MalwareBazaar Database

Office OLE Information

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

OLE id

OLE dump

MalwareBazaar was able to identify 7 sections in this file using oledump:

OLE vba

MalwareBazaar was able to extract and deobfuscate VBA script(s) the following information from OLE objects embedded in this file using olevba:

Intelligence

File Origin

Vendor Threat Intelligence

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

P0. 556117090.doc

Verdict:

Malicious activity

Analysis date:

2021-06-25 06:16:37 UTC

Tags:

macros macros-on-open generated-doc maldoc-23

Link:

https://app.any.run/tasks/bf257665-ef16-4cd7-9b64-ecb6ac0f516d

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

BitDam Malicious

Verdict:

Malicious

File type:

application/msword

Has a screenshot:

False

Contains macros:

True

ClamAV Detected

Detection(s):

TwinWave.EvilDoc.WSHCROVARCHRMATHLONGGONE.20200524.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Trojan.Script.Agent.AFC.26322.26615.UNOFFICIAL

Alert

Create hunting rule

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

Word File with Macro

Link:

https://app.docguard.net/e197309f79a43cdeccdc0b69344a36abc6c23fb8eef66063e4eb5cc443ee9d4d/results/dashboard

Document image

Image:

Download PNG

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/e197309f79a43cdeccdc0b69344a36abc6c23fb8eef66063e4eb5cc443ee9d4d

Details

Macro with Startup Hook

Detected macro logic that will automatically execute on document open. Most malware contains some execution hook.

Macro Execution Coercion

Detected a document that appears to social engineer the user into activating embedded logic.

Joe Sandbox FormBook

Result

Threat name:

FormBook

Alert

Create hunting rule

Detection:

malicious

Classification:

spre.troj.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/807922

Signature

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Detected unpacking (changes PE section rights)

DLL side loading technique detected

Document contains an embedded VBA macro which may execute processes

Document contains an embedded VBA macro with suspicious strings

Document contains an embedded VBA with many string operations indicating source code obfuscation

Document exploit detected (process start blacklist hit)

Found malware configuration

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Modifies the prolog of user mode functions (user mode inline hooks)

Multi AV Scanner detection for submitted file

Obfuscated command line found

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Queues an APC in another process (thread injection)

Sample uses process hollowing technique

Sigma detected: Microsoft Office Product Spawning Windows Shell

Sigma detected: msiexec download and execute

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

System process connects to network (likely due to code injection or exploit)

Tries to detect virtualization through RDTSC time measurements

Yara detected FormBook

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e197309f79a43cdeccdc0b69344a36abc6c23fb8eef66063e4eb5cc443ee9d4d/

ReversingLabs TitaniumCloud Script.Trojan.Wacatac

Threat name:

Script.Trojan.Wacatac

Alert

Create hunting rule

Status:

Malicious

First seen:

2021-06-24 14:35:48 UTC

AV detection:

11 of 46 (23.91%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=4gltbh3zuq6n5tg4bnutisrwvpdmep5y533gay7e5nomiq7otvgq._file

Hatching Triage formbook

Result

Malware family:

formbook

Alert

Create hunting rule

Score:

  10/10

Tags:

family:formbook macro rat spyware stealer trojan

Link:

https://tria.ge/reports/210625-fcswkdvrd2/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Modifies Internet Explorer settings

Modifies data under HKEY_USERS

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of UnmapMainImage

Suspicious use of WriteProcessMemory

NSIS installer

Office loads VBA resources, possible macro or embedded object present

Enumerates physical storage devices

Drops file in Windows directory

Suspicious use of SetThreadContext

Enumerates connected drives

Loads dropped DLL

Use of msiexec (install) with remote resource

Blocklisted process makes network request

Executes dropped EXE

Formbook Payload

Formbook

Process spawned unexpected child process

Malware Config

C2 Extraction:

http://www.fbrblog.com/k1rc/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/e197309f79a43cdeccdc0b69344a36abc6c23fb8eef66063e4eb5cc443ee9d4d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments