Malicious Office (OOXML) / .DOC — malware analysis report

Static analysis result for SHA-256 fd2287eb17ddf0cb…

MALICIOUS

Office (OOXML) / .DOC

18.4 KB Created: 2023-01-29 12:05:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2023-01-29
MD5: 15567870bd7776030e07bab42d913c59 SHA-1: 847dda37009dc8ca288f3d910cdd801ef1f3529d SHA-256: fd2287eb17ddf0cbdf8b4a67f46dcd86f9ae81ae62228a060d730bc49382e78d
262 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1105 Ingress Tool Transfer

This OOXML document contains VBA macros, specifically an Auto_Open macro, which is a common technique for initial execution. The script utilizes Windows API functions like VirtualAlloc, RtlMoveMemory, and CreateThread, indicating it's designed to allocate memory, copy shellcode into it, and then execute it. This strongly suggests the document acts as a dropper for a second-stage payload, as indicated by the ClamAV detection name 'Doc.Dropper.Valyria-6680543-0'.

Heuristics 7

  • ClamAV: Doc.Dropper.Valyria-6680543-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Valyria-6680543-0
  • ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV
    ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Workbook_Open macro high OLE_VBA_WBOPEN
    Workbook_Open macro
  • Auto_Open macro high OLE_VBA_AUTO
    Auto_Open macro
  • VBA project inside OOXML medium OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas
    • http://schemas.microsoft.com/office/drawing/2014/chartex
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartex
    • http://schemas.microsoft.com/office/drawing/2015/10/21/chartex
    • http://schemas.microsoft.com/office/drawing/2016/5/9/chartex
    • http://schemas.microsoft.com/office/drawing/2016/5/10/chartex
    • http://schemas.microsoft.com/office/drawing/2016/5/11/chartex
    • http://schemas.microsoft.com/office/drawing/2016/5/12/chartex
    • http://schemas.microsoft.com/office/drawing/2016/5/13/chartex
    • http://schemas.microsoft.com/office/drawing/2016/5/14/chartex
    • http://schemas.openxmlformats.org/markup-compatibility/2006
    • http://schemas.microsoft.com/office/drawing/2016/ink
    • http://schemas.microsoft.com/office/drawing/2017/model3d
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships
    • http://schemas.openxmlformats.org/officeDocument/2006/math
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawing
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawing
    • http://schemas.openxmlformats.org/wordprocessingml/2006/main
    • http://schemas.microsoft.com/office/word/2010/wordml
    • http://schemas.microsoft.com/office/word/2012/wordml
    • http://schemas.microsoft.com/office/word/2016/wordml/cid
    • http://schemas.microsoft.com/office/word/2015/wordml/symex
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroup
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInk
    • http://schemas.microsoft.com/office/word/2006/wordml
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShape

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
0ec7ff6d8eabde264f506c604e4ef7951000a31aaec239e430b032208d4d01e5		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 3875 bytes
vbaProject_00.bin
3d56cdc6b7a019733024efa6052ea9146dd0a68bf74986233c6735f26ebdf3c6		 vba-project OOXML VBA project: word/vbaProject.bin 15360 bytes
Detection
ClamAV: Doc.Dropper.Valyria-6680543-0
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.