Malicious Office (OOXML) / .DOCM — malware analysis report

Static analysis result for SHA-256 e59b23b42034db8b…

MALICIOUS

Office (OOXML) / .DOCM

19.1 KB Authoring application: Microsoft Office Word 12.0000 First seen: 2022-10-19
MD5: f7a5606f85f869820c35244db0e14559 SHA-1: b4593f522f0d4f59365e62773275fe9589fae50c SHA-256: e59b23b42034db8b276cfbde516fe396cfd53ee40b3880c3c38e37b79846a314
182 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Service Execution: Visual Basic T1059.003 Service Execution: Windows Command Shell T1105 Ingress Tool Transfer T1204.002 Malicious Link: Malicious File

The sample is a macro-enabled document (DOCM) that contains an AutoOpen macro. This macro executes a command that uses curl to download a file named '3AU.exe' from 'https://oceaniccolor.com/mp/3AU.exe' and then executes it. The document also contains a lure to enable content, which is a common tactic for macro-based malware.

Heuristics 6

  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • cmd.exe reference in VBA high OLE_VBA_CMD
    cmd.exe reference in VBA
  • VBA project inside OOXML medium OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://oceaniccolor.com/mp/3AU.exe
    • http://schemas.openxmlformats.org/markup-compatibility/2006
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships
    • http://schemas.openxmlformats.org/officeDocument/2006/math
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawing
    • http://schemas.openxmlformats.org/wordprocessingml/2006/main
    • http://schemas.microsoft.com/office/word/2006/wordml
    • https://products.aspose.com/words/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
a273743e6336d1bd202ddce5ed4d7b91079796d242be4d5d411fe89e92ad03e9		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 119 bytes
vbaProject_00.bin
46d809734ce5f9ee628006cb4cf12636da6ed596f1c05165ace1c3e794eee5a3		 vba-project OOXML VBA project: word/vbaProject.bin 3584 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.