Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 fada3dc69fa71eac…

MALICIOUS

Office (OOXML)

26.5 KB Created: 2021-06-08 15:09:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2021-06-30
MD5: 4e8913e7859e14b2246f2d2c827f2eed SHA-1: 104a7b1b30ea23a059be9099176606b114250725 SHA-256: fada3dc69fa71eacc4df2a7dcbaa7027f0fdd93c8dac2ef75563ee86f8a5503b
142 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1027 Obfuscated Files or Information T1497.001 System Checks: System Identification

The sample is an OOXML document containing a VBA project with an AutoOpen macro, indicating malicious intent. The VBA code includes functions to check for virtual machine artifacts and the number of running tasks, suggesting an attempt to evade analysis. The presence of the AutoOpen macro and the evasion techniques point towards a downloader or droppper functionality, though no direct payload delivery mechanism was observed.

Heuristics 5

  • VBA project inside OOXML medium 3 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2015/10/21/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/9/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/10/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/11/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/12/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/13/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/14/chartexIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/inkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2017/model3dIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2018/wordml/cexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2016/wordml/cidIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2018/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2020/wordml/sdtdatahashIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2015/wordml/symexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 4228 bytes
SHA-256: 0aa33e6cce77c4dd22961d523900b7697aa534c23b93cb7868993479741b7aef
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "AutoOpen"
Sub Main()
    On Error Resume Next
    A = checkRecentDocs()
    B = checkNbrOfTask()
    C = checkBios()
    D = checkPnP()
    E = checkUsername()
    F = checkFilenameHash()
    G = checkFilenameBad()
    H = checkPreciseFileName()
    I = checkAppCount()
    
    J = A And B And C And D And E And F And G And H And I
    If J = True Then
        MsgBox (J)
    Else
        MsgBox (J)
    End If
End Sub


Public Function checkRecentDocs()
    If Application.RecentFiles.Count < 3 Then
        checkRecentDocs = False
    Else
        checkRecentDocs = True
    End If
End Function


Public Function checkNbrOfTask()
    If Application.Tasks.Count < 3 Then
        checkNbrOfTask = False
    Else
        checkNbrOfTask = True
    End If
End Function


Public Function checkBios()
    badBios = False
    badBiosNames = Array("virtualbox", "vmware", "kvm")
    Set objWMIService = GetObject("winmgmts:\\.\root\cimv2")
    Set colItems = objWMIService.ExecQuery("Select * from Win32_Bios", , 48)
    For Each objItem In colItems
        For Each badName In badBiosNames
            If InStr(LCase(objItem.SMBIOSBIOSVersion), badName) > 0 Then
                badBios = True
            End If
            If InStr(LCase(objItem.SerialNumber), badName) > 0 Then
                badBios = True
            End If
        Next
    Next
    If badBios Then
        checkBios = False
    Else
        checkBios = True
    End If
End Function


Public Function checkPnP()
    badPNP = False
    badPNPNames = Array("VEN_80EE", "VEN_15AD")
    Set objWMIService = GetObject("winmgmts:\\.\root\cimv2")
    Set colItems = objWMIService.ExecQuery("Select * from Win32_PnPEntity", , 48)
    For Each objItem In colItems
        For Each badName In badPNPNames
            If InStr(LCase(objItem.DeviceId), badName) > 0 Then
                badPNP = True
            End If
        Next
    Next
    If badPNP Then
        checkPnP = False
    Else
        checkPnP = True
    End If
End Function


Public Function checkUsername()
    badUsername = False
    badUsernames = Array("admin", "malfind", "sandbox", "test")
    Set objWMIService = GetObject("winmgmts:\\.\root\cimv2")
    Set colItems = objWMIService.ExecQuery("Select * from Win32_ComputerSystem", , 48)
    For Each objItem In colItems
        For Each badName In badUsernames
            If InStr(LCase(objItem.UserName), badName) > 0 Then
                badUsername = True
            End If
        Next
    Next
    If badUsername Then
        checkUsername = False
    Else
        checkUsername = True
    End If
End Function


Public Function checkFilenameHash()
    hexchars = "0123456789abcdef"
    C = 0
    For I = 1 To Len(ThisDocument.Name)
        s = Mid(LCase(ThisDocument.Name), I, 1)
        If InStr(s, hexchars) > 0 Then
            C = C + 1
        End If
    Next
    If C >= (Len(ThisDocument.Name) - 5) Then
        checkFilenameHash = False
    Else
        checkFilenameHash = True
    End If
End Function


Public Function checkFilenameBad()
    badName = False
    badNames = Array("malware", "myapp", "sample", ".bin", "mlwr_", "Desktop")
    For Each n In badNames
        If InStr(LCase(ActiveDocument.FullName), n) > 0 Then
            badName = True
        End If
    Next
    If badName Then
        checkFilenameBad = False
    Else
        checkFilenameBad = True
    End If
End Function


Public Function checkPreciseFileName() As Boolean
    If ActiveDocument.Name = "MyDocument.docm" Then
        checkPreciseFileName = True
    Else
        checkPreciseFileName = False
    End If
End Function


Public Function checkAppCount()
    I
... (truncated)
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 38400 bytes
SHA-256: bf018b24762d80375dd74a4263346accec9cc97540d3f525a467d37f264cc31b
emf_00.emf ooxml-emf OOXML EMF part: docProps/thumbnail.emf 3316 bytes
SHA-256: b036ef7cfa114ecae0c14c6e3ab34eeb48dc5893e82b1bd9926a17ada49906dc

Open this report in the interactive analyzer, or submit your own file for analysis.