Malicious MS Word Document analysis – 0c0b86ceb037

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Microsoft Office Document

Size

28.51 KB · 28,509 B

First seen

2024-03-06 17:39 · 2 years ago

Last seen

2024-03-06 17:39 · 2 years ago

Last analysis

2024-07-20 01:02 · 2 years ago

Hashes

MD5 36a7ca05f49fbd4b8d261ecc918803ce Sha1 51d79eb03ce08e186fc8a22e1d40b8ebb51acc02 Sha256 0c0b86ceb037e3ad7f6ad5753d532355758f08e5aeb61d04042a48c0a701e298 Sha384 fc4b51b9456f198a09efba9292282bae55837bc6b900eae8b7a915f50bc45bd6da0da4ea2d4d52dc71a5b10b9e38e2cf Sha512 b59e3dfc5910521390d489b0cf4aa60e21c6e1a64725638bdb1ab8e8bdf9ae22afda06765b7613e52a6a220e1adcc3cde4cdf2425fe86d01526bbddc058bf15e SSDeep 384:/inJNbktOtisO5vFZZQcUxjvQWDTwJ7VcDHGr51kHVwfAeeS3R92FGzZFgp:/qICitZZ2jIM6cDeDZP2FOZFG TLSH 47D2E078C9405C6AEDF5C93FC054AAB6F599420087D582B95C75CB8CCF81CA39B91ACE

11 malicious · 36 files

DOCDoc1.docm

XML[Content_Types].xml

BIN_rels

BINword

XMLdocument.xml

BIN_rels

OFFvbaProject.bin

BIN.

BINRoot Entry

BINVBA

BINdir

VBAUserForm1

VBAThisDocument

VBA[Stored VBA]

VBS[PCode]

VBS[PCode].deobfuscated.vbs

VBA[Decompiled VBA]

VBS[Full Diff]

VBS[Full Diff].deobfuscated.vbs

VBS[Full Diff].deobfuscated.vbs.deobfuscated.vbs

VBA[Partial Diff]

BIN_VBA_PROJECT

BINPROJECT

BINPROJECTwm

BINUserForm1

BINtheme

XMLvbaData.xml

XMLsettings.xml

XMLstyles.xml

XMLwebSettings.xml

XMLfontTable.xml

BINdocProps

	Module Name0
	UserForm1	VBA Macro
	ThisDocument	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document VBA Macro
PCode Decompiled VBA Stored VBA Partial Diff. Full Diff. Missing P-Code: The Office document under analysis has been identified as having undergone VBA Purging techniques, as the P-Code block within the document is currently inaccessible. As a result, the decompilation of the code was not possible, leaving only the stored code available in textual format for analysis. VBA Purging essentially involves the elimination of the PerformanceCache section from the module streams. To fully erase any traces of the P-Code section, the MODULEOFFSET between the two sections is adjusted to 0 by altering the _VBA_PROJECT stream, and all SRP streams that also house PerformanceCache data are removed. Following the removal of the compiled code, antivirus engines and Yara rules, which depend on precise string matches, are rendered ineffective. This allows macros to bypass them effortlessly, owing to the compressed format of the remaining source code.