Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 203fdd588617eb71…

MALICIOUS

Office (OLE)

171.0 KB Created: 2020-01-16 14:15:00 Authoring application: Microsoft Office Word First seen: 2020-02-04
MD5: 6caf5a61b1f26aed54f402c3f25daca9 SHA-1: 2d104f434a3f97a87b4a4b8236237f1ab0105d4d SHA-256: 203fdd588617eb71be13373d7fc6dd6e81f967a73c895f053346bbdf46d814b1
204 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The sample is a Microsoft Office document containing heavily obfuscated VBA macros. The 'Document_Open' macro, along with 'CreateObject' and execution sink calls, indicates an attempt to download and execute a second-stage payload. The VBA code uses Windows API calls for character encoding conversions, suggesting complex obfuscation techniques. No specific family could be identified due to the obfuscation.

Heuristics 7

  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 38589 bytes
SHA-256: e172dd03dbeaf638e3a49a16ea2257e9d4291953710031d33cd50a75fa769cbf
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Const CP_UTF8                       As Long = 65001

#If Win64 Then
Private Declare PtrSafe Function WideCharToMultiByte Lib "kernel32" (ByVal CodePage As LongPtr, ByVal dwFlags As LongPtr, ByVal lpWideCharStr As LongPtr, ByVal cchWideChar As LongPtr, lpMultiByteStr As Any, ByVal cchMultiByte As LongPtr, ByVal lpDefaultChar As LongPtr, ByVal lpUsedDefaultChar As LongPtr) As LongPtr
Private Declare PtrSafe Function MultiByteToWideChar Lib "kernel32" (ByVal CodePage As LongPtr, ByVal dwFlags As LongPtr, lpMultiByteStr As Any, ByVal cchMultiByte As LongPtr, ByVal lpWideCharStr As LongPtr, ByVal cchWideChar As LongPtr) As Long
#Else
Private Declare Function WideCharToMultiByte Lib "kernel32" (ByVal CodePage As Long, ByVal dwFlags As Long, ByVal lpWideCharStr As Long, ByVal cchWideChar As Long, lpMultiByteStr As Any, ByVal cchMultiByte As Long, ByVal lpDefaultChar As Long, ByVal lpUsedDefaultChar As Long) As Long
Private Declare Function MultiByteToWideChar Lib "kernel32" (ByVal CodePage As Long, ByVal dwFlags As Long, lpMultiByteStr As Any, ByVal cchMultiByte As Long, ByVal lpWideCharStr As Long, ByVal cchWideChar As Long) As Long

#End If
 

 
 Dim Befgter As Variant
 Dim flon As Variant
 
Sub Start()

max = 192617
tabs = 24 '17-24

    'DataCollection
    'AdressMatching
    'Ooo au ia?aa oeeuo?aoeae naaeaou ni?oe?iaeo ii eeoaaiio n??oo
    'A iiea yoi o?aaoaony aaeaou a?o?io?!
    Filter
    
    Message "Aioiai!"
    
End Sub

'Nai? aaiiuo ni anao oaaeeo
Private Sub DataCollection()
    
    CreateSheet tempSh
    Dim iWS As Worksheet
    s = 1
    max = 2
    For Each iWS In ThisWorkbook.Worksheets
        Call ProgressBar("Yoai 1: Iauaaeiaiea oaaeeo", s, ThisWorkbook.Worksheets.Count)
        If (iWS.name <> tempSh And iWS.name <> adrSh And iWS.name <> resultSh) Then
            'Eiie?iaaiea oaiee ec ia?aie no?aieou
            If Sheets(tempSh).Cells(1, 1) = "" Then
                tabs = 1
                Do While iWS.Cells(1, tabs) <> ""
                    Sheets(tempSh).Cells(1, tabs) = iWS.Cells(1, tabs)
                    tabs = tabs + 1
                Loop
                Sheets(tempSh).Cells(1, tabs) = "Oneoaa"
            End If
            'Eiie?iaaiea aaiiuo
            i = 2
            Do While iWS.Cells(i, 1) <> ""
                For j = 1 To tabs - 1
                    Sheets(tempSh).Cells(max, j) = iWS.Cells(i, j)
                Next
                Sheets(tempSh).Cells(max, tabs) = iWS.name
                i = i + 1
                max = max + 1
            Loop
        End If
        s = s + 1
    Next iWS
    max = max - 1
    CreateSheet resultSh
    
End Sub

'Niiinoaaeaiea ni ni?aai?ieeii aa?ania
Private Sub AdressMatching()
    
    'Eiaaenaoey
    
    Message "Eiaaenaoey aa?ania"
    
    Sheets(adrSh).Select
    iMax = 1
    i = 4
    ReDim Indexes(iMax) As adrIndex
    Indexes(iMax).adr = PrepareAdress(Cells(i, 1) + Cells(i, 2) + CStr(Cells(i, 3)))
    Indexes(iMax).iStart = i
    Indexes(iMax).iEnd = i
    Do While Cells(i, 1) <> ""
        If Indexes(iMax).adr = PrepareAdress(Cells(i, 1) + Cells(i, 2) + CStr(Cells(i, 3))) Then
            Indexes(iMax).iEnd = i
        Else
            iMax = iMax + 1
            ReDim Preserve Indexes(iMax) As adrIndex
            Indexes(iMax).adr = PrepareAdress(Cells(i, 1) + Cells(i, 2) + CStr(Cells(i, 3)))
            Indexes(iMax).iStart = i
            Indexes(iMax).iEnd = i
        End If
        i = i + 1
    Loop
    'For i = 1 To iMax
    '    Cells(i, 25) = indexes(i).adr
    '    Cells(i, 26) = indexes(i).iStart
    '    Cells(i, 27) = indexes(i).iEnd
    'Next
    
    'Iiene
    
    Sheets(tempSh).Select
    For j = 0 To 6
        Cells(1, tabs +
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.