Office (OOXML) malware analysis — malicious · ebf17b248146bbdd

MALICIOUS

Office (OOXML)

35.7 KB Created: 2020-10-29 06:45:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2020-11-12

MD5: 74c06ff8f5d7baa78edfc6866ee17182 SHA-1: 680c427ef3260348173822101c8e2f20b2b127fa SHA-256: ebf17b248146bbddce2b292048d4c08f7705f010dde0b3be0001fb6ebc686eb5

124 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 User Execution: Malicious File T1059.007 JavaScript

This OOXML document contains an embedded OLE object that is designed to drop a JavaScript file. The heuristic 'OFFICE_PACKAGE_RISKY_FILE' indicates that the package drops an auto-executable payload named 'GWAMPR_ASIA_INV_VAR_BACKUp.js'. This JavaScript payload likely downloads and executes a second-stage payload from the recovered URL 'http://dto.wa.ca.com/application'. The presence of an embedded object and a dropped script suggests a malicious document intended to deliver further malware.

Heuristics 5

Ole10Native package drops an auto-executable payload critical OFFICE_PACKAGE_RISKY_FILE

OLE Package displayName or fullPath ends in a directly auto-executable extension (a runnable binary or a script the default shell host runs on double-click). Embedding such a payload inside an Office document has no benign authoring use — it is a malware-delivery dropper.
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded OLE object medium OOXML_OLE_OBJECT

Document contains an embedded OLE object
Payload URL recovered from embedded OLE object (1 URL) info OOXML_EMBEDDED_OBJECT_URL

An embedded OLE object (xl/word/ppt embeddings) carries a next-stage download URL in its Ole10Native/Package stream — stored literally (incl. UTF-16) or base64-encoded — which the package-level URL sweep does not see. Surfaced as an IOC; self-validating (only real payload hosts).
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2015/9/8/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2015/10/21/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/9/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/10/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/11/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/12/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/13/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/14/chartexIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/inkIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2017/model3dIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2016/wordml/cidIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2015/wordml/symexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)
- http://dto.wa.ca.com/applicationIn document text (OOXML body / shared strings)

Extracted artifacts 8

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`ooxml_oleobject_00.bin`	ooxml-ole-object	OOXML embedded OLE part: word/embeddings/oleObject2.bin	31744 bytes
SHA-256: `0a24506bf3fa52d2e77479af091c3602903bb5f329f67313953f0f6e4343aaaf`
Detection ClamAV: No threats found Obfuscation or payload: likely Static shellcode analysis recovered command string(s): cmdname>%(powershell_system32_cmd)</app:cmdname><app:is_interactive_job>false</app:is_interactive_job></nt_job><nt_job name="EXECUTE_BBG_FEED_UPLOAD"><dependencies
`ooxml_oleobject_00_ole10native_00.bin`	ole-package	OOXML word/embeddings/oleObject2.bin Ole10Native stream: Ole10Native	28806 bytes
SHA-256: `1cb652afd6823b7ca701f9adda8b07b126f4c331c6cee87b6ca43487e145cdc8`
Detection ClamAV: No threats found Obfuscation or payload: likely Static shellcode analysis recovered command string(s): cmdname>%(powershell_system32_cmd)</app:cmdname><app:is_interactive_job>false</app:is_interactive_job></nt_job><nt_job name="EXECUTE_BBG_FEED_UPLOAD"><dependencies
`ooxml_oleobject_00_ole10native_00_GWAMPR_ASIA_INV_BBG_AUDIT_REPORT_7000_BACKUP.xml`	ole-package-payload	OOXML word/embeddings/oleObject2.bin Ole10Native payload: display_name=GWAMPR_ASIA_INV_BBG_AUDIT_REPORT_7000_BACKUP.xml; full_path=C:\Users\fullora\AppData\Local\Temp\GWAMPR_ASIA_INV_BBG_AUDIT_REPORT_7000_BACKUP.xml; temp_path=; def_file=	28017 bytes
SHA-256: `88240bc40d69d40e69da8b9ccfce8af6c2f8f1b7dd1f4f3437a4a737c7d9934e`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 7 shell/COM execution token(s).
`ooxml_oleobject_01.bin`	ooxml-ole-object	OOXML embedded OLE part: word/embeddings/oleObject1.bin	29696 bytes
SHA-256: `62a9da3be7574721b3fbb689d7be617a3038b90940dabc8e2cf896b96f37b1a5`
Detection ClamAV: No threats found Obfuscation or payload: likely Static shellcode analysis recovered command string(s): cmd = 'c:\\windows\\system32\\cmd.exe';, powershell_system32_cmd = 'C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe';
`ooxml_oleobject_01_ole10native_00.bin`	ole-package	OOXML word/embeddings/oleObject1.bin Ole10Native stream: Ole10Native	27132 bytes
SHA-256: `f15831d4478546decc92f1a80779dbb19a693fc111da9af04018ec7189d61162`
Detection ClamAV: No threats found Obfuscation or payload: likely Static shellcode analysis recovered command string(s): cmd = 'c:\\windows\\system32\\cmd.exe';, powershell_system32_cmd = 'C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe';
`ooxml_oleobject_01_ole10native_00_GWAMPR_ASIA_INV_VAR_BACKUp.js`	ole-package-payload	OOXML word/embeddings/oleObject1.bin Ole10Native payload: display_name=GWAMPR_ASIA_INV_VAR_BACKUp.js; full_path=C:\Users\fullora\AppData\Local\Temp\GWAMPR_ASIA_INV_VAR_BACKUp.js; temp_path=; def_file=	26514 bytes
SHA-256: `0917eb387d33bd312f7c48488413cdf392255a02cced55ffa8797bde726b4c10`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 4 shell/COM execution token(s).
`emf_00.emf`	ooxml-emf	OOXML EMF part: word/media/image1.emf	5724 bytes
SHA-256: `bdc4b8ce5e0d94d3b6746a9f1b97bcd9af6519326ab24ed2dd6ef72687fd01be`
`emf_01.emf`	ooxml-emf	OOXML EMF part: word/media/image2.emf	5880 bytes
SHA-256: `5050a593b05c2a2d76777ff42b60797de2042ffe099feba93588bb315394bf09`

Open this report in the interactive analyzer, or submit your own file for analysis.