created: 2014-01-06 11:01:00 UTC Authoring application: Microsoft Office Word 15.0000 First seen: 2018-01-08
MD5: bcee159f88e0acd4a58cd2be4418ebde SHA-1: 3bf22fdb3f321ce8752d0b7fd878525de128750f SHA-256: d0b78b97cdbc85a6d26e69107b718f1d298a3a482590b0a477cc39e8df3de229
350 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1566.001 Spearphishing Attachment

The sample is an OOXML document containing heavily obfuscated VBA macros. Heuristics indicate the presence of auto-executing macros (AutoOpen, Document_Open) that utilize CreateObject and Shell() calls, typical for downloading and executing further malicious content. The VBA code appears to be designed to bypass detection through obfuscation and custom decoding routines.

Heuristics 10

  • VBA project inside OOXML medium 8 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.allapi.net/ In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingCanvasIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 2712421 bytes
SHA-256: 817b9c376d179453ffb10814c58184aed56493a5c5e048953bc90159ec023235
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "FrmIndxChkPage"
Attribute VB_Base = "0{0D514452-5D5F-43BA-9DD6-2423ACED6BBD}{1046636E-976D-423B-872D-997F97640260}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Private Sub CommandButton1_Click()
'Application.Run MacroName:="مراجعةأرقام_صفحات_الفهارس"
Ch = 1
FrmIndxChkPage.Hide
End Sub
Private Sub CommandButton2_Click()
Ch = 2
FrmIndxChkPage.Hide
'Application.Run MacroName:="مراجعةأرقام_صفحات_الفهارس2"
End Sub
Private Sub CommandButton4_Click()
End
End Sub

Attribute VB_Name = "FrmOthersMultiCopy"
Attribute VB_Base = "0{E016C4C0-CBFC-47C6-9595-7148F1DF7C9A}{5ED5ADEE-0369-4B60-84B8-168AAB35F75A}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Private Sub CheckBox3_Click()
If CheckBox3 = True Then Fn2 = 2
If CheckBox3 = False Then Fn2 = 0
End Sub
Private Sub CommandButton1_Click()
sors = Selection
Selection.copy
If Fn2 = 2 Then
Selection.MoveRight Unit:=wdCharacter, Count:=1
Selection.MoveLeft Unit:=wdCharacter, Count:=1
'Selection.TypeText Text:=" "
'Selection.MoveLeft Unit:=wdCharacter, Count:=1
Selection.Fields.Add Range:=Selection.Range, Type:=wdFieldEmpty, Text:= _
"PAGE  \* Arabic ", PreserveFormatting:=True
Selection.MoveLeft Unit:=wdCharacter, Count:=1, Extend:=wdExtend
'Selection.MoveLeft Unit:=wdCharacter, Count:=2, Extend:=wdExtend
'Selection.Fields.Unlink
Pg = Selection
Selection.Delete Unit:=wdCharacter, Count:=1
End If
Nc = Nc + 1
mysource2.Activate
Selection.TypeText Text:=sors
Selection.Find.Execute FindText:=sors, Forward:=False, Wrap:=wdFindStop
Selection.MoveRight Unit:=wdCharacter, Count:=1
Selection.TypeText Text:=" " + Pg
'Selection.Paste
Selection.RtlRun
'Selection.TypeText Text:=vbTab + pg
Selection.TypeParagraph
Selection.WholeStory
Selection.copy
Selection.EndKey Unit:=wdStory
mysource1.Activate
End Sub
Private Sub CommandButton2_Click()
mysource2.Activate
Selection.WholeStory
Selection.copy
mysource1.Activate
Selection.Paste
'Selection = ""
'mysource2.Close SaveChanges:=wdDoNotSaveChanges
End Sub
Private Sub CommandButton3_Click()
On Error Resume Next
Selection = ""
mysource2.Close SaveChanges:=wdDoNotSaveChanges
End
End Sub
Private Sub CommandButton4_Click()
mysource2.Close SaveChanges:=wdDoNotSaveChanges
End
End Sub

Attribute VB_Name = "FrmRef1"
Attribute VB_Base = "0{D22B2482-1B91-4884-A7E0-8E9F9E3C1457}{5AA3969E-CF08-43B6-BE72-E35C1002F5A1}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Dim FileLoaded As Boolean
Dim OldKey As String
Dim Ref As Collection
Private Sub CommandButton1_Click()
Open "c:\saudmac2007-13\Obt\FrmRef1TrueOrFalse.txt" For Output As #9
Write #9, "FrmRef1"
Write #9, FrmRef1.CheckBox5.Value
Write #9, FrmRef1.CBHash.Value
Write #9, FrmRef1.CheckBox4.Value
Close (9)
End
End Sub
Private Sub CommandButton2_Click()
Dim Sp
If Hash = 1 Then
ActiveWindow.ActivePane.Next.Activate
End If
If FrmRef1.CheckBox5 = False Then Sp = " "
If FrmRef1.CBHash = True Then
Selection.TypeText Text:="<"
End If
If FrmRef1.CheckBox5 = True Then
Selection.TypeText Text:="+["
End If
Selection.Text = ListResult.Text & Sp
Selection.MoveRight Unit:=wdCharacter, Count:=1
If FrmRef1.CheckBox5 = True Then
Selection.TypeText Text:="]"
End If
If FrmRef1.CBHash = True Then
Selection.TypeText Text:=">"
End If


... (truncated)
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 8201216 bytes
SHA-256: 03915471f7999ed13700664242f6906bfb5531e1586fc02f3cbd4e325be6f709

Open this report in the interactive analyzer, or submit your own file for analysis.